Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dat5E54.dll.dll

Overview

General Information

Sample name:dat5E54.dll.dll
(renamed file extension from exe to dll)
Original sample name:dat5E54.dll.exe
Analysis ID:1541409
MD5:6b539f7ac36b7f45b9376c4fcd6ff2cb
SHA1:94530b5a577d1c79b467f1ca1c1b432bd468600a
SHA256:fae0779fdd0e8ec08bd569076afffe3dca1e805d9d88434cecf3b1c0ae141858
Tags:exeuser-pr0xylife
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Encrypted powershell cmdline option found
Loading BitLocker PowerShell Module
Sigma detected: Windows Binaries Write Suspicious Extensions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 3852 cmdline: loaddll64.exe "C:\Users\user\Desktop\dat5E54.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)
    • conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5236 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • rundll32.exe (PID: 7128 cmdline: rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)
        • powershell.exe (PID: 2496 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt" MD5: 04029E121A0CFA5991749937DD22A1D9)
          • conhost.exe (PID: 4876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • rundll32.exe (PID: 7164 cmdline: rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,go MD5: EF3179D498793BF4234F708D3BE28633)
      • powershell.exe (PID: 2996 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • rundll32.exe (PID: 3172 cmdline: rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",go MD5: EF3179D498793BF4234F708D3BE28633)
      • powershell.exe (PID: 828 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Windows Binaries Write Suspicious Extensions
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\rundll32.exe, ProcessId: 7128, TargetFilename: C:\Users\user\AppData\Local\Temp\0404016.ps1
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt", CommandLine|base64offset|contains: I~%, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,go, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7164, ParentProcessName: rundll32.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt", ProcessId: 2996, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.0% probability
Source: dat5E54.dll.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2323312986.0000012B5B13B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000006.00000002.2323018983.0000012B5B12D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb} source: powershell.exe, 00000006.00000002.2321936045.0000012B5B0FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000006.00000002.2321936045.0000012B5B0FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ion.pdb\t>3 source: powershell.exe, 00000006.00000002.2322245134.0000012B5B112000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdb1 source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2322245134.0000012B5B112000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbs source: powershell.exe, 00000006.00000002.2323018983.0000012B5B12D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdbY source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA3400230 type_info::_name_internal_method,FindFirstFileExW,Concurrency::details::_Scheduler::_Scheduler,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,FindNextFileW,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,3_2_00007FFDA3400230

Networking

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\rundll32.exeNetwork Connect: 178.156.131.83 443Jump to behavior
Source: Joe Sandbox ViewASN Name: SERVIHOSTING-ASAireNetworksES SERVIHOSTING-ASAireNetworksES
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: unknownTCP traffic detected without corresponding DNS query: 178.156.131.83
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339B8E0 __ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,__ExceptionPtrDestroy,_Mtx_unlock,WSAStartup,__ExceptionPtrDestroy,_Mtx_unlock,new,new,new,LoadLibraryA,GetProcAddress,FreeLibrary,new,inet_addr,htons,socket,connect,__ExceptionPtrDestroy,_Mtx_unlock,new,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,send,recv,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,send,recv,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,recv,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,new,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,3_2_00007FFDA339B8E0
Source: powershell.exe, 00000006.00000002.2318528741.0000012B5B097000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2331612417.0000018346735000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
Source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.mic
Source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000007.00000002.2322397424.00000183464C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
Source: powershell.exe, 00000006.00000002.2288038846.0000012B52A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B44374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832FAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2362050022.0000015A10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.2381843783.0000015A76C9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsoft.cop
Source: powershell.exe, 00000006.00000002.2205279172.0000012B42C29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B437AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832EF2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00DAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000006.00000002.2205279172.0000012B42A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2205279172.0000012B42C29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B437AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832EF2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00DAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000B.00000002.2381538500.0000015A76C8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://.AppV.
Source: powershell.exe, 00000006.00000002.2205279172.0000012B42A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A0112F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000006.00000002.2205279172.0000012B4402A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832F7A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01628000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2205279172.0000012B4402A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832F7A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01628000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.2288038846.0000012B52A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B44374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832FAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2362050022.0000015A10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 50131 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50154 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50211 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50177 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 50085 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50165 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50074 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50107 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 50120 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50189 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50130 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50096 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50108 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 50062 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50119 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50142 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50178 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50153 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50210 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
Source: unknownNetwork traffic detected: HTTP traffic on port 50061 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50187 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50049 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 50144 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50209 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50095 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50155 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50176 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50084 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 50166 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50143 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50208 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50110 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50083 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50121 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
Source: unknownNetwork traffic detected: HTTP traffic on port 50188 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50109 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50072 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50132 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50199 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 50174 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50139 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50151 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50116 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50210
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50212
Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50202 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50211
Source: unknownNetwork traffic detected: HTTP traffic on port 50094 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50213
Source: unknownNetwork traffic detected: HTTP traffic on port 50071 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50106
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50105
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50108
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50109
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
Source: unknownNetwork traffic detected: HTTP traffic on port 50186 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50101
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50128 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50162 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50197 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50117
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50116
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50119
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50118
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50111
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50110
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50112
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50115
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50114
Source: unknownNetwork traffic detected: HTTP traffic on port 50127 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50175 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50198 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50213 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50128
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50127
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50129
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50120
Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50122
Source: unknownNetwork traffic detected: HTTP traffic on port 50150 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50121
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50124
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50123
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50126
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50125
Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50105 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50164 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50106 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50129 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50184 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50117 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50173 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50152 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50201 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50141 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50212 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50118 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50092 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50200 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50163 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50140 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50205
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50204
Source: unknownNetwork traffic detected: HTTP traffic on port 50196 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50206
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50209
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50208
Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50201
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50200
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50203
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50202
Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50185 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50175
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50174
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50177
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50176
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50179
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50178
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50180
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50061
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50182
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50181
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50184
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50062
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50183
Source: unknownNetwork traffic detected: HTTP traffic on port 50068 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50125 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50194 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50148 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50186
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50185
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50067
Source: unknownNetwork traffic detected: HTTP traffic on port 50091 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50188
Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50187
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50068
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50189
Source: unknownNetwork traffic detected: HTTP traffic on port 50205 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50183 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50191
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50190
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50193
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50071
Source: unknownNetwork traffic detected: HTTP traffic on port 50159 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50192
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50195
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50194
Source: unknownNetwork traffic detected: HTTP traffic on port 50080 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50204 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50195 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50147 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50172 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50076
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50197
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50196
Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50199
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
Source: unknownNetwork traffic detected: HTTP traffic on port 50114 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50198
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50080
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50083
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50085
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50084
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50086
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50088
Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50092
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50091
Source: unknownNetwork traffic detected: HTTP traffic on port 50136 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50094
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50096
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50095
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50139
Source: unknownNetwork traffic detected: HTTP traffic on port 50170 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50138
Source: unknownNetwork traffic detected: HTTP traffic on port 50193 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50149 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50131
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50130
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50133
Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50132
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
Source: unknownNetwork traffic detected: HTTP traffic on port 50090 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50135
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50134
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50137
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50136
Source: unknownNetwork traffic detected: HTTP traffic on port 50161 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50140
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50149
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50142
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50141
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50144
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50143
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50146
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50145
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50148
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50147
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50151
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50150
Source: unknownNetwork traffic detected: HTTP traffic on port 50138 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50103 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50067 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50153
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50152
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50155
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50154
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50157
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50156
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50159
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50158
Source: unknownNetwork traffic detected: HTTP traffic on port 50182 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50160
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50041
Source: unknownNetwork traffic detected: HTTP traffic on port 50137 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50162
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50040
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50161
Source: unknownNetwork traffic detected: HTTP traffic on port 50066 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50104 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50089 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50203 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50164
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50163
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50045
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50166
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50044
Source: unknownNetwork traffic detected: HTTP traffic on port 50115 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50165
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50047
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50168
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50046
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50167
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50049
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50048
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50169
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50050
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50171
Source: unknownNetwork traffic detected: HTTP traffic on port 50160 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50170
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50173
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50051
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50172
Source: unknownNetwork traffic detected: HTTP traffic on port 50044 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50145 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50168 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50122 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50042 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50180 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50077 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50134 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50053 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50088 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49924 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50076 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50133 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50099 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50156 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50043 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50100 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50167 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50192 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50111 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50181 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50065 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50098
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50097
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50099
Source: unknownNetwork traffic detected: HTTP traffic on port 50112 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50206 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50075 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50158 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50135 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50087 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50169 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49925 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50064 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50123 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50190 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50098 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49925
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49924
Source: unknownNetwork traffic detected: HTTP traffic on port 50086 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50063 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50124 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50191 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50179 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49912
Source: unknownNetwork traffic detected: HTTP traffic on port 50041 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50146 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50097 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50157 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49900
Source: unknownNetwork traffic detected: HTTP traffic on port 50101 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49888 -> 443
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33980E03_2_00007FFDA33980E0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339E7303_2_00007FFDA339E730
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C44B13_2_00007FFDA33C44B1
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C4CC03_2_00007FFDA33C4CC0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33970C03_2_00007FFDA33970C0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33A17203_2_00007FFDA33A1720
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339B8E03_2_00007FFDA339B8E0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA338A3B03_2_00007FFDA338A3B0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33B63503_2_00007FFDA33B6350
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C60A03_2_00007FFDA33C60A0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33A87603_2_00007FFDA33A8760
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33D68403_2_00007FFDA33D6840
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33AA5503_2_00007FFDA33AA550
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33AAB403_2_00007FFDA33AAB40
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339A8903_2_00007FFDA339A890
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA3398D603_2_00007FFDA3398D60
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA338ED603_2_00007FFDA338ED60
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33993603_2_00007FFDA3399360
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33FB2B03_2_00007FFDA33FB2B0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33A91F03_2_00007FFDA33A91F0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33D50903_2_00007FFDA33D5090
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33CD7F03_2_00007FFDA33CD7F0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA338F5903_2_00007FFDA338F590
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C54E03_2_00007FFDA33C54E0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA3399AD03_2_00007FFDA3399AD0
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C3A303_2_00007FFDA33C3A30
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C40103_2_00007FFDA33C4010
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C5DFE3_2_00007FFDA33C5DFE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C45606_2_00007FFD346C4560
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C76F26_2_00007FFD346C76F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C64166_2_00007FFD346C6416
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFD346C66FB11_2_00007FFD346C66FB
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33C15A0 appears 109 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33C1620 appears 310 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33C1740 appears 71 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA338AFB0 appears 890 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33C1F80 appears 261 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33C1FF0 appears 92 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA338AC80 appears 175 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA338AD20 appears 656 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00007FFDA33ADC80 appears 39 times
Source: dat5E54.dll.dllBinary or memory string: OriginalFilenamepiserivice34.exe> vs dat5E54.dll.dll
Source: classification engineClassification label: mal64.evad.winDLL@19/17@0/1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4876:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5900:120:WilError_03
Source: C:\Windows\System32\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\0404016.ps1Jump to behavior
Source: dat5E54.dll.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\rundll32.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,go
Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\dat5E54.dll.dll"
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,go
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",go
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,goJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",goJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"Jump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: dat5E54.dll.dllStatic PE information: Image base 0x180000000 > 0x60000000
Source: dat5E54.dll.dllStatic file information: File size 1631744 > 1048576
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: dat5E54.dll.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: dat5E54.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2323312986.0000012B5B13B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000006.00000002.2323018983.0000012B5B12D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb} source: powershell.exe, 00000006.00000002.2321936045.0000012B5B0FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000006.00000002.2321936045.0000012B5B0FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ion.pdb\t>3 source: powershell.exe, 00000006.00000002.2322245134.0000012B5B112000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdb1 source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.2322245134.0000012B5B112000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbs source: powershell.exe, 00000006.00000002.2323018983.0000012B5B12D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdbY source: powershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmp
Source: dat5E54.dll.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dat5E54.dll.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dat5E54.dll.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dat5E54.dll.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dat5E54.dll.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339E730 GetModuleHandleA,GetProcAddress,new,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,closesocket,new,__ExceptionPtrDestroy,new,_Mtx_unlock,new,new,new,new,new,new,new,LoadLibraryA,GetProcAddress,FreeLibrary,new,new,exit,exit,3_2_00007FFDA339E730
Source: dat5E54.dll.dllStatic PE information: section name: _RDATA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C00BD pushad ; iretd 6_2_00007FFD346C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C1AA5 push eax; iretd 6_2_00007FFD346C1B5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C1B35 push eax; iretd 6_2_00007FFD346C1B5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C73CF push esi; retf 6_2_00007FFD346C73D7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD346C1B5E push eax; iretd 6_2_00007FFD346C1B5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD34790DC1 pushad ; iretd 6_2_00007FFD34790DE1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FFD346C00BD pushad ; iretd 11_2_00007FFD346C00C1

