Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.Trojan.GenericKD.46442270.25635.17664

Overview

General Information

Sample Name:SecuriteInfo.com.Trojan.GenericKD.46442270.25635.17664 (renamed file extension from 17664 to exe)
Analysis ID:430707
MD5:853744502b68e50e6cbaf81ffb3f5cc0
SHA1:ea748baebe70d7c6d3da9d1a2a34b76051425962
SHA256:8115607710c35c78eda8dd16d73cab92e2c857d8c91eb1422fcc1b3f06835a4a
Tags:exe
Infos:

Most interesting Screenshot:

Detection

GuLoader Remcos
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected GuLoader
Yara detected Remcos RAT
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Sigma detected: WScript or CScript Dropper
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe (PID: 6696 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
    • SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe (PID: 7080 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
      • wscript.exe (PID: 6480 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\install.vbs' MD5: 7075DD7B9BE8807FCA93ACD86F724884)
        • cmd.exe (PID: 6884 cmdline: 'C:\Windows\System32\cmd.exe' /c 'C:\Users\user\AppData\Roaming\win.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
          • conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • win.exe (PID: 5128 cmdline: C:\Users\user\AppData\Roaming\win.exe MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
            • win.exe (PID: 2796 cmdline: C:\Users\user\AppData\Roaming\win.exe MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
    • backgroundTaskHost.exe (PID: 7080 cmdline: 'C:\Windows\system32\backgroundTaskHost.exe' -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)
  • win.exe (PID: 5844 cmdline: 'C:\Users\user\AppData\Roaming\win.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
    • win.exe (PID: 5604 cmdline: 'C:\Users\user\AppData\Roaming\win.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
  • win.exe (PID: 5852 cmdline: 'C:\Users\user\AppData\Roaming\win.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
    • win.exe (PID: 5544 cmdline: 'C:\Users\user\AppData\Roaming\win.exe' MD5: 853744502B68E50E6CBAF81FFB3F5CC0)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://ztechinternational.com/dk/Jice_remcos%202_vOOXAzQx82.bin"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000017.00000002.846829596.00000000023B0000.00000004.00000040.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000000.00000002.384201388.00000000020B0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
      00000004.00000000.383895844.0000000000560000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
        00000012.00000002.644122683.00000000020B0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          00000016.00000002.660151221.0000000000560000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
            Click to see the 7 entries

            Sigma Overview

            System Summary:

            barindex
            Sigma detected: WScript or CScript DropperShow sources
            Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (rule), oscd.community: Data: Command: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\install.vbs' , CommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\install.vbs' , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe' , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exe, ParentProcessId: 7080, ProcessCommandLine: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\install.vbs' , ProcessId: 6480

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: 00000000.00000002.384201388.00000000020B0000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "http://ztechinternational.com/dk/Jice_remcos%202_vOOXAzQx82.bin"}
            Yara detected Remcos RATShow sources
            Source: Yara matchFile source: 00000017.00000002.846829596.00000000023B0000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: win.exe PID: 2796, type: MEMORY
            Source: SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: http://ztechinternational.com/dk/Jice_remcos%202_vOOXAzQx82.bin
            Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_005698CB LoadLibraryA,InternetReadFile,24_2_005698CB
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /dk/Jice_remcos%202_vOOXAzQx82.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: ztechinternational.comCache-Control: no-cache
            Source: unknownDNS traffic detected: queries for: ztechinternational.com
            Source: win.exe, 00000016.00000002.660151221.0000000000560000.00000040.00000001.sdmp, win.exe, 00000018.00000002.679457919.0000000000560000.00000040.00000001.sdmpString found in binary or memory: http://ztechinternational.com/dk/Jice_remcos%202_vOOXAzQx82.bin

            E-Banking Fraud:

            barindex
            Yara detected Remcos RATShow sources
            Source: Yara matchFile source: 00000017.00000002.846829596.00000000023B0000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: win.exe PID: 2796, type: MEMORY

            System Summary:

            barindex
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeProcess Stats: CPU usage > 98%
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9417 NtProtectVirtualMemory,0_2_020B9417
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0CBA D3DKMTSetStablePowerState,NtWriteVirtualMemory,TerminateProcess,0_2_020B0CBA
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5CB3 NtAllocateVirtualMemory,0_2_020B5CB3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B98CB LoadLibraryA,NtResumeThread,0_2_020B98CB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1D2E NtWriteVirtualMemory,LoadLibraryA,0_2_020B1D2E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A03 NtResumeThread,0_2_020B9A03
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A2F NtResumeThread,0_2_020B9A2F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A27 NtWriteVirtualMemory,0_2_020B4A27
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4638 NtWriteVirtualMemory,0_2_020B4638
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3E30 NtWriteVirtualMemory,0_2_020B3E30
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5230 NtWriteVirtualMemory,0_2_020B5230
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4E36 NtWriteVirtualMemory,0_2_020B4E36
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A41 NtResumeThread,0_2_020B9A41
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5E47 NtAllocateVirtualMemory,0_2_020B5E47
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A57 NtResumeThread,0_2_020B9A57
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B7E78 NtWriteVirtualMemory,0_2_020B7E78
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A73 NtWriteVirtualMemory,0_2_020B4A73
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A74 NtResumeThread,0_2_020B9A74
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B528D NtWriteVirtualMemory,0_2_020B528D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A87 NtWriteVirtualMemory,0_2_020B4A87
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4E99 NtWriteVirtualMemory,0_2_020B4E99
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9A95 NtResumeThread,0_2_020B9A95
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4694 NtWriteVirtualMemory,0_2_020B4694
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5EA8 NtAllocateVirtualMemory,0_2_020B5EA8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9AAF NtResumeThread,0_2_020B9AAF
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4AA0 NtWriteVirtualMemory,0_2_020B4AA0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B46D3 NtWriteVirtualMemory,0_2_020B46D3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1ED7 NtWriteVirtualMemory,0_2_020B1ED7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9AEC NtResumeThread,0_2_020B9AEC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2B01 NtWriteVirtualMemory,0_2_020B2B01
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B00 NtWriteVirtualMemory,0_2_020B4B00
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4F14 NtWriteVirtualMemory,0_2_020B4F14
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B2D NtWriteVirtualMemory,0_2_020B4B2D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B25 NtWriteVirtualMemory,0_2_020B4B25
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2F3E NtWriteVirtualMemory,LoadLibraryA,0_2_020B2F3E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9B4B NtResumeThread,0_2_020B9B4B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B5C NtWriteVirtualMemory,0_2_020B4B5C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4F8C NtWriteVirtualMemory,0_2_020B4F8C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9B83 NtResumeThread,0_2_020B9B83
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4797 NtWriteVirtualMemory,0_2_020B4797
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4FB8 NtWriteVirtualMemory,0_2_020B4FB8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8BBE NtWriteVirtualMemory,0_2_020B8BBE
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4BB0 NtWriteVirtualMemory,0_2_020B4BB0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9BCB NtResumeThread,0_2_020B9BCB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B93CD NtProtectVirtualMemory,0_2_020B93CD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B47F4 NtWriteVirtualMemory,0_2_020B47F4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4C16 NtWriteVirtualMemory,0_2_020B4C16
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9C14 NtResumeThread,0_2_020B9C14
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5023 NtWriteVirtualMemory,0_2_020B5023
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4847 NtWriteVirtualMemory,0_2_020B4847
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4C68 NtWriteVirtualMemory,0_2_020B4C68
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B506F NtWriteVirtualMemory,0_2_020B506F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4899 NtWriteVirtualMemory,0_2_020B4899
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B44CF NtWriteVirtualMemory,0_2_020B44CF
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B50C5 NtWriteVirtualMemory,0_2_020B50C5
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5CD9 NtAllocateVirtualMemory,0_2_020B5CD9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B98D8 NtResumeThread,0_2_020B98D8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B48E3 NtWriteVirtualMemory,0_2_020B48E3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4CE4 NtWriteVirtualMemory,0_2_020B4CE4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5CE4 NtAllocateVirtualMemory,0_2_020B5CE4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B60FA NtWriteVirtualMemory,0_2_020B60FA
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B28FE NtWriteVirtualMemory,LoadLibraryA,0_2_020B28FE
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B98F3 NtResumeThread,0_2_020B98F3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4D2A NtWriteVirtualMemory,0_2_020B4D2A
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5D21 NtAllocateVirtualMemory,0_2_020B5D21
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4520 NtWriteVirtualMemory,0_2_020B4520
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9933 NtResumeThread,0_2_020B9933
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4948 NtWriteVirtualMemory,0_2_020B4948
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5146 NtWriteVirtualMemory,0_2_020B5146
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B995D NtResumeThread,0_2_020B995D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B9951 NtResumeThread,0_2_020B9951
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B996E NtResumeThread,0_2_020B996E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5D71 NtAllocateVirtualMemory,0_2_020B5D71
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4570 NtWriteVirtualMemory,0_2_020B4570
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B518F NtWriteVirtualMemory,0_2_020B518F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4D83 NtWriteVirtualMemory,0_2_020B4D83
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4985 NtWriteVirtualMemory,0_2_020B4985
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B999B NtResumeThread,0_2_020B999B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5D90 NtAllocateVirtualMemory,0_2_020B5D90
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5DAD NtAllocateVirtualMemory,0_2_020B5DAD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B45B5 NtWriteVirtualMemory,0_2_020B45B5