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33AAB40 LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,GetProcAddress,FreeLibrary,GetProcAddress,FreeLibrary,_mbsset_s,LoadLibraryA,GetProcAddress,FreeLibrary,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,_mbsset_s,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,std::_Xinvalid_argument,std::_Xinvalid_argument,std::_Xinvalid_argument,std::_Xinvalid_argument,3_2_00007FFDA33AAB40
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD34790FB5 sldt word ptr [eax]6_2_00007FFD34790FB5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6950Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1675Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7252
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1606
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7441Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2205Jump to behavior
Source: C:\Windows\System32\rundll32.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_3-56246
Source: C:\Windows\System32\loaddll64.exe TID: 6400Thread sleep time: -120000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep time: -42000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep time: -42000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep count: 36 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep time: -40320s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep count: 37 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep time: -37000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep count: 73 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7080Thread sleep time: -73000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep time: -42000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep time: -42000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep count: 36 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep time: -40320s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep count: 37 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep time: -37000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep count: 72 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 3132Thread sleep time: -72000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2100Thread sleep count: 6950 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5920Thread sleep count: 1675 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5160Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 992Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6724Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep time: -52000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep time: -52000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep count: 37 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep time: -41440s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep count: 35 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep time: -35000s >= -30000sJump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep count: 71 > 30Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 988Thread sleep time: -71000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA3400230 type_info::_name_internal_method,FindFirstFileExW,Concurrency::details::_Scheduler::_Scheduler,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,FindNextFileW,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,3_2_00007FFDA3400230
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C5110 GetSystemInfo,3_2_00007FFDA33C5110
Source: C:\Windows\System32\loaddll64.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 42000Jump to behavior
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 42000Jump to behavior
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 42000Jump to behavior
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 42000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 52000Jump to behavior
Source: C:\Windows\System32\rundll32.exeThread delayed: delay time: 52000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: powershell.exe, 0000000B.00000002.2383147376.0000015A76D66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductKY99CH4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
Source: powershell.exe, 0000000B.00000002.2383147376.0000015A76D66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.mberoductuctowsP
Source: dat5E54.dll.dllBinary or memory string: pqnI56w3W9fuc6BJjldHf7B45RbCTEOs3975876tXwOvI40y2Z6XZnSnqd92oOaU52TsqpxsCxBvwzyqUgoZHeLMzb5nNSsoPbEI8n6jivwEUCyOVIQ95DmpKHOvzekGJupWS8chYnHeIsPFnboDEMmP6KLPtmPEbfBF1LaFNU3PCMo9yQ9lCkuiuOLFVZTET58SQlU17dEXDaMjjtmPLFVaZcvewtkIBNLKYE4pIdSA5xruGQaTovQKTTAXz2xcka1jKO0NA0wX7sggm8BOq75QdHNgzpIQd4WRT0KyvXK4dsNatI2GAAMSsY7xlQRI6RJNIfAujvxWor5h0vQBVoFXT6cJ0F2TFZskyWIObH096Vuql8Hno4mhUesIb4sLpb5BvnlzhfEQaRLBHVClD4Bzz5XqycbhtAN4Ayvp1FWwGXCuvrrRpzI5Xue0R4YVEzHQpLC1wqwwg7g9EPu5QgDjT94VeQ8m0DglD2qbzGxcEFKAtBgb62tuNdiqqkZAUOKkEkILWgVBPCpK42wcTByeX28fxq3fH7RvTtjkw30Beh1TaMUxrtzyUZkmlvk3JXIjDAy1cLduxcNPEpoYH7CRcLmWR1oHDGtruXCPFnnNmiviSEHECL3MTaT6mTwt4WL3KELNUNdqAX6RpM8rK53opHqcXdOph9ZeRfbPXEAAuqox4vDkv0TVmCiZUiE23cycQXTLndXXOozvH908AiFSwkRPgtLUjfysqYFbPbTIWmMVV6bkXsMBuTrbtQgktOblN6mQlAjRxauxLI9xkRXt9gEqZc3itFHULR5R1hzsbh0MrcIknk1FgJCctHQxlGkTRKwF0XSXJi2afDc3iWtkYJwEpfoFPGE07eqrjfqFL0Oc62HPyrPF2teH9dT3FAJcVQbtHNt1gjs4TGqZN9uGQonuCEaXWfOnUbxmKm0Gj5urJlLmVRw2rHtRHF8O4PXnfL9deZJCyFg2iFahF4DwpQ5criHd4b2XL8cB3R0BEeuZTcJAWHgVQe4GNvEARQe2mySaQTI0l95CMf4g7O10OJjnGqF4Fpt6tooCa0ecqj0JhRS7CIwX6FcFHFHouulUAK5dUpFnrcIuRrl9FxEDMiFT22G1qODpdeiNxgUqZbc
Source: rundll32.exe, 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4600481634.000001BBE3898000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4601112213.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4600342751.0000023D16D68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4601068739.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4600345379.000001AC5DB58000.00000004.00000020.00020000.00000000.sdmp, dat5E54.dll.dllBinary or memory string: hXNymgFZPfjpNBqD8u8ALRjje5fZbYPVxMe1SJ7WILfiELwFHtSFFmkHsqJzzLVwnhpnnnLwhkRfFckir0Ukzs6HDRanWGOFp5ep5gXNXZ89ZqyAoDKoUE6bdHduHj9T2B1SbWihq16bcXj0ndA16wfajOF424miX1oVX9bnCQ28Le1Ak7GMUQXuQ3ds6ULzNc0PfPGBC3cbJrEhsAiDXqBk8tNwGPvuuFUa8czPS0BxH0MIXLG2Tgv9yG2QGhqyqd2QJRa7ZnmQy6mZ05a2V8apB0jTkAuLbNpprFVU9iGFGtXMqBNU18YEuw0wT6dfbLSzBH67eh892eNSAYybsxky58LbqPjesmtan5yFT5fAPxC5EToIMkhkTbpl3EFfpJWRSW6mbZC7SZVArsWoRTCE9IqRGbeD4HdSP4tDUNyg8Bt47Vd7BUbvK96rv0tG4ZAefpLwyE7isQRVA9wHWf8XRtBq9AldMs6pK1iJWDoDlgdEV7z22xGbrbidqAIXWumyY3mR7TK5NIiv9tZ7Wi48714kiswbH0KUGiUGcGpa3yVzbTRyyB53sJGULOoDSTq5o1r0T4pMERCZOeMLEgWkRdm1w1so5g6yxwaOKpJ6ohlQjWGoWmks3ZYToABtBKwarCS1xd20zvWKYAytHdJdYvBJrHHhlgVe1ErottRCW8ZdATdjOQh7snLfKoyXLKpNFbfkWVX2CIZOQSiaE4yQ10fIPQD7PUpkVXt2pHjfOETTCnrbXhv808W5lAS2nOgKxIS2Ext2MbfcgXBrwbU4NiblPCCuN1qgURQdV5wbkyMxhWoDIaOhLXpbvDmnFnG08urqXkitx1aRlRycmy7j1dO9UP8G6I4bJpYVZirGOb5jcFe8ouP2rLQzJj6CjcjQj9ivjiLtz64J1lJoKHEO00DwH70gWtptWfKqQgLWhdI3uNcczXFpGSyGaUMg4f2K4XArVYrPBtgDWN468VVhMR9JK1uxALIBLkHu1Z1suoBc3HwKgRsFTSWP3AVaVYMnjCKszUZaLqpYNEmei3Gi9FHcRIQlDDRu1FQH7vwDjphU2XqoSoNrivkAt4z0GOiRIfGgYjwpDUyJjDmitZM2L6HtPsjNDZebxUaU4c8qkqS3fyp3RHy4hGFSFS2BebCQ076Zhav0ZYBTVXqHyLAJpLOzBrrgHJHpbuKbvXqD3BtuNrXDmXNYBVWhn2wOox9yIhIn2EsDyyQEAkL7M0kcwpNGOLMhu6fcwWg1xw4KwvSWIRit3wFhC7iRJgX6RjN67oJGKUmrZnVA6rLXlIYmwqrvPVcwvVYKNvy8QRixBdeXCSX6qD5jTbieBAdxDRMFn3mTFa08ira3gC2vZ89md3ptoNyznTtQ4NwNGCiMMZGiZYDPbdTul37CzAGzSRvRChMtXT794ezLkQVrV1HPTL7CLnbZeuUHdY1CO2qbWsviZYuGbs1SzQKCj5xneJ6VzNEcJbY5c7XL5kaOyW6jzA95X5QCpnVv4LS8kPn8MS2rVYmkEorrbQmgcishhdQ4UZG8qSE4tu8jkOv7cpxVGvHkHp04BThU6VimhbcLqXsD6T590iZ2lLbR8YbZJP85qSNI3ZuZQN5AtRYjDp5QGluO9jjKa7gjfv62HQVWIjasySA6hrRnOAUciaXyq6YU1FN4TLJKXbATCywotNZNp4vHvTGUnNu06OsYvXqS1a0z2MaPRwfKqOIkj0koDtsTJyKZB2KucGWLj6vA3EIwRdD2UhXFIKSXm6eTWFvwvxPR0u5tx2F7kUzr2Qy0ZN3ZZ9ouZ6oQilxfgGpqaF3VWo9nm2l2Wfy4oPVNwdcAO08iFhMQyAfifbJptVUQRNPUiqNds71nSQZjE2lasxnQMjr9
Source: rundll32.exe, 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4600481634.000001BBE3898000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4601112213.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4600342751.0000023D16D68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4601068739.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4600345379.000001AC5DB58000.00000004.00000020.00020000.00000000.sdmp, dat5E54.dll.dllBinary or memory string: rDPIeFJ2xItYHHxE6fUMTxpEplsp53UcnKYhowXsulWXtyirHDEcLm1RkNqmotxp2fXAqsUJWVVKYEqrUIqWeVbdA720Q2JILvnWTpPpkV4oGamWkv6MFByjPDQDJvNcTLxLgZsCLB82mEjRBHJXQLonDE3VUaR8Fo6Upslp78aTeh2ZTbDgS1tUubC9MQTYeugSDjSNfraeo0xzc1z5pWEzziaZIoIUZQkQ6oFlqyq7zk5OZwaYYNBqAfEELlNTq0i2iF3iZQ4A3p9q3wdP2pjGnp9JJJC79ebEq3thOLDWqw9BCbaAX53szNTu5ZSUumKAXVH3QWmXX6EUvXONVfB9Ld64o2heklmoNoAQb37pQ0yolX96HrhWhOkkpsMDJtZXiz5KkusPRlYjCuAi0ipcRWqXDxVOBIsgzOz9lCXc1e8QThjoCkRwA2FdnRIXg1nhkTI7YqribMum9EBTmLqFmci2n1qpyOBopnTpJDjs0qXgiAaIjBZsV1IQbXncmBquHYqFjhT1nakkAlUji2O2hrfJjiGSXmOMJVwlt3CUjMOZF27eTvfhLAtGcpelNj9eBnIjLFvggh7VJWrozJw5zcUIvPdM0EQ1GoqjSkE3FnaaqeXUUxUcaW0eJ0C8zamGrwvrZlJ8B4RN6qeEtrnxFaOQjpXurupWewlISjUKrtB3I5onBnjKA80sxWcTGYs4Y54Yg1ZJCcTPUprxLRAfN0XGBLnGykVxZHYcUlxEHXlbAejq47uvF29AKq622vFJIpv84x5SODX6X0WxUC1ocFlo9AldTerreUfcjqcneHyloYO8GSX8LhH1HCLa7jNc13GoNfGlN1JMoTEPpMoic5xOr0tVR0sNKon3QvO681F4LHz3zTNbs49GU141RsMg5d9f4zcYV0vhbFHb5iWPvbZbbky3bZxHTZH1QWxdhxoW1QToZEXsDdY15esZrdrEMAxAiSVCSLqcdTh9Z2izV4IfeHQAZWO4gbThGFs2eGXrgAB6xNGKoGjscYDA1kJZES9q47eU74hGqVEW1Y4sPV1LQA8FjNTt9YeRGwXr1MWZiumpIEutQ1700CDUiRrY5Yfpj4BEwseSRDGzppX1nudPu5LMDeAheSzDt6z0n2knrGwTgFqEO4Kn7OIj8OMNs5fAp05I8oLxsmkN3deiHb33RKoUC04lFdkHRiY
Source: powershell.exe, 0000000B.00000002.2371795791.0000015A74A1A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductKY99CH4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.None
Source: rundll32.exe, 00000003.00000002.4601005526.000001BBE56C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: rundll32.exe, 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4600481634.000001BBE3898000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4601112213.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4600342751.0000023D16D68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4601068739.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4600345379.000001AC5DB58000.00000004.00000020.00020000.00000000.sdmp, dat5E54.dll.dllBinary or memory string: NekKfvGxpHtSaED9Pq0QysSMGyEP3QCseFA5DZXN66ZGjF8QRkyhq2OKMNroqwhUdiIJJVeP6WnbDN2xlDh8BDqfr1SV1HSi2RkAPyJNZd1yDrYYWEofygcn3HqqOaVQalqPXhgcrsZ1nNJEIwJLPLNPMjQPVKMYKjj0ljxJjGATEv4A2izU43liyQAXzUuGMvxSwrsXqm4cOBxLUQbdGiBNqu1yz46msZDYvJLo8wPOh0mG8HQUVLpiwjHLai6521uPyFQ4zYI307CInygRy6J5C6BatM38u8AKVcmczKvcg4rVncRg9gmqYXL4OBQ06fWLX93Au13bfi7bwrjfRl35eUijEBdS2hhmTOp2W6BoPtPXIQgGOiKexmsPOmFsabnZGcMuFRouxgg1xltQpsNINC292f6g6eI06Wz97EaeuEuqnMJcb7ANZNODfCH56uT6sguFdiRVUfpi8w1MBxQZrL0W6q5gKhNUcihsKSePXWfiWclxD2rLrFMmsQufZxvMnx2AnYXUJ4FE5bywmOZYNYINRtNu129LpTpQivp8juL4UMQadgj5KrjozhMV4kBgdMMAa9fKrxPaxcZQugQiAo02EmzP8sE1E0Z3CB05NpoxGfuMOHiEwkIyQBsAMc8Qpq3UOsLRVRAwsrc7RIhO2S8GgzdXFVM1EEZVca02wOIkhY8hchjcxANjAj7Fwd1xCSz6dt0fsewp6s3fMcFHX71FcVJwnylvnux7DJ89Rjljn0specOzWvfpsVwlXp1sjaHu66LfbRY4nx5ibrU2pAB6QCg2M1JmzO3vUWjZGyxbkiLXknWLXxgsZYLPT4rFwyNYPgpOH96F5XdaS4OSTISIi56vQuS37ph6O4R4thTQOBP35kRXYlt0xiIvKTqPRlsDJGbx1etWnXHnL0xuT8tgzrBWZBLIxzPVugXLNB4ohY1kRwuHwte7QF8ox7Zf8hCcUzhgFsGtkAtAk8sHcTm3gVHQp8wxcu5uPw4hxlFaMRtOsQcg0EGxCMrvFTpjZHavPjALmsCHjLqHVOduzdRRkdBuSyAjDI3vnD90kTtwsTqGLqrkKTGByo5h5uZ8GZG06cPh3hzYjf40PyPIV1tRMunjNxretoJKlwVkWH70IZNCKBMziDApeQqq8GUUIFWSHuNLl8Ebtt4qnlhdZ6MMBPwGeBsmwHFnrH5LmNvtQoRuNpuq6ZB9xN3h0TQlaPc48uUTRTmm8Tktgus0Tr02DPy0l8h5nJcKS4GA7C2LVcuFPu7XDpp2w3Tuc16a45zJob2kLpsP3S5nKLyGc7oG097prdWR64ExW9ZonU0AU
Source: powershell.exe, 0000000B.00000002.2379939213.0000015A76B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: powershell.exe, 00000007.00000002.2326770325.0000018346594000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.qF
Source: rundll32.exe, 0000000A.00000002.4600643101.000001AC5F984000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWs
Source: powershell.exe, 0000000B.00000002.2379353402.0000015A76B02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ROOT/cimv2user-PCComputer System ProductComputer System ProductKY99CH{8E8AA455-5EA0-478B-BC13-0F38998FE123}4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Nonep
Source: powershell.exe, 00000007.00000002.2334863563.00000183467A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.mberoductuct
Source: powershell.exe, 0000000B.00000002.2383147376.0000015A76D66000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.em Producti.csv
Source: powershell.exe, 00000007.00000002.2337090533.000001834681F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ROOT/cimv2user-PCComputer System ProductComputer System ProductKY99CH{8E8AA455-5EA0-478B-BC13-0F38998FE123}4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.NoneS
Source: powershell.exe, 00000007.00000002.2329250204.00000183466E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.U
Source: dat5E54.dll.dllBinary or memory string: Dlo4e2AHRiOQnhBgsVqcawQQaAfYWHYpl64ivlrVGks1GBuWNFzVHuezclhSCdayppM3O9njMTkS4RxGbUXm9FkXAx9G8B8RZ8GS6hNLKQgLcUyPgHwzepyjC4vs5NGkWvmQluW1CMYADreD6x2AxW7OIXvSVafsnyxMLxPBGT5tLGTfMxJxhmbad9AZkesLi24UA4evYjctkEqrxArSGb0I0OyfpWLWQpA7WGnEjcYb6g9tZKkrUYpo211odSqTCO9hhcjLhlkn8o4bMz8zwSDy1ytfOQspGoPSGCS2ZgDjVOeBCZAXja0RCv7DAGXSiorq4CDpxEqpvnAc7P8UQNPqMhhbilptQYaeMYvNrJ9B8PfzBNUlcO8d3KAH077IhqH35B646WPGlFX2X1T3koSE9AD7YemXFZw6R4LMBB0q5XovrS3VMciUCNqqTNNoLfPOK4zLwtfrRWCgzOAYo0h2wldbXGuRsxExU4dCskBkd4sEOuFdC9rVWYDMQG21HfVGWWSzlaC9QPrj2Ds8iYgNUuvv829HLoBEBGQpfkISh1JsQc9JAjfYOP8b51HhFOPwnodKA1ApvUk3vM3nzaeKGFs11w2Odfi040oqbBSD4Y33SurPsWKLdIOVruiD1EJArO5fRxkNK68ZFBLPQPIhZ8OBZSOxDkKEVn7uxGziIwyVa3WKTyV8LBeEtq0T28AByC4Wr48qWN4PskHuIabdXiwvNbdJIBW4sb4XsfADmdBPfLzG4CBUtByx1CaRmNkYJ4NWpWKOPHs715YUMa3QnI3TJHfNSclJjP7KvgRpmgTUhIKJnR2eB7hViugOj5KFKGyuyJPoPLfQVPIuH5na29dm5uu0FjPYk5bwoVgd6bdCIKzT3sshjVK9CHBYcMWDbyV8Jg3L5zxmyeoRfcOXI1xrk5psaqOdTDEogHYtaSMaLrDazBqfU
Source: powershell.exe, 0000000B.00000002.2379353402.0000015A76B02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ROOT/cimv2ruser-PCuctKY99CH{8E8AA455-5EA0-478B-BC13-0F38998FE123}4D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.NoneROOT/cimv2user-PC|
Source: rundll32.exe, 00000004.00000003.3375143458.0000023D1878B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3375188860.0000023D187AC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4600813504.0000023D187AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4600643101.000001AC5F99A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33EA170 IsDebuggerPresent,Concurrency::details::UMSBackgroundPoller::~UMSBackgroundPoller,3_2_00007FFDA33EA170
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA339E730 GetModuleHandleA,GetProcAddress,new,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,__ExceptionPtrDestroy,_Mtx_unlock,closesocket,new,__ExceptionPtrDestroy,new,_Mtx_unlock,new,new,new,new,new,new,new,LoadLibraryA,GetProcAddress,FreeLibrary,new,new,exit,exit,3_2_00007FFDA339E730
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33F09F0 GetProcessHeap,3_2_00007FFDA33F09F0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33B6770 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFDA33B6770
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33B4F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FFDA33B4F30
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33C1DC0 __crtCaptureCurrentContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFDA33C1DC0