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B51C7 NtWriteVirtualMemory,0_2_020B51C7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4DE9 NtWriteVirtualMemory,0_2_020B4DE9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5DE9 NtAllocateVirtualMemory,0_2_020B5DE9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B99E9 NtResumeThread,0_2_020B99E9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B45E0 NtWriteVirtualMemory,0_2_020B45E0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B45E4 NtWriteVirtualMemory,0_2_020B45E4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B45F9 NtWriteVirtualMemory,0_2_020B45F9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B49F4 NtWriteVirtualMemory,0_2_020B49F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9417 NtProtectVirtualMemory,16_2_020B9417
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B0CBA D3DKMTSetStablePowerState,NtWriteVirtualMemory,TerminateProcess,16_2_020B0CBA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5CB3 NtAllocateVirtualMemory,16_2_020B5CB3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B98CB LoadLibraryA,NtUnmapViewOfSection,16_2_020B98CB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B1D2E NtWriteVirtualMemory,LoadLibraryA,16_2_020B1D2E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A03 NtUnmapViewOfSection,16_2_020B9A03
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A2F NtUnmapViewOfSection,16_2_020B9A2F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4A27 NtWriteVirtualMemory,16_2_020B4A27
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4638 NtWriteVirtualMemory,16_2_020B4638
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B3E30 NtWriteVirtualMemory,16_2_020B3E30
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5230 NtWriteVirtualMemory,16_2_020B5230
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4E36 NtWriteVirtualMemory,16_2_020B4E36
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A41 NtUnmapViewOfSection,16_2_020B9A41
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5E47 NtAllocateVirtualMemory,16_2_020B5E47
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A57 NtUnmapViewOfSection,16_2_020B9A57
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B7E78 NtWriteVirtualMemory,16_2_020B7E78
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4A73 NtWriteVirtualMemory,16_2_020B4A73
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A74 NtUnmapViewOfSection,16_2_020B9A74
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B528D NtWriteVirtualMemory,16_2_020B528D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4A87 NtWriteVirtualMemory,16_2_020B4A87
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4E99 NtWriteVirtualMemory,16_2_020B4E99
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9A95 NtUnmapViewOfSection,16_2_020B9A95
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4694 NtWriteVirtualMemory,16_2_020B4694
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5EA8 NtAllocateVirtualMemory,16_2_020B5EA8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9AAF NtUnmapViewOfSection,16_2_020B9AAF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4AA0 NtWriteVirtualMemory,16_2_020B4AA0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B46D3 NtWriteVirtualMemory,16_2_020B46D3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B1ED7 NtWriteVirtualMemory,16_2_020B1ED7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9AEC NtUnmapViewOfSection,16_2_020B9AEC
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B2B01 NtWriteVirtualMemory,16_2_020B2B01
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4B00 NtWriteVirtualMemory,16_2_020B4B00
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4F14 NtWriteVirtualMemory,16_2_020B4F14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4B2D NtWriteVirtualMemory,16_2_020B4B2D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4B25 NtWriteVirtualMemory,16_2_020B4B25
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B2F3E NtWriteVirtualMemory,LoadLibraryA,16_2_020B2F3E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9B4B NtUnmapViewOfSection,16_2_020B9B4B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4B5C NtWriteVirtualMemory,16_2_020B4B5C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4F8C NtWriteVirtualMemory,16_2_020B4F8C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9B83 NtUnmapViewOfSection,16_2_020B9B83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4797 NtWriteVirtualMemory,16_2_020B4797
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4FB8 NtWriteVirtualMemory,16_2_020B4FB8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B8BBE NtWriteVirtualMemory,16_2_020B8BBE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4BB0 NtWriteVirtualMemory,16_2_020B4BB0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9BCB NtUnmapViewOfSection,16_2_020B9BCB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B93CD NtProtectVirtualMemory,16_2_020B93CD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B47F4 NtWriteVirtualMemory,16_2_020B47F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4C16 NtWriteVirtualMemory,16_2_020B4C16
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9C14 NtUnmapViewOfSection,16_2_020B9C14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5023 NtWriteVirtualMemory,16_2_020B5023
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4847 NtWriteVirtualMemory,16_2_020B4847
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4C68 NtWriteVirtualMemory,16_2_020B4C68
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B506F NtWriteVirtualMemory,16_2_020B506F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4899 NtWriteVirtualMemory,16_2_020B4899
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B44CF NtWriteVirtualMemory,16_2_020B44CF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B50C5 NtWriteVirtualMemory,16_2_020B50C5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5CD9 NtAllocateVirtualMemory,16_2_020B5CD9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B98D8 NtUnmapViewOfSection,16_2_020B98D8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B48E3 NtWriteVirtualMemory,16_2_020B48E3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4CE4 NtWriteVirtualMemory,16_2_020B4CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5CE4 NtAllocateVirtualMemory,16_2_020B5CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B60FA NtWriteVirtualMemory,16_2_020B60FA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B28FE NtWriteVirtualMemory,LoadLibraryA,16_2_020B28FE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B98F3 NtUnmapViewOfSection,16_2_020B98F3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4D2A NtWriteVirtualMemory,16_2_020B4D2A