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\rundll32.exeNetwork Connect: 178.156.131.83 443Jump to behavior
Encrypted powershell cmdline option found
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\0404016.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\3065065663.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\0404016.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\3065065663.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\24255015403505.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\232462603231.txt"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\0404016.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\0404016.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\3065065663.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" set-executionpolicy remotesigned -scope process -force -confirm:$false;$psdefaultparametervalues = @{'out-file:encoding' = 'utf8'}; " c:\users\user\appdata\local\temp\24255015403505.ps1" | out-file -encoding utf8 "c:\users\user\appdata\local\temp\232462603231.txt"Jump to behavior
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA34105D0 cpuid 3_2_00007FFDA34105D0
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,EnumSystemLocalesW,3_2_00007FFDA34087C0
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,__vcrt_getptd,GetLocaleInfoW,TestDefaultCountry,3_2_00007FFDA3408690
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,__vcrt_getptd,GetLocaleInfoW,GetLocaleInfoW,TestDefaultCountry,GetLocaleInfoW,3_2_00007FFDA3408AF0
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,EnumSystemLocalesW,3_2_00007FFDA34089A0
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,EnumSystemLocalesW,3_2_00007FFDA3408890
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,__vcrt_getptd,GetLocaleInfoW,3_2_00007FFDA3408F00
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,__vcrt_getptd,GetLcidFromDefault,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,3_2_00007FFDA34093E0
Source: C:\Windows\System32\rundll32.exeCode function: __vcrt_getptd,GetLocaleInfoW,3_2_00007FFDA3409280
Source: C:\Windows\System32\rundll32.exeCode function: __crt_fast_encode_pointer,EnumSystemLocalesW,3_2_00007FFDA33EF170
Source: C:\Windows\System32\rundll32.exeCode function: GetLocaleInfoW,GetACP,GetLocaleInfoW,3_2_00007FFDA3409150
Source: C:\Windows\System32\rundll32.exeCode function: GetLocaleInfoW,3_2_00007FFDA33EFDA0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00007FFDA33B6910 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,3_2_00007FFDA33B6910

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		111
Process Injection		41
Virtualization/Sandbox Evasion		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		12
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization Scripts1
DLL Side-Loading		111
Process Injection		LSASS Memory31
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts2
Native API		Logon Script (Windows)Logon Script (Windows)11
Deobfuscate/Decode Files or Information		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
PowerShell		Login HookLogin Hook2
Obfuscated Files or Information		NTDS41
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Rundll32		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync43
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1541409 Sample: dat5E54.dll.exe Startdate: 24/10/2024 Architecture: WINDOWS Score: 64 52 Sigma detected: Windows Binaries Write Suspicious Extensions 2->52 54 AI detected suspicious sample 2->54 9 loaddll64.exe 1 2->9         started        process3 process4 11 rundll32.exe 2 9->11         started        15 cmd.exe 1 9->15         started        17 rundll32.exe 1 9->17         started        19 conhost.exe 9->19         started        file5 46 C:\Users\user\AppData\...\24255015403505.ps1, ASCII 11->46 dropped 60 System process connects to network (likely due to code injection or exploit) 11->60 62 Encrypted powershell cmdline option found 11->62 21 powershell.exe 20 11->21         started        25 rundll32.exe 2 15->25         started        28 powershell.exe 22 17->28         started        signatures6 process7 dnsIp8 42 C:\Users\user\AppData\...\232462603231.txt, Unicode 21->42 dropped 56 Loading BitLocker PowerShell Module 21->56 30 conhost.exe 21->30         started        48 178.156.131.83, 443, 49711, 49712 SERVIHOSTING-ASAireNetworksES Romania 25->48 44 C:\Users\user\AppData\Local\...\0404016.ps1, ASCII 25->44 dropped 58 Encrypted powershell cmdline option found 25->58 32 powershell.exe 25->32         started        36 conhost.exe 28->36         started        file9 signatures10 process11 file12 40 C:\Users\user\AppData\...\3065065663.txt, Unicode 32->40 dropped 50 Loading BitLocker PowerShell Module 32->50 38 conhost.exe 32->38         started        signatures13 process14

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
dat5E54.dll.dll3%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://nuget.org/NuGet.exe0%URL Reputationsafe
https://aka.ms/winsvr-2022-pshelp0%URL Reputationsafe
http://crl.m0%URL Reputationsafe
http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
https://go.micro0%URL Reputationsafe
http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
https://contoso.com/0%URL Reputationsafe
https://nuget.org/nuget.exe0%URL Reputationsafe
https://contoso.com/License0%URL Reputationsafe
https://contoso.com/Icon0%URL Reputationsafe
https://aka.ms/pscore680%URL Reputationsafe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
http://crl.v0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.2288038846.0000012B52A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B44374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832FAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2362050022.0000015A10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://schemas.microsoft.coppowershell.exe, 0000000B.00000002.2381843783.0000015A76C9E000.00000004.00000020.00020000.00000000.sdmpfalse
    		unknown
    https://aka.ms/winsvr-2022-pshelppowershell.exe, 0000000B.00000002.2213714935.0000015A0112F000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://crl.mpowershell.exe, 00000006.00000002.2318528741.0000012B5B097000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2331612417.0000018346735000.00000004.00000020.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000006.00000002.2205279172.0000012B42C29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B437AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832EF2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00DAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpfalse
      		unknown
      https://go.micropowershell.exe, 00000006.00000002.2205279172.0000012B4402A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832F7A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01628000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000006.00000002.2205279172.0000012B42C29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B437AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832EF2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E3A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00DAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://contoso.com/powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.2288038846.0000012B52A72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2205279172.0000012B44374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832FAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2362050022.0000015A10073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://contoso.com/Licensepowershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://crl.micpowershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        https://contoso.com/Iconpowershell.exe, 0000000B.00000002.2213714935.0000015A01971000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://aka.ms/winsvr-2022-pshelpXpowershell.exe, 00000006.00000002.2205279172.0000012B4402A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832F7A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A01628000.00000004.00000800.00020000.00000000.sdmpfalse
          		unknown
          https://.AppV.powershell.exe, 0000000B.00000002.2381538500.0000015A76C8B000.00000004.00000020.00020000.00000000.sdmpfalse
            		unknown
            http://crl.micft.cMicRosofpowershell.exe, 00000006.00000002.2318528741.0000012B5B0F3000.00000004.00000020.00020000.00000000.sdmpfalse
              		unknown
              https://aka.ms/pscore68powershell.exe, 00000006.00000002.2205279172.0000012B42A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00001000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.2205279172.0000012B42A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2206718924.000001832E181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2213714935.0000015A00001000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://crl.vpowershell.exe, 00000007.00000002.2322397424.00000183464C0000.00000004.00000020.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              https://github.com/Pester/Pesterpowershell.exe, 0000000B.00000002.2213714935.0000015A00228000.00000004.00000800.00020000.00000000.sdmpfalse
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                178.156.131.83
                		unknownRomania
                		29119SERVIHOSTING-ASAireNetworksEStrue

                General Information

                Joe Sandbox version:41.0.0 Charoite
                Analysis ID:1541409
                Start date and time:2024-10-24 19:54:09 +02:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 8m 17s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:17
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:dat5E54.dll.dll
                (renamed file extension from exe to dll)
                Original Sample Name:dat5E54.dll.exe
                Detection:MAL
                Classification:mal64.evad.winDLL@19/17@0/1
                EGA Information:
                • Successful, ratio: 33.3%
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 32
                • Number of non-executed functions: 225
                Cookbook Comments:
                • Override analysis time to 240s for rundll32

                Warnings

                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                • Execution Graph export aborted for target powershell.exe, PID 2996 because it is empty
                • Execution Graph export aborted for target powershell.exe, PID 828 because it is empty
                • Not all processes where analyzed, report is missing behavior information
                • Report size exceeded maximum capacity and may have missing behavior information.
                • Report size getting too big, too many NtCreateKey calls found.
                • Report size getting too big, too many NtOpenKeyEx calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • VT rate limit hit for: dat5E54.dll.dll

                Simulations

                Behavior and APIs

                TimeTypeDescription
                13:55:06API Interceptor58x Sleep call for process: powershell.exe modified
                13:55:07API Interceptor1x Sleep call for process: loaddll64.exe modified
                13:55:11API Interceptor6x Sleep call for process: rundll32.exe modified

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                178.156.131.83jDeaJUwkWT.exeGet hashmaliciousUnknownBrowse
                  jDeaJUwkWT.exeGet hashmaliciousUnknownBrowse

                    Domains

                    ⊘No context

                    ASNs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    SERVIHOSTING-ASAireNetworksESfOTHzKNyyk.elfGet hashmaliciousMiraiBrowse
                    • 185.132.166.205
                    G63E6opeS8.elfGet hashmaliciousMiraiBrowse
                    • 31.14.204.130
                    5tSAlF2WkT.elfGet hashmaliciousMiraiBrowse
                    • 94.76.139.161
                    message(1).emlGet hashmaliciousUnknownBrowse
                    • 79.143.93.75
                    IWnUKXop2x.elfGet hashmaliciousMirai, OkiruBrowse
                    • 185.132.164.46
                    SecuriteInfo.com.Win32.Sector.30.15961.3704.exeGet hashmaliciousSalityBrowse
                    • 93.114.228.238
                    n5h5BaL8q0.exeGet hashmaliciousSality, XWormBrowse
                    • 93.114.228.238
                    PfBjDhHzvV.exeGet hashmaliciousMetasploit, SalityBrowse
                    • 93.114.228.238
                    botnet.arm.elfGet hashmaliciousMirai, MoobotBrowse
                    • 185.27.124.122
                    jDeaJUwkWT.exeGet hashmaliciousUnknownBrowse
                    • 178.156.131.83

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):64
                    Entropy (8bit):1.1510207563435464
                    Encrypted:false
                    SSDEEP:3:Nlllullkv/tz:NllU+v/
                    MD5:6442F277E58B3984BA5EEE0C15C0C6AD
                    SHA1:5343ADC2E7F102EC8FB6A101508730898CB14F57
                    SHA-256:36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
                    SHA-512:F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
                    Malicious:false
                    Preview:@...e................................................@..........

                    C:\Users\user\AppData\Local\Temp\0404016.ps1

                    Download File
                    Process:C:\Windows\System32\rundll32.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):57
                    Entropy (8bit):4.7473759267800535
                    Encrypted:false
                    SSDEEP:3:bVqWiJI7RIMiINRGOS:bcWMI7RE4RvS
                    MD5:ADD80FBC49B6992C99CD2A0C3DA7AD06
                    SHA1:B912D703B304729AFFD11CD80BBBB39BD9233A14
                    SHA-256:EF2DF829792691F330AE1ED8A2ACA5BF055050CAD0E70D427D4B524A1336601A
                    SHA-512:3CAE1B0CF269B4C53AB025959C0390CFBA35B64F9BF160E21DE28F708F9AEE198A8709CA74938A90A27415B095C88DD6429C1F88541C6DD57FDC92F4981650D1
                    Malicious:true
                    Preview:(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID

                    C:\Users\user\AppData\Local\Temp\232462603231.txt

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):41
                    Entropy (8bit):4.061956505136042
                    Encrypted:false
                    SSDEEP:3:yiRtwEIZgDn:yi3wEIZ6
                    MD5:4A4FD1CE6701E498452D5F335E4E436A
                    SHA1:72A22BBF07C2A13AA00614A34EC8C4C3EF9C451A
                    SHA-256:AE66E4CC358C38E11DD9BD93728997247AD2A9A3D6C16D2306A7BB5759891A50
                    SHA-512:0C4018B28D318547E50CADFA8146BF4A22AD21F9786EDAE795ACD3C339B5AA181DBCCFA9FF3B4FC6A91269FB3B0C0B468CB58E0663D35220B40E2632460FCA21
                    Malicious:true
                    Preview:.4D802742-3099-9C0E-C19B-2A23EA1FC420..

                    C:\Users\user\AppData\Local\Temp\24255015403505.ps1

                    Download File
                    Process:C:\Windows\System32\rundll32.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):57
                    Entropy (8bit):4.7473759267800535
                    Encrypted:false
                    SSDEEP:3:bVqWiJI7RIMiINRGOS:bcWMI7RE4RvS
                    MD5:ADD80FBC49B6992C99CD2A0C3DA7AD06
                    SHA1:B912D703B304729AFFD11CD80BBBB39BD9233A14
                    SHA-256:EF2DF829792691F330AE1ED8A2ACA5BF055050CAD0E70D427D4B524A1336601A
                    SHA-512:3CAE1B0CF269B4C53AB025959C0390CFBA35B64F9BF160E21DE28F708F9AEE198A8709CA74938A90A27415B095C88DD6429C1F88541C6DD57FDC92F4981650D1
                    Malicious:true
                    Preview:(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID

                    C:\Users\user\AppData\Local\Temp\3065065663.txt

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):41
                    Entropy (8bit):4.061956505136042
                    Encrypted:false
                    SSDEEP:3:yiRtwEIZgDn:yi3wEIZ6
                    MD5:4A4FD1CE6701E498452D5F335E4E436A
                    SHA1:72A22BBF07C2A13AA00614A34EC8C4C3EF9C451A
                    SHA-256:AE66E4CC358C38E11DD9BD93728997247AD2A9A3D6C16D2306A7BB5759891A50
                    SHA-512:0C4018B28D318547E50CADFA8146BF4A22AD21F9786EDAE795ACD3C339B5AA181DBCCFA9FF3B4FC6A91269FB3B0C0B468CB58E0663D35220B40E2632460FCA21
                    Malicious:true
                    Preview:.4D802742-3099-9C0E-C19B-2A23EA1FC420..

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vpni1xy.uzt.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c54ubspo.fui.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cj2uls5z.y5q.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3srqcml.4ec.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fuvxt1au.qgw.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0ahh5rr.t1x.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfqhyc0k.tac.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_voywrvb5.few.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcyg1rry.dur.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wr5gjj14.l4z.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkr3xl5b.k2v.ps1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zck2uart.i3j.psm1

                    Download File
                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):60
                    Entropy (8bit):4.038920595031593
                    Encrypted:false
                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                    Malicious:false
                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                    Static File Info

                    General

                    File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                    Entropy (8bit):6.621432319100869
                    TrID:
                    • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                    • Win64 Executable (generic) (12005/4) 10.17%
                    • Generic Win/DOS Executable (2004/3) 1.70%
                    • DOS Executable Generic (2002/1) 1.70%
                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                    File name:dat5E54.dll.dll
                    File size:1'631'744 bytes
                    MD5:6b539f7ac36b7f45b9376c4fcd6ff2cb
                    SHA1:94530b5a577d1c79b467f1ca1c1b432bd468600a
                    SHA256:fae0779fdd0e8ec08bd569076afffe3dca1e805d9d88434cecf3b1c0ae141858
                    SHA512:a22d27b208c86f0ebb05c7939d9562d6bb04d8b54cc670413b672dbf9bfe9e366ff94b8621939718ceaca6954224adc7200a1b451e32dfa9a788313ab2fbbb09
                    SSDEEP:24576:blf/h/CoQXOk+h/YLzNZCKQNo3bQ4RV0sPNy8Tm/9wH4aqlrO3XV+:bVh/CZXO5h4jlnT8a
                    TLSH:3A75AF5AFBF610E9E5B9C178D953223AFC71796483399BCB4690460E4F31BE49A3DB00
                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r<9.6]W.6]W.6]W.}%T.1]W.}%R..]W.}%S.9]W.#"S.9]W.#"T.<]W.#"R.b]W.}%V.=]W.6]V..]W...^.2]W...W.7]W.....7]W.6]..7]W...U.7]W.Rich6]W

                    File Icon

                    Icon Hash:7ae282899bbab082

                    Static PE Info

                    General

                    Entrypoint:0x180036080
                    Entrypoint Section:.text
                    Digitally signed:false
                    Imagebase:0x180000000
                    Subsystem:windows gui
                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
                    DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
                    Time Stamp:0x671A7174 [Thu Oct 24 16:10:28 2024 UTC]
                    TLS Callbacks:
                    CLR (.Net) Version:
                    OS Version Major:6
                    OS Version Minor:0
                    File Version Major:6
                    File Version Minor:0
                    Subsystem Version Major:6
                    Subsystem Version Minor:0
                    Import Hash:1026835d87aa45b94dbd921bb7a74831

                    Entrypoint Preview

                    Instruction
                    dec esp
                    mov dword ptr [esp+18h], eax
                    mov dword ptr [esp+10h], edx
                    dec eax
                    mov dword ptr [esp+08h], ecx
                    dec eax
                    sub esp, 28h
                    cmp dword ptr [esp+38h], 01h
                    jne 00007FD684E2A1C7h
                    call 00007FD684E2AAF7h
                    dec esp
                    mov eax, dword ptr [esp+40h]
                    mov edx, dword ptr [esp+38h]
                    dec eax
                    mov ecx, dword ptr [esp+30h]
                    call 00007FD684E29FF4h
                    dec eax
                    add esp, 28h
                    ret
                    int3
                    int3
                    int3
                    int3
                    int3
                    int3
                    int3
                    int3
                    int3
                    int3
                    dec eax
                    mov dword ptr [esp+08h], ecx
                    dec eax
                    sub esp, 28h
                    mov edx, FFFFFFFFh
                    dec eax
                    mov ecx, dword ptr [esp+30h]
                    call 00007FD684E3A6EDh
                    dec eax
                    add esp, 28h
                    ret
                    int3
                    int3
                    int3
                    dec esp
                    mov dword ptr [esp+20h], ecx
                    dec esp
                    mov dword ptr [esp+18h], eax
                    dec eax
                    mov dword ptr [esp+10h], edx
                    dec eax
                    mov dword ptr [esp+08h], ecx
                    dec eax
                    sub esp, 48h
                    dec eax
                    mov eax, dword ptr [esp+68h]
                    dec eax
                    mov eax, dword ptr [eax+38h]
                    dec eax
                    add eax, 04h
                    dec eax
                    mov dword ptr [esp+30h], eax
                    dec esp
                    mov eax, dword ptr [esp+30h]
                    dec eax
                    mov edx, dword ptr [esp+68h]
                    dec eax
                    mov ecx, dword ptr [esp+58h]
                    call 00007FD684E2A2F7h
                    dec eax
                    mov eax, dword ptr [esp+30h]
                    mov eax, dword ptr [eax]
                    mov dword ptr [esp+20h], eax
                    dec eax
                    mov eax, dword ptr [esp+50h]
                    mov eax, dword ptr [eax+04h]
                    and eax, 66h
                    test eax, eax
                    jne 00007FD684E2A1CFh
                    mov eax, dword ptr [esp+20h]
                    and eax, 01h
                    mov dword ptr [esp+24h], eax
                    jmp 00007FD684E2A1CDh
                    mov eax, dword ptr [esp+00h]

                    Data Directories

                    NameVirtual AddressVirtual Size Is in Section
                    IMAGE_DIRECTORY_ENTRY_EXPORT0x1808f00x40.rdata
                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1809300x78.rdata
                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1990000x550.rsrc
                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x18d0000xaa58.pdata
                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x19a0000x1044.reloc
                    IMAGE_DIRECTORY_ENTRY_DEBUG0x178b500x38.rdata
                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x178a100x140.rdata
                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x3c0.rdata
                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                    Sections