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5D21 NtAllocateVirtualMemory,16_2_020B5D21
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4520 NtWriteVirtualMemory,16_2_020B4520
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9933 NtUnmapViewOfSection,16_2_020B9933
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4948 NtWriteVirtualMemory,16_2_020B4948
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5146 NtWriteVirtualMemory,16_2_020B5146
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B995D NtUnmapViewOfSection,16_2_020B995D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B9951 NtUnmapViewOfSection,16_2_020B9951
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B996E NtUnmapViewOfSection,16_2_020B996E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5D71 NtAllocateVirtualMemory,16_2_020B5D71
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4570 NtWriteVirtualMemory,16_2_020B4570
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B518F NtWriteVirtualMemory,16_2_020B518F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4D83 NtWriteVirtualMemory,16_2_020B4D83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4985 NtWriteVirtualMemory,16_2_020B4985
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B999B NtUnmapViewOfSection,16_2_020B999B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5D90 NtAllocateVirtualMemory,16_2_020B5D90
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5DAD NtAllocateVirtualMemory,16_2_020B5DAD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B45B5 NtWriteVirtualMemory,16_2_020B45B5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B51C7 NtWriteVirtualMemory,16_2_020B51C7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B4DE9 NtWriteVirtualMemory,16_2_020B4DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B5DE9 NtAllocateVirtualMemory,16_2_020B5DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B99E9 NtUnmapViewOfSection,16_2_020B99E9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B45E0 NtWriteVirtualMemory,16_2_020B45E0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B45E4 NtWriteVirtualMemory,16_2_020B45E4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B45F9 NtWriteVirtualMemory,16_2_020B45F9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 16_2_020B49F4 NtWriteVirtualMemory,16_2_020B49F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9417 NtProtectVirtualMemory,17_2_007A9417
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A98CB LoadLibraryA,NtMapViewOfSection,17_2_007A98CB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A0CBA D3DKMTSetStablePowerState,NtWriteVirtualMemory,TerminateProcess,17_2_007A0CBA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5CB3 NtAllocateVirtualMemory,17_2_007A5CB3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A1D2E NtWriteVirtualMemory,LoadLibraryA,17_2_007A1D2E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4C68 NtWriteVirtualMemory,17_2_007A4C68
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A506F NtWriteVirtualMemory,17_2_007A506F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4847 NtWriteVirtualMemory,17_2_007A4847
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5023 NtWriteVirtualMemory,17_2_007A5023
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4C16 NtWriteVirtualMemory,17_2_007A4C16
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9C14 NtMapViewOfSection,17_2_007A9C14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A60FA NtWriteVirtualMemory,17_2_007A60FA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A28FE NtWriteVirtualMemory,LoadLibraryA,17_2_007A28FE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A98F3 NtMapViewOfSection,17_2_007A98F3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A48E3 NtWriteVirtualMemory,17_2_007A48E3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4CE4 NtWriteVirtualMemory,17_2_007A4CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5CE4 NtAllocateVirtualMemory,17_2_007A5CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A98D8 NtMapViewOfSection,17_2_007A98D8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5CD9 NtAllocateVirtualMemory,17_2_007A5CD9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A44CF NtWriteVirtualMemory,17_2_007A44CF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A50C5 NtWriteVirtualMemory,17_2_007A50C5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4899 NtWriteVirtualMemory,17_2_007A4899
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4570 NtWriteVirtualMemory,17_2_007A4570
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5D71 NtAllocateVirtualMemory,17_2_007A5D71
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A996E NtMapViewOfSection,17_2_007A996E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A995D NtMapViewOfSection,17_2_007A995D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9951 NtMapViewOfSection,17_2_007A9951
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4948 NtWriteVirtualMemory,17_2_007A4948
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5146 NtWriteVirtualMemory,17_2_007A5146
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9933 NtMapViewOfSection,17_2_007A9933
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4D2A NtWriteVirtualMemory,17_2_007A4D2A
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4520 NtWriteVirtualMemory,17_2_007A4520
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5D21 NtAllocateVirtualMemory,17_2_007A5D21