                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                    .text0x10000x9ad850x9ae00e69f3c2fff635415811210911f5123a7False0.3688663362590799data5.95583010127468IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    .rdata0x9c0000xe55640xe560006aed8359d0b9a13498eb7ee570d6701False0.6833404291553133data6.158720556079672IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .data0x1820000xa1e40x1800c0c6c494b7d6aaa692c396fe2f89bd9bFalse0.16471354166666666DOS executable (block device driver)3.1475779911225867IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                    .pdata0x18d0000xaa580xac007bb6756851b0837239da63c1ab5ae683False0.4037745276162791data5.4699547785908536IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    _RDATA0x1980000x15c0x200ade23286435d460755ac4e95736a185fFalse0.404296875data3.313412750478552IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .rsrc0x1990000x5500x600fd02aa8b999603c6b3966cecb6a1d7ecFalse0.4173177083333333data3.842438330561097IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .reloc0x19a0000x10440x1200080eec7d894781bce2347d5b12274bfaFalse0.3858506944444444data5.258403565389978IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                    Resources

                    NameRVASizeTypeLanguageCountryZLIB Complexity
                    RT_VERSION0x1990a00x32cdataRussianRussia0.45320197044334976
                    RT_MANIFEST0x1993d00x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                    Imports

                    DLLImport
                    KERNEL32.dllLoadLibraryA, GetProcAddress, FreeLibrary, GetModuleHandleExA, WideCharToMultiByte, CreateFileW, SetStdHandle, MultiByteToWideChar, GetModuleHandleA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, ReadConsoleW, ReadFile, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetFilePointerEx, GetFileSizeEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, GetCurrentThreadId, CloseHandle, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, QueryPerformanceCounter, LCMapStringEx, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RaiseException, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetModuleFileNameW, GetModuleHandleExW, ExitProcess, CreateThread, ExitThread, FreeLibraryAndExitThread, HeapAlloc, HeapSize, HeapValidate, GetSystemInfo, GetStdHandle, GetFileType, WriteFile, OutputDebugStringW, WriteConsoleW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, DeleteFileW, HeapFree, HeapReAlloc, HeapQueryInformation, GetProcessHeap, RtlUnwind
                    USER32.dllGetDC
                    GDI32.dllGetDIBits
                    gdiplus.dllGdipAlloc, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipFree, GdipSaveImageToFile, GdipCloneImage, GdiplusStartup, GdiplusShutdown
                    WS2_32.dllsend, socket, inet_addr, recv, htons, WSAStartup, closesocket, connect

                    Exports

                    NameOrdinalAddress
                    go10x180021720

                    Possible Origin

                    Language of compilation systemCountry where language is spokenMap
                    RussianRussia
                    EnglishUnited States

                    Network Behavior

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Oct 24, 2024 19:55:12.292644024 CEST49711443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.292706966 CEST44349711178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:12.292783022 CEST49711443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.292821884 CEST49711443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.292829990 CEST44349711178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:12.293100119 CEST44349711178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:12.294038057 CEST49712443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.294095039 CEST44349712178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:12.294275999 CEST49712443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.294333935 CEST49712443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:12.294344902 CEST44349712178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:12.294398069 CEST44349712178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:14.260190010 CEST49714443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:14.260231972 CEST44349714178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:14.260297060 CEST49714443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:14.260333061 CEST49714443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:14.260338068 CEST44349714178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:14.260540962 CEST44349714178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.565080881 CEST49721443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.565124035 CEST44349721178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.565182924 CEST49721443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.565211058 CEST49721443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.565222979 CEST44349721178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.565309048 CEST44349721178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.566560030 CEST49722443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.566581011 CEST44349722178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.566665888 CEST49722443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.566684961 CEST49722443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:16.566689968 CEST44349722178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:16.566739082 CEST44349722178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.549757004 CEST49732443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.549803972 CEST44349732178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.549871922 CEST49732443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.549921036 CEST49732443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.549932957 CEST44349732178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.549982071 CEST44349732178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.705595970 CEST49734443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.705641031 CEST44349734178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.705703020 CEST49734443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.705735922 CEST49734443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.705744982 CEST44349734178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.705821037 CEST44349734178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.707075119 CEST49735443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.707108021 CEST44349735178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.707184076 CEST49735443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.707241058 CEST49735443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:18.707253933 CEST44349735178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:18.707271099 CEST44349735178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:20.691077948 CEST49746443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:20.691111088 CEST44349746178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:20.691178083 CEST49746443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:20.691212893 CEST49746443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:20.691220999 CEST44349746178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:20.691405058 CEST44349746178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.003890038 CEST49763443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.003951073 CEST44349763178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.004033089 CEST49763443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.004101038 CEST49763443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.004115105 CEST44349763178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.004220009 CEST44349763178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.005563974 CEST49764443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.005584955 CEST44349764178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.005731106 CEST49764443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.005774975 CEST49764443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:23.005784988 CEST44349764178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:23.005805016 CEST44349764178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:24.977380991 CEST49779443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:24.977411985 CEST44349779178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:24.977689028 CEST49779443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:24.977780104 CEST49779443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:24.977787971 CEST44349779178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:24.977833033 CEST44349779178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.174705982 CEST49780443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.174722910 CEST44349780178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.174787998 CEST49780443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.174855947 CEST49780443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.174861908 CEST44349780178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.174984932 CEST44349780178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.176587105 CEST49781443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.176624060 CEST44349781178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.176680088 CEST49781443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.176749945 CEST49781443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:25.176758051 CEST44349781178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:25.176779032 CEST44349781178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:27.111721039 CEST49792443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:27.111795902 CEST44349792178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:27.111867905 CEST49792443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:27.111942053 CEST49792443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:27.111964941 CEST44349792178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:27.112073898 CEST44349792178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.440200090 CEST49808443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.440228939 CEST44349808178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.440309048 CEST49808443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.440355062 CEST49808443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.440359116 CEST44349808178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.440524101 CEST44349808178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.441844940 CEST49809443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.441935062 CEST44349809178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.442059040 CEST49809443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.442120075 CEST49809443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:29.442137957 CEST44349809178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:29.442243099 CEST44349809178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.393045902 CEST49820443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.393104076 CEST44349820178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.393239021 CEST49820443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.393270016 CEST49820443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.393277884 CEST44349820178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.393420935 CEST44349820178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.581453085 CEST49821443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.581479073 CEST44349821178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.581549883 CEST49821443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.581690073 CEST49821443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.581710100 CEST44349821178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.581765890 CEST44349821178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.583075047 CEST49822443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.583117008 CEST44349822178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.583178043 CEST49822443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.583224058 CEST49822443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:31.583235979 CEST44349822178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:31.583256006 CEST44349822178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:33.534146070 CEST49833443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:33.534205914 CEST44349833178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:33.534301996 CEST49833443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:33.534378052 CEST49833443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:33.534394026 CEST44349833178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:33.534559011 CEST44349833178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.982028961 CEST49844443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.982070923 CEST44349844178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.982162952 CEST49844443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.982191086 CEST49844443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.982197046 CEST44349844178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.982310057 CEST44349844178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.984451056 CEST49845443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.984494925 CEST44349845178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.984550953 CEST49845443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.984594107 CEST49845443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:35.984601021 CEST44349845178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:35.984647989 CEST44349845178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.065067053 CEST49860443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.065098047 CEST44349860178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.065185070 CEST49860443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.065227032 CEST49860443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.065232992 CEST44349860178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.065354109 CEST44349860178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.099114895 CEST49861443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.099149942 CEST44349861178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.099236965 CEST49861443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.099287033 CEST49861443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.099292040 CEST44349861178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.099391937 CEST44349861178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.107992887 CEST49862443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.108025074 CEST44349862178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.108092070 CEST49862443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.108131886 CEST49862443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:38.108138084 CEST44349862178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:38.108172894 CEST44349862178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:40.208008051 CEST49873443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:40.208070040 CEST44349873178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:40.208137989 CEST49873443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:40.208172083 CEST49873443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:40.208178997 CEST44349873178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:40.208538055 CEST44349873178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377641916 CEST49889443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377643108 CEST49888443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377659082 CEST44349889178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377690077 CEST44349888178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377736092 CEST49889443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377765894 CEST49888443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377818108 CEST49889443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377819061 CEST49888443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:42.377824068 CEST44349889178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377826929 CEST44349888178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377875090 CEST44349889178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:42.377914906 CEST44349888178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.528736115 CEST49899443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.528789997 CEST44349899178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.528888941 CEST49899443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.528928995 CEST49899443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.528935909 CEST44349899178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.529077053 CEST44349899178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.542798042 CEST49900443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.542829990 CEST44349900178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.542936087 CEST49900443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.542963982 CEST49900443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.542969942 CEST44349900178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.543081045 CEST44349900178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.544382095 CEST49901443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.544435978 CEST44349901178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.544502974 CEST49901443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.544543028 CEST49901443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:44.544548988 CEST44349901178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:44.544595957 CEST44349901178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:46.659852028 CEST49912443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:46.659889936 CEST44349912178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:46.659976006 CEST49912443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:46.660012960 CEST49912443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:46.660018921 CEST44349912178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:46.660156012 CEST44349912178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.831058025 CEST49924443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.831104994 CEST44349924178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.831186056 CEST49924443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.831233978 CEST49924443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.831242085 CEST44349924178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.831377983 CEST44349924178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.831468105 CEST49925443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.831521034 CEST44349925178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.831979036 CEST49925443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.832098961 CEST49925443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:48.832118034 CEST44349925178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:48.832144022 CEST44349925178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.971796989 CEST49941443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.971848965 CEST44349941178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.971931934 CEST49941443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.971978903 CEST49941443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.971987009 CEST44349941178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.972110033 CEST44349941178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.973588943 CEST49942443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.973664045 CEST44349942178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.973757029 CEST49942443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.973823071 CEST49942443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.973845959 CEST44349942178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.973875046 CEST44349942178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.973967075 CEST49943443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.973984957 CEST44349943178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.974035978 CEST49943443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.974097013 CEST49943443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:50.974106073 CEST44349943178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:50.974126101 CEST44349943178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:53.112205982 CEST49954443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:53.112257957 CEST44349954178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:53.112334013 CEST49954443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:53.112365007 CEST49954443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:53.112371922 CEST44349954178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:53.112510920 CEST44349954178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.362081051 CEST49967443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.362121105 CEST44349967178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.362170935 CEST49967443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.366197109 CEST49967443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.366216898 CEST44349967178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.366255999 CEST44349967178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.375694036 CEST49968443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.375729084 CEST44349968178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.375782013 CEST49968443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.375849009 CEST49968443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:55.375854015 CEST44349968178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:55.375904083 CEST44349968178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.425259113 CEST49978443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.425321102 CEST44349978178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.425399065 CEST49978443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.425451994 CEST49978443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.425457954 CEST44349978178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.425570011 CEST44349978178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.426178932 CEST49977443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.426239967 CEST44349977178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.426480055 CEST49977443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.426480055 CEST49977443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.426480055 CEST49979443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.426523924 CEST44349977178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.426537991 CEST44349979178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.426570892 CEST44349977178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.427231073 CEST49979443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.427231073 CEST49979443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:57.427257061 CEST44349979178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:57.427299023 CEST44349979178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:59.565251112 CEST49991443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:59.565288067 CEST44349991178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:59.565350056 CEST49991443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:59.565391064 CEST49991443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:55:59.565396070 CEST44349991178.156.131.83192.168.2.6
                    Oct 24, 2024 19:55:59.565469980 CEST44349991178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.705753088 CEST50002443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.705797911 CEST44350002178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.705954075 CEST50002443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.705996037 CEST50002443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.706001997 CEST44350002178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.706166983 CEST44350002178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.706433058 CEST50003443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.706469059 CEST44350003178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.706609011 CEST50003443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.706641912 CEST50003443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:01.706655979 CEST44350003178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:01.706684113 CEST44350003178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.846616030 CEST50014443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846621037 CEST50015443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846667051 CEST44350014178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.846673965 CEST44350015178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.846755981 CEST50014443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846842051 CEST50014443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846852064 CEST44350014178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.846909046 CEST44350014178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.846940994 CEST50015443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846940994 CEST50015443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.846980095 CEST44350015178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.847027063 CEST44350015178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.848058939 CEST50016443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.848077059 CEST44350016178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.848151922 CEST50016443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.848207951 CEST50016443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:03.848217964 CEST44350016178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:03.848239899 CEST44350016178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:05.986860037 CEST50025443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:05.986931086 CEST44350025178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:05.987027884 CEST50025443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:05.987122059 CEST50025443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:05.987138033 CEST44350025178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:05.987190962 CEST44350025178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.134032011 CEST50034443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.134098053 CEST44350034178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.134289026 CEST50034443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.134380102 CEST50034443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.134402037 CEST44350034178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.134469986 CEST44350034178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.136305094 CEST50035443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.136337042 CEST44350035178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.136485100 CEST50035443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.136533976 CEST50035443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:08.136549950 CEST44350035178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:08.136579037 CEST44350035178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268307924 CEST50039443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268400908 CEST44350039178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268490076 CEST50040443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268537045 CEST44350040178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268548965 CEST50039443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268548965 CEST50039443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268585920 CEST50040443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268640041 CEST44350039178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268641949 CEST50040443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.268649101 CEST44350040178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268830061 CEST44350040178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.268834114 CEST44350039178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.269761086 CEST50041443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.269807100 CEST44350041178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.269877911 CEST50041443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.269920111 CEST50041443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:10.269931078 CEST44350041178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:10.269989014 CEST44350041178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:12.408655882 CEST50042443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:12.408670902 CEST44350042178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:12.408749104 CEST50042443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:12.408783913 CEST50042443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:12.408787966 CEST44350042178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:12.409032106 CEST44350042178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.550720930 CEST50043443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.550757885 CEST44350043178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.550837994 CEST50043443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.550869942 CEST50043443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.550875902 CEST44350043178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.551002026 CEST44350043178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.552298069 CEST50044443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.552362919 CEST44350044178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.552432060 CEST50044443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.552468061 CEST50044443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:14.552474976 CEST44350044178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:14.552522898 CEST44350044178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.690861940 CEST50045443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.690915108 CEST44350045178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.691029072 CEST50045443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.691179991 CEST50045443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.691198111 CEST44350045178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.691302061 CEST44350045178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.691469908 CEST50046443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.691518068 CEST44350046178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.691580057 CEST50046443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.691612005 CEST50046443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.691617012 CEST44350046178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.691704988 CEST44350046178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.692061901 CEST50047443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.692096949 CEST44350047178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.692186117 CEST50047443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.692305088 CEST50047443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:16.692320108 CEST44350047178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:16.692341089 CEST44350047178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:18.877959967 CEST50048443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:18.878009081 CEST44350048178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:18.878170967 CEST50048443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:18.878972054 CEST50048443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:18.878987074 CEST44350048178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:18.879067898 CEST44350048178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.020652056 CEST50049443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.020699978 CEST44350049178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.020766020 CEST50049443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.020809889 CEST50049443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.020816088 CEST44350049178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.021007061 CEST44350049178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.022078037 CEST50050443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.022114992 CEST44350050178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.022165060 CEST50050443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.022206068 CEST50050443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:21.022212982 CEST44350050178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:21.022274971 CEST44350050178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.159334898 CEST50051443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.159390926 CEST44350051178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.159475088 CEST50051443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.159522057 CEST50051443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.159528017 CEST44350051178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.159640074 CEST44350051178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.161999941 CEST50052443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162043095 CEST44350052178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.162106037 CEST50052443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162137985 CEST50052443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162144899 CEST44350052178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.162256002 CEST44350052178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.162334919 CEST50053443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162359953 CEST44350053178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.162446022 CEST50053443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162746906 CEST50053443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:23.162760973 CEST44350053178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:23.162781954 CEST44350053178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:25.300412893 CEST50055443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:25.300467968 CEST44350055178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:25.300538063 CEST50055443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:25.300720930 CEST50055443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:25.300734043 CEST44350055178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:25.300797939 CEST44350055178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.443059921 CEST50056443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.443114042 CEST44350056178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.443186045 CEST50056443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.443249941 CEST50056443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.443257093 CEST44350056178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.443417072 CEST44350056178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.445003033 CEST50057443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.445051908 CEST44350057178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.445116997 CEST50057443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.445149899 CEST50057443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:27.445156097 CEST44350057178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:27.445245028 CEST44350057178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.580759048 CEST50058443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.580853939 CEST44350058178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.581006050 CEST50058443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.581075907 CEST50058443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.581096888 CEST44350058178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.581217051 CEST44350058178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.582360029 CEST50059443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.582438946 CEST44350059178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.582603931 CEST50059443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.582673073 CEST50059443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.582694054 CEST44350059178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.582725048 CEST44350059178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.583529949 CEST50060443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.583559036 CEST44350060178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.583626032 CEST50060443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.583692074 CEST50060443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:29.583705902 CEST44350060178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:29.583739042 CEST44350060178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:31.737207890 CEST50061443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:31.737258911 CEST44350061178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:31.737355947 CEST50061443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:31.737394094 CEST50061443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:31.737400055 CEST44350061178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:31.737536907 CEST44350061178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.886934996 CEST50062443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.887015104 CEST44350062178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.887161970 CEST50062443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.887161970 CEST50062443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.887202978 CEST44350062178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.887377977 CEST44350062178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.888192892 CEST50063443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.888230085 CEST44350063178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.888293982 CEST50063443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.888339043 CEST50063443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:33.888354063 CEST44350063178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:33.888398886 CEST44350063178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.034379959 CEST50064443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.034486055 CEST44350064178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.034658909 CEST50064443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.034658909 CEST50064443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.034738064 CEST44350064178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.034892082 CEST44350064178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.035650015 CEST50065443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.035697937 CEST44350065178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.035809994 CEST50065443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.035842896 CEST50065443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.035850048 CEST44350065178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.035907030 CEST44350065178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.036716938 CEST50066443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.036776066 CEST44350066178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.036895037 CEST50066443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.036962986 CEST50066443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:36.036978006 CEST44350066178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:36.037010908 CEST44350066178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:38.178746939 CEST50067443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:38.178797960 CEST44350067178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:38.178864002 CEST50067443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:38.178913116 CEST50067443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:38.178919077 CEST44350067178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:38.179089069 CEST44350067178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.411874056 CEST50068443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.411911964 CEST44350068178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.412070036 CEST50068443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.412184000 CEST50068443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.412190914 CEST44350068178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.412252903 CEST44350068178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.412250996 CEST50069443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.412308931 CEST44350069178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.412429094 CEST50069443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.412760019 CEST50069443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:40.412770987 CEST44350069178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:40.412792921 CEST44350069178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.724085093 CEST50071443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.724126101 CEST44350071178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.724219084 CEST50071443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.724270105 CEST50071443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.724275112 CEST44350071178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.724433899 CEST44350071178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.726056099 CEST50072443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.726094007 CEST44350072178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.726155043 CEST50072443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.726196051 CEST50072443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.726203918 CEST44350072178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.726264954 CEST44350072178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.728001118 CEST50073443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.728034973 CEST44350073178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.728107929 CEST50073443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.728250980 CEST50073443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:42.728265047 CEST44350073178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:42.728317976 CEST44350073178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:44.862565041 CEST50074443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:44.862610102 CEST44350074178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:44.862862110 CEST50074443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:44.862974882 CEST50074443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:44.862991095 CEST44350074178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:44.863040924 CEST44350074178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.003087997 CEST50075443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.003125906 CEST44350075178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.003194094 CEST50075443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.003253937 CEST50075443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.003261089 CEST44350075178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.003370047 CEST44350075178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.003953934 CEST50076443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.003978014 CEST44350076178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.004081964 CEST50076443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.004112005 CEST50076443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:47.004116058 CEST44350076178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:47.004158020 CEST44350076178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143297911 CEST50077443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143300056 CEST50078443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143328905 CEST44350077178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143340111 CEST44350078178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143462896 CEST50078443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143462896 CEST50078443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143491983 CEST44350078178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143493891 CEST50077443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143528938 CEST50077443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.143534899 CEST44350077178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143662930 CEST44350078178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.143677950 CEST44350077178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.144790888 CEST50079443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.144826889 CEST44350079178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.144891977 CEST50079443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.144937038 CEST50079443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:49.144942999 CEST44350079178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:49.144999981 CEST44350079178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:51.284621000 CEST50080443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:51.284643888 CEST44350080178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:51.284795046 CEST50080443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:51.284811020 CEST44350080178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:51.284847021 CEST50080443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:51.284853935 CEST44350080178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:51.284962893 CEST44350080178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.428901911 CEST50081443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.429019928 CEST44350081178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.429104090 CEST50081443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.429181099 CEST50081443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.429200888 CEST44350081178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.429349899 CEST44350081178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.433037043 CEST50082443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.433126926 CEST44350082178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.433207989 CEST50082443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.433274031 CEST50082443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:53.433293104 CEST44350082178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:53.433360100 CEST44350082178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.565676928 CEST50083443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.565784931 CEST44350083178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.565891981 CEST50083443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.565958977 CEST50084443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.565967083 CEST50083443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.565987110 CEST44350083178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.565995932 CEST44350084178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.566070080 CEST50084443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.566145897 CEST44350083178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.566181898 CEST50084443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.566190004 CEST44350084178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.566337109 CEST44350084178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.566819906 CEST50085443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.566870928 CEST44350085178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.566976070 CEST50085443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.566976070 CEST50085443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:55.567018986 CEST44350085178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:55.567070007 CEST44350085178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:57.705781937 CEST50086443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:57.705823898 CEST44350086178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:57.705923080 CEST50086443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:57.705960989 CEST50086443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:57.705965996 CEST44350086178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:57.706089020 CEST44350086178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.848505020 CEST50087443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.848556042 CEST44350087178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.848665953 CEST50087443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.848665953 CEST50087443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.848706007 CEST44350087178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.848850965 CEST44350087178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.857441902 CEST50088443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.857484102 CEST44350088178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.857630014 CEST50088443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.866566896 CEST50088443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:56:59.866584063 CEST44350088178.156.131.83192.168.2.6
                    Oct 24, 2024 19:56:59.866615057 CEST44350088178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988019943 CEST50089443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988074064 CEST44350089178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988251925 CEST50089443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988419056 CEST50090443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988462925 CEST44350090178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988504887 CEST50089443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988518000 CEST44350089178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988579035 CEST44350089178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988596916 CEST50090443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988629103 CEST50090443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.988634109 CEST44350090178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.988698959 CEST44350090178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.989329100 CEST50091443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.989345074 CEST44350091178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.989439011 CEST50091443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.989453077 CEST50091443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:01.989455938 CEST44350091178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:01.989518881 CEST44350091178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:04.127978086 CEST50092443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:04.128010035 CEST44350092178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:04.128087044 CEST50092443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:04.128467083 CEST50092443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:04.128475904 CEST44350092178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:04.128525019 CEST44350092178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.363090992 CEST50093443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.363141060 CEST44350093178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.363212109 CEST50093443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.363254070 CEST50093443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.363260031 CEST44350093178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.363513947 CEST44350093178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.381222010 CEST50094443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.381263971 CEST44350094178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.381370068 CEST50094443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.381664038 CEST50094443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:06.381683111 CEST44350094178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:06.381717920 CEST44350094178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.431628942 CEST50095443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.431694031 CEST44350095178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.431808949 CEST50095443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.431808949 CEST50095443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.431859016 CEST44350095178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.432010889 CEST44350095178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.433176041 CEST50096443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.433224916 CEST44350096178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.433293104 CEST50096443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.433326960 CEST50096443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.433335066 CEST44350096178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.433404922 CEST44350096178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.434509993 CEST50097443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.434561968 CEST44350097178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.434633970 CEST50097443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.434633970 CEST50097443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:08.434672117 CEST44350097178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:08.434719086 CEST44350097178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:10.565057993 CEST50098443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:10.565115929 CEST44350098178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:10.565196991 CEST50098443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:10.565232038 CEST50098443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:10.565239906 CEST44350098178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:10.565362930 CEST44350098178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.705944061 CEST50099443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.705990076 CEST44350099178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.706068039 CEST50099443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.706239939 CEST50099443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.706262112 CEST44350099178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.706324100 CEST44350099178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.707520008 CEST50100443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.707582951 CEST44350100178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.707665920 CEST50100443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.707695961 CEST50100443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:12.707704067 CEST44350100178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:12.707786083 CEST44350100178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.847249985 CEST50101443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.847299099 CEST44350101178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.847522974 CEST50101443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.847651958 CEST50101443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.847656965 CEST44350101178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.847939014 CEST44350101178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.848042011 CEST50102443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.848088026 CEST44350102178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.848210096 CEST50102443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.848210096 CEST50102443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.848246098 CEST44350102178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.848337889 CEST44350102178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.849464893 CEST50103443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.849484921 CEST44350103178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.849605083 CEST50103443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.849771976 CEST50103443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:14.849781990 CEST44350103178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:14.849809885 CEST44350103178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:16.987114906 CEST50104443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:16.987212896 CEST44350104178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:16.987375021 CEST50104443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:16.987375021 CEST50104443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:16.987461090 CEST44350104178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:16.987596035 CEST44350104178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.127726078 CEST50105443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.127850056 CEST44350105178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.127948046 CEST50106443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.127963066 CEST50105443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.128036976 CEST44350106178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.128067017 CEST50105443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.128088951 CEST44350105178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.128176928 CEST50106443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.128236055 CEST50106443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:19.128256083 CEST44350105178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.128262043 CEST44350106178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:19.128376961 CEST44350106178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.268608093 CEST50107443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.268677950 CEST44350107178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.268767118 CEST50107443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.268861055 CEST50107443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.268881083 CEST44350107178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.268965960 CEST44350107178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.269802094 CEST50108443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.269844055 CEST44350108178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.269912958 CEST50109443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.269948959 CEST44350109178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.269965887 CEST50108443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.269965887 CEST50108443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.270003080 CEST44350108178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.270041943 CEST50109443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.270041943 CEST50109443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:21.270067930 CEST44350109178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.270101070 CEST44350108178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:21.270148039 CEST44350109178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:23.408835888 CEST50110443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:23.408881903 CEST44350110178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:23.408994913 CEST50110443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:23.409121037 CEST50110443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:23.409130096 CEST44350110178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:23.409238100 CEST44350110178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.551999092 CEST50111443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.552053928 CEST44350111178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.552268982 CEST50111443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.552344084 CEST50111443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.552350998 CEST44350111178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.552606106 CEST44350111178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.553134918 CEST50112443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.553147078 CEST44350112178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.553265095 CEST50112443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.553265095 CEST50112443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:25.553286076 CEST44350112178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:25.553373098 CEST44350112178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690181017 CEST50114443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690227032 CEST44350114178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690385103 CEST50114443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690385103 CEST50114443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690403938 CEST50115443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690417051 CEST44350114178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690464973 CEST44350115178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690521955 CEST50115443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690556049 CEST50115443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.690562963 CEST44350115178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690807104 CEST44350114178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.690948963 CEST44350115178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.691467047 CEST50116443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.691519976 CEST44350116178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.691582918 CEST50116443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.691618919 CEST50116443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:27.691627026 CEST44350116178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:27.691701889 CEST44350116178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:29.830971956 CEST50117443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:29.831109047 CEST44350117178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:29.831231117 CEST50117443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:29.831317902 CEST50117443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:29.831340075 CEST44350117178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:29.831707001 CEST44350117178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:31.990312099 CEST50118443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:31.990366936 CEST44350118178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:31.990437984 CEST50118443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:31.990497112 CEST50118443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:31.990503073 CEST44350118178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:31.990708113 CEST44350118178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:32.004632950 CEST50119443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:32.004697084 CEST44350119178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:32.004772902 CEST50119443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:32.004808903 CEST50119443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:32.004817963 CEST44350119178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:32.004911900 CEST44350119178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.128650904 CEST50120443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.128698111 CEST44350120178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.128758907 CEST50120443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.128822088 CEST50120443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.128838062 CEST44350120178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.128997087 CEST44350120178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130372047 CEST50122443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130382061 CEST44350122178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130448103 CEST50122443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130491972 CEST50122443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130496979 CEST44350122178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130623102 CEST44350122178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130645037 CEST50121443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130696058 CEST44350121178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130804062 CEST50121443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130897999 CEST50121443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:34.130913019 CEST44350121178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:34.130959034 CEST44350121178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:36.268253088 CEST50123443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:36.268292904 CEST44350123178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:36.268378973 CEST50123443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:36.268409967 CEST50123443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:36.268416882 CEST44350123178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:36.268570900 CEST44350123178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.409389973 CEST50124443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.409445047 CEST44350124178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.409624100 CEST50124443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.409661055 CEST50124443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.409666061 CEST44350124178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.409815073 CEST44350124178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.410964012 CEST50125443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.411046028 CEST44350125178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.411163092 CEST50125443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.411411047 CEST50125443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:38.411439896 CEST44350125178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:38.411469936 CEST44350125178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.549520016 CEST50126443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.549555063 CEST44350126178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.549622059 CEST50126443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.549664974 CEST50126443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.549670935 CEST44350126178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.549953938 CEST44350126178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.549968958 CEST50127443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.550024986 CEST44350127178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.550080061 CEST50127443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.550122023 CEST50127443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.550131083 CEST44350127178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.550183058 CEST44350127178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.550812006 CEST50128443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.550873995 CEST44350128178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.550923109 CEST50128443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.550995111 CEST50128443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:40.551002979 CEST44350128178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:40.551044941 CEST44350128178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:42.693116903 CEST50129443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:42.693161964 CEST44350129178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:42.693281889 CEST50129443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:42.693344116 CEST50129443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:42.693348885 CEST44350129178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:42.693475008 CEST44350129178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.831017017 CEST50130443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.831072092 CEST44350130178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.831171989 CEST50130443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.832258940 CEST50130443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.832278013 CEST44350130178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.832355976 CEST44350130178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.832420111 CEST50131443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.832467079 CEST44350131178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.832595110 CEST50131443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.833234072 CEST50131443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:44.833245993 CEST44350131178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:44.833267927 CEST44350131178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.971651077 CEST50132443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.971713066 CEST44350132178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.971791029 CEST50132443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.971839905 CEST50132443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.971848011 CEST44350132178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.971853971 CEST50133443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.971895933 CEST44350133178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.971957922 CEST44350132178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.971977949 CEST50133443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.971977949 CEST50133443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.972008944 CEST44350133178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.972045898 CEST44350133178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.972946882 CEST50134443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.972965956 CEST44350134178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.973027945 CEST50134443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.973067045 CEST50134443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:46.973074913 CEST44350134178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:46.973093987 CEST44350134178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:49.112025976 CEST50135443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:49.112066984 CEST44350135178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:49.112159014 CEST50135443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:49.112183094 CEST50135443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:49.112195015 CEST44350135178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:49.112334967 CEST44350135178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.252749920 CEST50136443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.252788067 CEST44350136178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.252969027 CEST50136443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.253037930 CEST50136443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.253074884 CEST44350136178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.253143072 CEST44350136178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.254288912 CEST50137443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.254334927 CEST44350137178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.254435062 CEST50137443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.254605055 CEST50137443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:51.254622936 CEST44350137178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:51.254642963 CEST44350137178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.394906998 CEST50138443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.394974947 CEST44350138178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.395152092 CEST50138443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.395152092 CEST50138443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.395196915 CEST44350138178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.395384073 CEST44350138178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.395735025 CEST50139443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.395780087 CEST44350139178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.395901918 CEST50139443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.395929098 CEST50139443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.395934105 CEST44350139178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.395972967 CEST44350139178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.396723032 CEST50140443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.396764994 CEST44350140178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.396833897 CEST50140443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.396878004 CEST50140443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:53.396889925 CEST44350140178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:53.396909952 CEST44350140178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:55.534522057 CEST50141443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:55.534565926 CEST44350141178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:55.534655094 CEST50141443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:55.534735918 CEST50141443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:55.534744024 CEST44350141178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:55.534830093 CEST44350141178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.675045967 CEST50142443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.675106049 CEST44350142178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.675322056 CEST50142443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.677046061 CEST50142443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.677061081 CEST44350142178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.677119017 CEST44350142178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.677505016 CEST50143443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.677540064 CEST44350143178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.677643061 CEST50143443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.677838087 CEST50143443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:57.677849054 CEST44350143178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:57.677864075 CEST44350143178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.816356897 CEST50144443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.816410065 CEST44350144178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.816600084 CEST50144443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.816775084 CEST50144443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.816792011 CEST44350144178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.816827059 CEST50145443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.816876888 CEST44350145178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.816942930 CEST44350144178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.817012072 CEST50145443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.817059994 CEST50145443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.817066908 CEST44350145178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.817100048 CEST44350145178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.817598104 CEST50146443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.817609072 CEST44350146178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.817806959 CEST50146443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.817806959 CEST50146443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:57:59.817827940 CEST44350146178.156.131.83192.168.2.6
                    Oct 24, 2024 19:57:59.817859888 CEST44350146178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:01.956474066 CEST50147443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:01.956521988 CEST44350147178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:01.956597090 CEST50147443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:01.956701994 CEST50147443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:01.956711054 CEST44350147178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:01.956815004 CEST44350147178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.100725889 CEST50148443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.100828886 CEST44350148178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.100907087 CEST50148443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.101015091 CEST50148443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.101037979 CEST44350148178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.101114988 CEST44350148178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.103018045 CEST50149443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.103072882 CEST44350149178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.103166103 CEST50149443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.103194952 CEST50149443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:04.103214979 CEST44350149178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:04.103262901 CEST44350149178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.237045050 CEST50150443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.237118006 CEST44350150178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.237283945 CEST50150443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.237498999 CEST50150443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.237528086 CEST44350150178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.237576962 CEST44350150178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.238143921 CEST50151443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.238181114 CEST44350151178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.238301039 CEST50151443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.238301039 CEST50151443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.238331079 CEST44350151178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.238368034 CEST44350151178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.239816904 CEST50152443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.239847898 CEST44350152178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.239964008 CEST50152443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.239998102 CEST50152443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:06.240005970 CEST44350152178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:06.240029097 CEST44350152178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:08.378012896 CEST50153443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:08.378117085 CEST44350153178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:08.378227949 CEST50153443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:08.378292084 CEST50153443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:08.378310919 CEST44350153178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:08.378433943 CEST44350153178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.518280983 CEST50154443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.518343925 CEST44350154178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.518435955 CEST50154443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.518481016 CEST50154443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.518487930 CEST44350154178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.518610954 CEST44350154178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.519846916 CEST50155443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.519897938 CEST44350155178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.519959927 CEST50155443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.519995928 CEST50155443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:10.520001888 CEST44350155178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:10.520087957 CEST44350155178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.659636021 CEST50156443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.659689903 CEST44350156178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.659955025 CEST50156443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.660159111 CEST50156443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.660176039 CEST44350156178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.660231113 CEST44350156178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.660363913 CEST50157443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.660393953 CEST44350157178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.660480022 CEST50157443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.660507917 CEST50157443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.660518885 CEST44350157178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.660537004 CEST44350157178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.661973953 CEST50158443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.662005901 CEST44350158178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.662182093 CEST50158443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.662182093 CEST50158443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:12.662216902 CEST44350158178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:12.662247896 CEST44350158178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:14.802124977 CEST50159443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:14.802176952 CEST44350159178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:14.802340984 CEST50159443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:14.802478075 CEST50159443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:14.802489042 CEST44350159178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:14.802617073 CEST44350159178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940458059 CEST50160443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940537930 CEST50161443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940567017 CEST44350160178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940601110 CEST44350161178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940658092 CEST50160443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940675020 CEST50161443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940713882 CEST50160443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940731049 CEST50161443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:16.940732002 CEST44350160178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940737963 CEST44350161178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940882921 CEST44350160178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:16.940884113 CEST44350161178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081115961 CEST50162443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081168890 CEST44350162178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081254005 CEST50162443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081305027 CEST50162443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081310987 CEST44350162178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081384897 CEST50163443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081423044 CEST44350163178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081432104 CEST44350162178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081482887 CEST50163443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081516027 CEST50163443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.081522942 CEST44350163178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.081573963 CEST44350163178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.082566977 CEST50164443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.082609892 CEST44350164178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.082678080 CEST50164443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.082710028 CEST50164443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:19.082716942 CEST44350164178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:19.082760096 CEST44350164178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:21.221362114 CEST50165443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:21.221409082 CEST44350165178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:21.221544027 CEST50165443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:21.221570969 CEST50165443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:21.221577883 CEST44350165178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:21.221716881 CEST44350165178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.362474918 CEST50166443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.362535954 CEST44350166178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.362618923 CEST50166443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.362649918 CEST50166443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.362663984 CEST44350166178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.362787962 CEST44350166178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.363895893 CEST50167443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.363933086 CEST44350167178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.363991976 CEST50167443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.364038944 CEST50167443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:23.364046097 CEST44350167178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:23.364099979 CEST44350167178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503554106 CEST50168443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503588915 CEST50169443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503618956 CEST44350168178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503640890 CEST44350169178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503694057 CEST50168443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503730059 CEST50169443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503773928 CEST50169443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503779888 CEST44350169178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503783941 CEST50168443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.503797054 CEST44350168178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503875971 CEST44350168178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.503952980 CEST44350169178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.504590988 CEST50170443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.504626989 CEST44350170178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.504686117 CEST50170443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.504720926 CEST50170443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:25.504733086 CEST44350170178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:25.504760027 CEST44350170178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:27.643274069 CEST50171443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:27.643347025 CEST44350171178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:27.643433094 CEST50171443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:27.643474102 CEST50171443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:27.643481970 CEST44350171178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:27.643605947 CEST44350171178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784041882 CEST50173443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784112930 CEST50172443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784142017 CEST44350173178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784159899 CEST44350172178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784336090 CEST50173443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784336090 CEST50173443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784359932 CEST50172443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784359932 CEST50172443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:29.784404039 CEST44350172178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784416914 CEST44350173178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784529924 CEST44350173178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:29.784755945 CEST44350172178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.924770117 CEST50174443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.924819946 CEST44350174178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.924901962 CEST50174443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.924948931 CEST50174443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.924952984 CEST44350174178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.925141096 CEST44350174178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.926291943 CEST50175443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.926341057 CEST44350175178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.926414013 CEST50175443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.926446915 CEST50175443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.926455021 CEST44350175178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.926525116 CEST44350175178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.927714109 CEST50176443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.927767992 CEST44350176178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.927845001 CEST50176443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.927882910 CEST50176443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:31.927891970 CEST44350176178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:31.927953005 CEST44350176178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:34.066137075 CEST50177443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:34.066189051 CEST44350177178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:34.066278934 CEST50177443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:34.066323996 CEST50177443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:34.066330910 CEST44350177178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:34.066504002 CEST44350177178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206274033 CEST50178443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206291914 CEST50179443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206322908 CEST44350178178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206334114 CEST44350179178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206409931 CEST50178443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206485033 CEST50179443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206485033 CEST50179443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206501961 CEST50178443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:36.206511974 CEST44350179178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206518888 CEST44350178178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206629038 CEST44350178178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:36.206656933 CEST44350179178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.349589109 CEST50180443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.349646091 CEST44350180178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.349708080 CEST50180443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.349756956 CEST50180443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.349764109 CEST44350180178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.350009918 CEST44350180178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.351288080 CEST50181443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.351368904 CEST44350181178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.351435900 CEST50181443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.351490974 CEST50181443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.351506948 CEST44350181178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.351600885 CEST44350181178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.352284908 CEST50182443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.352305889 CEST44350182178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.352349997 CEST50182443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.352384090 CEST50182443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:38.352387905 CEST44350182178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:38.352453947 CEST44350182178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:40.487596035 CEST50183443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:40.487706900 CEST44350183178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:40.487849951 CEST50183443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:40.487919092 CEST50183443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:40.487937927 CEST44350183178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:40.488173962 CEST44350183178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628331900 CEST50185443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628396988 CEST44350185178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628479004 CEST50185443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628528118 CEST50185443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628536940 CEST44350185178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628643990 CEST50184443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628650904 CEST44350185178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628684044 CEST44350184178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628798008 CEST50184443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628798008 CEST50184443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:42.628828049 CEST44350184178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:42.628910065 CEST44350184178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.768738031 CEST50186443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.768784046 CEST44350186178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.768861055 CEST50186443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.768904924 CEST50186443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.768912077 CEST44350186178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.769037008 CEST44350186178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.770205975 CEST50187443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.770248890 CEST44350187178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.770311117 CEST50187443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.770359039 CEST50187443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.770368099 CEST44350187178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.770394087 CEST44350187178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.771615028 CEST50188443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.771651030 CEST44350188178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.771703959 CEST50188443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.771745920 CEST50188443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:44.771754980 CEST44350188178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:44.771770954 CEST44350188178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:46.951232910 CEST50189443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:46.951281071 CEST44350189178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:46.951361895 CEST50189443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:46.951419115 CEST50189443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:46.951428890 CEST44350189178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:46.951523066 CEST44350189178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081187963 CEST50190443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081226110 CEST44350190178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081362963 CEST50190443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081362963 CEST50190443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081391096 CEST44350190178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081429005 CEST50191443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081485033 CEST44350191178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081528902 CEST44350190178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081542969 CEST50191443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081599951 CEST50191443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:49.081614017 CEST44350191178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:49.081629992 CEST44350191178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.222855091 CEST50192443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.222980976 CEST44350192178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.223134041 CEST50193443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.223155022 CEST50192443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.223172903 CEST44350193178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.223225117 CEST50192443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.223243952 CEST44350192178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.223359108 CEST50193443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.223473072 CEST44350192178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.223604918 CEST50193443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.223612070 CEST44350193178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.223644972 CEST44350193178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.224219084 CEST50194443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.224246025 CEST44350194178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.224364042 CEST50194443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.224406004 CEST50194443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:51.224419117 CEST44350194178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:51.224497080 CEST44350194178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:53.392379045 CEST50195443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:53.392425060 CEST44350195178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:53.392492056 CEST50195443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:53.402576923 CEST50195443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:53.402595043 CEST44350195178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:53.402664900 CEST44350195178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.534815073 CEST50197443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.534813881 CEST50196443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.534909964 CEST44350197178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.534910917 CEST44350196178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.535141945 CEST50197443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.535209894 CEST50196443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.535209894 CEST50196443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.535212040 CEST50197443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:55.535223961 CEST44350197178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.535254002 CEST44350196178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.535418034 CEST44350196178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:55.535480976 CEST44350197178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.666624069 CEST50198443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.666738033 CEST44350198178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.666821003 CEST50198443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.666904926 CEST50198443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.666927099 CEST44350198178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.667154074 CEST44350198178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.674436092 CEST50199443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.674499989 CEST44350199178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.674561024 CEST50199443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.674593925 CEST50199443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.674602032 CEST44350199178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.674734116 CEST44350199178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.675750971 CEST50200443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.675801992 CEST44350200178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.675858021 CEST50200443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.675887108 CEST50200443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:57.675894022 CEST44350200178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:57.676009893 CEST44350200178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:59.802351952 CEST50201443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:59.802423000 CEST44350201178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:59.802700996 CEST50201443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:59.802795887 CEST50201443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:58:59.802805901 CEST44350201178.156.131.83192.168.2.6
                    Oct 24, 2024 19:58:59.802963018 CEST44350201178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.021846056 CEST50202443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.021902084 CEST44350202178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.021981001 CEST50202443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.022022963 CEST50202443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.022028923 CEST44350202178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.022154093 CEST44350202178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.026154041 CEST50203443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.026209116 CEST44350203178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.026277065 CEST50203443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.026310921 CEST50203443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:02.026323080 CEST44350203178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:02.026344061 CEST44350203178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.096735954 CEST50204443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.096796036 CEST44350204178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.096875906 CEST50204443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.096905947 CEST50204443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.096915007 CEST44350204178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.097008944 CEST44350204178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.161035061 CEST50205443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.161077976 CEST44350205178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.161171913 CEST50205443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.161196947 CEST50205443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.161202908 CEST44350205178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.161283016 CEST44350205178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.162019014 CEST50206443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.162050009 CEST44350206178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.162110090 CEST50206443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.162146091 CEST50206443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:04.162157059 CEST44350206178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:04.162173033 CEST44350206178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:06.243262053 CEST50208443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:06.243324041 CEST44350208178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:06.243382931 CEST50208443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:06.243418932 CEST50208443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:06.243426085 CEST44350208178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:06.243530989 CEST44350208178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.440550089 CEST50209443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.440612078 CEST44350209178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.440707922 CEST50209443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.440748930 CEST50209443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.440757990 CEST44350209178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.440927029 CEST44350209178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.441977978 CEST50210443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.442018986 CEST44350210178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.442071915 CEST50210443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.442123890 CEST50210443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:08.442131042 CEST44350210178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:08.442182064 CEST44350210178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.534792900 CEST50211443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.534836054 CEST44350211178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.534913063 CEST50211443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.534954071 CEST50211443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.534961939 CEST44350211178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.535191059 CEST44350211178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581269979 CEST50213443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581329107 CEST44350213178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581351995 CEST50212443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581403971 CEST44350212178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581413984 CEST50213443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581456900 CEST50213443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581456900 CEST50212443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581464052 CEST44350213178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581513882 CEST50212443192.168.2.6178.156.131.83
                    Oct 24, 2024 19:59:10.581521988 CEST44350212178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581554890 CEST44350213178.156.131.83192.168.2.6
                    Oct 24, 2024 19:59:10.581604004 CEST44350212178.156.131.83192.168.2.6