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A45F9 NtWriteVirtualMemory,17_2_007A45F9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A49F4 NtWriteVirtualMemory,17_2_007A49F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4DE9 NtWriteVirtualMemory,17_2_007A4DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5DE9 NtAllocateVirtualMemory,17_2_007A5DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A99E9 NtMapViewOfSection,17_2_007A99E9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A45E0 NtWriteVirtualMemory,17_2_007A45E0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A45E4 NtWriteVirtualMemory,17_2_007A45E4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A51C7 NtWriteVirtualMemory,17_2_007A51C7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A45B5 NtWriteVirtualMemory,17_2_007A45B5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5DAD NtAllocateVirtualMemory,17_2_007A5DAD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A999B NtMapViewOfSection,17_2_007A999B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5D90 NtAllocateVirtualMemory,17_2_007A5D90
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A518F NtWriteVirtualMemory,17_2_007A518F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4D83 NtWriteVirtualMemory,17_2_007A4D83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4985 NtWriteVirtualMemory,17_2_007A4985
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A7E78 NtWriteVirtualMemory,17_2_007A7E78
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4A73 NtWriteVirtualMemory,17_2_007A4A73
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A74 NtMapViewOfSection,17_2_007A9A74
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A57 NtMapViewOfSection,17_2_007A9A57
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A41 NtMapViewOfSection,17_2_007A9A41
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5E47 NtAllocateVirtualMemory,17_2_007A5E47
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4638 NtWriteVirtualMemory,17_2_007A4638
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A3E30 NtWriteVirtualMemory,17_2_007A3E30
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5230 NtWriteVirtualMemory,17_2_007A5230
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4E36 NtWriteVirtualMemory,17_2_007A4E36
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A2F NtMapViewOfSection,17_2_007A9A2F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4A27 NtWriteVirtualMemory,17_2_007A4A27
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A03 NtMapViewOfSection,17_2_007A9A03
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9AEC NtMapViewOfSection,17_2_007A9AEC
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A46D3 NtWriteVirtualMemory,17_2_007A46D3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A1ED7 NtWriteVirtualMemory,17_2_007A1ED7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A5EA8 NtAllocateVirtualMemory,17_2_007A5EA8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9AAF NtMapViewOfSection,17_2_007A9AAF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4AA0 NtWriteVirtualMemory,17_2_007A4AA0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4E99 NtWriteVirtualMemory,17_2_007A4E99
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4694 NtWriteVirtualMemory,17_2_007A4694
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9A95 NtMapViewOfSection,17_2_007A9A95
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A528D NtWriteVirtualMemory,17_2_007A528D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4A87 NtWriteVirtualMemory,17_2_007A4A87
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4B5C NtWriteVirtualMemory,17_2_007A4B5C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9B4B NtMapViewOfSection,17_2_007A9B4B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A2F3E NtWriteVirtualMemory,LoadLibraryA,17_2_007A2F3E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4B2D NtWriteVirtualMemory,17_2_007A4B2D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4B25 NtWriteVirtualMemory,17_2_007A4B25
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4F14 NtWriteVirtualMemory,17_2_007A4F14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4B00 NtWriteVirtualMemory,17_2_007A4B00
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A2B01 NtWriteVirtualMemory,17_2_007A2B01
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A47F4 NtWriteVirtualMemory,17_2_007A47F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9BCB NtMapViewOfSection,17_2_007A9BCB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A93CD NtProtectVirtualMemory,17_2_007A93CD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4FB8 NtWriteVirtualMemory,17_2_007A4FB8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A8BBE NtWriteVirtualMemory,17_2_007A8BBE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4BB0 NtWriteVirtualMemory,17_2_007A4BB0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4797 NtWriteVirtualMemory,17_2_007A4797
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A4F8C NtWriteVirtualMemory,17_2_007A4F8C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 17_2_007A9B83 NtMapViewOfSection,17_2_007A9B83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9417 NtProtectVirtualMemory,18_2_020B9417
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B0CBA D3DKMTSetStablePowerState,NtWriteVirtualMemory,TerminateProcess,18_2_020B0CBA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5CB3 NtAllocateVirtualMemory,18_2_020B5CB3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B98CB LoadLibraryA,NtSetInformationThread,18_2_020B98CB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B1D2E NtWriteVirtualMemory,LoadLibraryA,18_2_020B1D2E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A03 NtSetInformationThread,18_2_020B9A03
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A2F NtSetInformationThread,18_2_020B9A2F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4A27 NtWriteVirtualMemory,18_2_020B4A27
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4638 NtWriteVirtualMemory,18_2_020B4638
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B3E30 NtWriteVirtualMemory,18_2_020B3E30
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5230 NtWriteVirtualMemory,18_2_020B5230
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4E36 NtWriteVirtualMemory,18_2_020B4E36
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A41 NtSetInformationThread,18_2_020B9A41
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5E47 NtAllocateVirtualMemory,18_2_020B5E47
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A57 NtSetInformationThread,18_2_020B9A57
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B7E78 NtWriteVirtualMemory,18_2_020B7E78