                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:13:55:03
                    Start date:24/10/2024
                    Path:C:\Windows\System32\loaddll64.exe
                    Wow64 process (32bit):false
                    Commandline:loaddll64.exe "C:\Users\user\Desktop\dat5E54.dll.dll"
                    Imagebase:0x7ff7b7430000
                    File size:165'888 bytes
                    MD5 hash:763455F9DCB24DFEECC2B9D9F8D46D52
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:1
                    Start time:13:55:03
                    Start date:24/10/2024
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff66e660000
                    File size:862'208 bytes
                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:2
                    Start time:13:55:04
                    Start date:24/10/2024
                    Path:C:\Windows\System32\cmd.exe
                    Wow64 process (32bit):false
                    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1
                    Imagebase:0x7ff7f53b0000
                    File size:289'792 bytes
                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:3
                    Start time:13:55:04
                    Start date:24/10/2024
                    Path:C:\Windows\System32\rundll32.exe
                    Wow64 process (32bit):false
                    Commandline:rundll32.exe C:\Users\user\Desktop\dat5E54.dll.dll,go
                    Imagebase:0x7ff6f9a70000
                    File size:71'680 bytes
                    MD5 hash:EF3179D498793BF4234F708D3BE28633
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:4
                    Start time:13:55:04
                    Start date:24/10/2024
                    Path:C:\Windows\System32\rundll32.exe
                    Wow64 process (32bit):false
                    Commandline:rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",#1
                    Imagebase:0x7ff6f9a70000
                    File size:71'680 bytes
                    MD5 hash:EF3179D498793BF4234F708D3BE28633
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:6
                    Start time:13:55:05
                    Start date:24/10/2024
                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
                    Imagebase:0x7ff6e3d50000
                    File size:452'608 bytes
                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:7
                    Start time:13:55:05
                    Start date:24/10/2024
                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\0404016.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\3065065663.txt"
                    Imagebase:0x7ff6e3d50000
                    File size:452'608 bytes
                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:8
                    Start time:13:55:05
                    Start date:24/10/2024
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff66e660000
                    File size:862'208 bytes
                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:9
                    Start time:13:55:05
                    Start date:24/10/2024
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff66e660000
                    File size:862'208 bytes
                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:10
                    Start time:13:55:07
                    Start date:24/10/2024
                    Path:C:\Windows\System32\rundll32.exe
                    Wow64 process (32bit):false
                    Commandline:rundll32.exe "C:\Users\user\Desktop\dat5E54.dll.dll",go
                    Imagebase:0x7ff6f9a70000
                    File size:71'680 bytes
                    MD5 hash:EF3179D498793BF4234F708D3BE28633
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:11
                    Start time:13:55:09
                    Start date:24/10/2024
                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\user\AppData\Local\Temp\24255015403505.ps1" | Out-File -encoding UTF8 "C:\Users\user\AppData\Local\Temp\232462603231.txt"
                    Imagebase:0x7ff6e3d50000
                    File size:452'608 bytes
                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:12
                    Start time:13:55:09
                    Start date:24/10/2024
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff66e660000
                    File size:862'208 bytes
                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    Disassembly