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4A73 NtWriteVirtualMemory,18_2_020B4A73
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A74 NtSetInformationThread,18_2_020B9A74
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B528D NtWriteVirtualMemory,18_2_020B528D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4A87 NtWriteVirtualMemory,18_2_020B4A87
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4E99 NtWriteVirtualMemory,18_2_020B4E99
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9A95 NtSetInformationThread,18_2_020B9A95
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4694 NtWriteVirtualMemory,18_2_020B4694
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5EA8 NtAllocateVirtualMemory,18_2_020B5EA8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9AAF NtSetInformationThread,18_2_020B9AAF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4AA0 NtWriteVirtualMemory,18_2_020B4AA0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B46D3 NtWriteVirtualMemory,18_2_020B46D3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B1ED7 NtWriteVirtualMemory,18_2_020B1ED7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9AEC NtSetInformationThread,18_2_020B9AEC
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B2B01 NtWriteVirtualMemory,18_2_020B2B01
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4B00 NtWriteVirtualMemory,18_2_020B4B00
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4F14 NtWriteVirtualMemory,18_2_020B4F14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4B2D NtWriteVirtualMemory,18_2_020B4B2D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4B25 NtWriteVirtualMemory,18_2_020B4B25
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B2F3E NtWriteVirtualMemory,LoadLibraryA,18_2_020B2F3E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9B4B NtSetInformationThread,18_2_020B9B4B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4B5C NtWriteVirtualMemory,18_2_020B4B5C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4F8C NtWriteVirtualMemory,18_2_020B4F8C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9B83 NtSetInformationThread,18_2_020B9B83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4797 NtWriteVirtualMemory,18_2_020B4797
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4FB8 NtWriteVirtualMemory,18_2_020B4FB8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B8BBE NtWriteVirtualMemory,18_2_020B8BBE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4BB0 NtWriteVirtualMemory,18_2_020B4BB0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9BCB NtSetInformationThread,18_2_020B9BCB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B93CD NtProtectVirtualMemory,18_2_020B93CD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B47F4 NtWriteVirtualMemory,18_2_020B47F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4C16 NtWriteVirtualMemory,18_2_020B4C16
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9C14 NtSetInformationThread,18_2_020B9C14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5023 NtWriteVirtualMemory,18_2_020B5023
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4847 NtWriteVirtualMemory,18_2_020B4847
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4C68 NtWriteVirtualMemory,18_2_020B4C68
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B506F NtWriteVirtualMemory,18_2_020B506F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4899 NtWriteVirtualMemory,18_2_020B4899
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B44CF NtWriteVirtualMemory,18_2_020B44CF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B50C5 NtWriteVirtualMemory,18_2_020B50C5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5CD9 NtAllocateVirtualMemory,18_2_020B5CD9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B98D8 NtSetInformationThread,18_2_020B98D8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B48E3 NtWriteVirtualMemory,18_2_020B48E3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4CE4 NtWriteVirtualMemory,18_2_020B4CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5CE4 NtAllocateVirtualMemory,18_2_020B5CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B60FA NtWriteVirtualMemory,18_2_020B60FA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B28FE NtWriteVirtualMemory,LoadLibraryA,18_2_020B28FE
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B98F3 NtSetInformationThread,18_2_020B98F3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4D2A NtWriteVirtualMemory,18_2_020B4D2A
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5D21 NtAllocateVirtualMemory,18_2_020B5D21
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4520 NtWriteVirtualMemory,18_2_020B4520
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9933 NtSetInformationThread,18_2_020B9933
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4948 NtWriteVirtualMemory,18_2_020B4948
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5146 NtWriteVirtualMemory,18_2_020B5146
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B995D NtSetInformationThread,18_2_020B995D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B9951 NtSetInformationThread,18_2_020B9951
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B996E NtSetInformationThread,18_2_020B996E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5D71 NtAllocateVirtualMemory,18_2_020B5D71
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4570 NtWriteVirtualMemory,18_2_020B4570
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B518F NtWriteVirtualMemory,18_2_020B518F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4D83 NtWriteVirtualMemory,18_2_020B4D83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4985 NtWriteVirtualMemory,18_2_020B4985
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B999B NtSetInformationThread,18_2_020B999B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5D90 NtAllocateVirtualMemory,18_2_020B5D90
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5DAD NtAllocateVirtualMemory,18_2_020B5DAD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B45B5 NtWriteVirtualMemory,18_2_020B45B5
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B51C7 NtWriteVirtualMemory,18_2_020B51C7
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B4DE9 NtWriteVirtualMemory,18_2_020B4DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B5DE9 NtAllocateVirtualMemory,18_2_020B5DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B99E9 NtSetInformationThread,18_2_020B99E9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B45E0 NtWriteVirtualMemory,18_2_020B45E0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B45E4 NtWriteVirtualMemory,18_2_020B45E4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B45F9 NtWriteVirtualMemory,18_2_020B45F9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 18_2_020B49F4 NtWriteVirtualMemory,18_2_020B49F4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569417 NtProtectVirtualMemory,22_2_00569417
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005698CB LoadLibraryA,NtSetInformationThread,22_2_005698CB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565CB3 NtAllocateVirtualMemory,22_2_00565CB3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00560CBA D3DKMTSetStablePowerState,NtProtectVirtualMemory,22_2_00560CBA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569C14 NtSetInformationThread,22_2_00569C14
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005698D8 NtSetInformationThread,22_2_005698D8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565CD9 NtAllocateVirtualMemory,22_2_00565CD9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005698F3 NtSetInformationThread,22_2_005698F3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565CE4 NtAllocateVirtualMemory,22_2_00565CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569951 NtSetInformationThread,22_2_00569951
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056995D NtSetInformationThread,22_2_0056995D
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565D71 NtAllocateVirtualMemory,22_2_00565D71
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056996E NtSetInformationThread,22_2_0056996E
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569933 NtSetInformationThread,22_2_00569933
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565D21 NtAllocateVirtualMemory,22_2_00565D21
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565DE9 NtAllocateVirtualMemory,22_2_00565DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005699E9 NtSetInformationThread,22_2_005699E9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565D90 NtAllocateVirtualMemory,22_2_00565D90
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056999B NtSetInformationThread,22_2_0056999B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565DAD NtAllocateVirtualMemory,22_2_00565DAD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A57 NtSetInformationThread,22_2_00569A57
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565E47 NtAllocateVirtualMemory,22_2_00565E47
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A41 NtSetInformationThread,22_2_00569A41
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A74 NtSetInformationThread,22_2_00569A74
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056166C NtProtectVirtualMemory,22_2_0056166C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00561614 NtProtectVirtualMemory,22_2_00561614
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056161B NtProtectVirtualMemory,22_2_0056161B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A03 NtSetInformationThread,22_2_00569A03
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A2F NtSetInformationThread,22_2_00569A2F
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005616DF NtProtectVirtualMemory,22_2_005616DF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569AEC NtSetInformationThread,22_2_00569AEC
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569A95 NtSetInformationThread,22_2_00569A95
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569AAF NtSetInformationThread,22_2_00569AAF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00565EA8 NtAllocateVirtualMemory,22_2_00565EA8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569B4B NtSetInformationThread,22_2_00569B4B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_0056173C NtProtectVirtualMemory,22_2_0056173C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005693CD NtProtectVirtualMemory,22_2_005693CD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569BCB NtSetInformationThread,22_2_00569BCB
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_00569B83 NtSetInformationThread,22_2_00569B83
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 22_2_005617B0 NtProtectVirtualMemory,22_2_005617B0
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00569417 NtProtectVirtualMemory,24_2_00569417
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565CB3 NtAllocateVirtualMemory,24_2_00565CB3
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00560CBA D3DKMTSetStablePowerState,NtProtectVirtualMemory,24_2_00560CBA
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565CD9 NtAllocateVirtualMemory,24_2_00565CD9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565CE4 NtAllocateVirtualMemory,24_2_00565CE4
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565D71 NtAllocateVirtualMemory,24_2_00565D71
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565D21 NtAllocateVirtualMemory,24_2_00565D21
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565DE9 NtAllocateVirtualMemory,24_2_00565DE9
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565D90 NtAllocateVirtualMemory,24_2_00565D90
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565DAD NtAllocateVirtualMemory,24_2_00565DAD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565E47 NtAllocateVirtualMemory,24_2_00565E47
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_0056166C NtProtectVirtualMemory,24_2_0056166C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00561614 NtProtectVirtualMemory,24_2_00561614
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_0056161B NtProtectVirtualMemory,24_2_0056161B
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_005616DF NtProtectVirtualMemory,24_2_005616DF
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_00565EA8 NtAllocateVirtualMemory,24_2_00565EA8
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_0056173C NtProtectVirtualMemory,24_2_0056173C
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_005693CD NtProtectVirtualMemory,24_2_005693CD
            Source: C:\Users\user\AppData\Roaming\win.exeCode function: 24_2_005617B0 NtProtectVirtualMemory,24_2_005617B0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeFile created: C:\Windows\Lwo7Jump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_0040DD8B0_2_0040DD8B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B623F0_2_020B623F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B08160_2_020B0816
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0CBA0_2_020B0CBA
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B5CB30_2_020B5CB3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B98CB0_2_020B98CB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1D2E0_2_020B1D2E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B12040_2_020B1204
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A270_2_020B4A27
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B46380_2_020B4638
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3E300_2_020B3E30
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0A370_2_020B0A37
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4E360_2_020B4E36
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8E4B0_2_020B8E4B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0E4D0_2_020B0E4D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B32440_2_020B3244
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B62530_2_020B6253
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B12650_2_020B1265
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B7E780_2_020B7E78
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A730_2_020B4A73
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B32750_2_020B3275
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0A880_2_020B0A88
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8E8C0_2_020B8E8C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0E800_2_020B0E80
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4A870_2_020B4A87
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4E990_2_020B4E99
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B46940_2_020B4694
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4AA00_2_020B4AA0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B62A40_2_020B62A4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0EB30_2_020B0EB3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B12DC0_2_020B12DC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B46D30_2_020B46D3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8ED00_2_020B8ED0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1ED70_2_020B1ED7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B630B0_2_020B630B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2B010_2_020B2B01
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B43000_2_020B4300
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B000_2_020B4B00
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B13130_2_020B1313
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4F140_2_020B4F14
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0F2F0_2_020B0F2F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B2D0_2_020B4B2D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B250_2_020B4B25
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2F3E0_2_020B2F3E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1F3C0_2_020B1F3C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2B370_2_020B2B37
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4B5C0_2_020B4B5C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1F520_2_020B1F52
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2F500_2_020B2F50
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B136B0_2_020B136B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3B6F0_2_020B3B6F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B63630_2_020B6363
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3B600_2_020B3B60
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B1F7F0_2_020B1F7F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4F8C0_2_020B4F8C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2B830_2_020B2B83
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0F9B0_2_020B0F9B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B47970_2_020B4797
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2FA80_2_020B2FA8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3BAF0_2_020B3BAF
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B63AC0_2_020B63AC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4FB80_2_020B4FB8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8BBE0_2_020B8BBE
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4BB00_2_020B4BB0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2BD80_2_020B2BD8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0FEB0_2_020B0FEB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B47F40_2_020B47F4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3C0C0_2_020B3C0C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B641B0_2_020B641B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4C160_2_020B4C16
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0C250_2_020B0C25
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B3C3F0_2_020B3C3F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2C330_2_020B2C33
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B104C0_2_020B104C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B48470_2_020B4847
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8C440_2_020B8C44
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0C5B0_2_020B0C5B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B4C680_2_020B4C68
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B8C6D0_2_020B8C6D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B30630_2_020B3063
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B247D0_2_020B247D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B64800_2_020B6480
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B48990_2_020B4899
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B2C940_2_020B2C94
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B10940_2_020B1094
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635.exeCode function: 0_2_020B0CA60_2_020B0CA6
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.46442270.25635