                    Reset < >

                      Execution Graph

                      Execution Coverage:9.9%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:28.5%
                      Total number of Nodes:2000
                      Total number of Limit Nodes:11
                      execution_graph 55215 7ffda338afe6 55222 7ffda33b5270 55215->55222 55219 7ffda338b01b BuildCatchObjectHelperInternal 55238 7ffda33b4f10 55219->55238 55221 7ffda338b087 55226 7ffda33b5279 55222->55226 55224 7ffda338affa 55224->55219 55229 7ffda338b200 55224->55229 55226->55224 55247 7ffda33d16a0 55226->55247 55250 7ffda33e5ba0 EnterCriticalSection LeaveCriticalSection new 55226->55250 55251 7ffda33b6700 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task 55226->55251 55252 7ffda33ad6a0 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task std::bad_alloc::bad_alloc 55226->55252 55230 7ffda338b2b6 55229->55230 55231 7ffda338b211 55229->55231 55230->55219 55232 7ffda338b2cb 55231->55232 55233 7ffda338b21e 55231->55233 55271 7ffda338a150 5 API calls Concurrency::cancel_current_task 55232->55271 55235 7ffda33b5270 new 5 API calls 55233->55235 55237 7ffda338b22b 55235->55237 55236 7ffda338b2d0 55237->55219 55239 7ffda33b4f19 55238->55239 55240 7ffda33b4f24 55239->55240 55241 7ffda33b4f70 IsProcessorFeaturePresent 55239->55241 55240->55221 55242 7ffda33b4f88 55241->55242 55272 7ffda33b51b0 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 55242->55272 55244 7ffda33b4f9b 55273 7ffda33b4f30 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 55244->55273 55246 7ffda33b503d 55246->55221 55253 7ffda33c6700 55247->55253 55250->55226 55251->55226 55252->55226 55256 7ffda33c4c20 55253->55256 55255 7ffda33c672f 55255->55226 55260 7ffda33c4c3c _get_purecall_handler 55256->55260 55259 7ffda33c4c7a 55259->55255 55260->55259 55261 7ffda33c4cc0 55260->55261 55268 7ffda33e5ba0 EnterCriticalSection LeaveCriticalSection new 55260->55268 55269 7ffda33d1950 EnterCriticalSection 55261->55269 55263 7ffda33c4cea new[] 55264 7ffda33c4ea5 HeapAlloc 55263->55264 55267 7ffda33c4d84 new[] memcpy_s 55263->55267 55264->55267 55266 7ffda33c5103 55266->55260 55270 7ffda33d19e0 LeaveCriticalSection 55267->55270 55268->55260 55269->55263 55270->55266 55271->55236 55272->55244 55273->55246 55274 7ffda33c661c 55275 7ffda33c6624 type_info::_name_internal_method 55274->55275 55278 7ffda33d19e0 LeaveCriticalSection 55275->55278 55277 7ffda33c665d 55278->55277 55279 7ffda33c31e0 55280 7ffda33c31ff 55279->55280 55281 7ffda33c31f1 GetLastError ExitThread 55279->55281 55292 7ffda33eb460 55280->55292 55288 7ffda33c322e 55299 7ffda33a7740 55288->55299 55293 7ffda33eb469 55292->55293 55294 7ffda33c320e 55293->55294 55308 7ffda33d1a50 30 API calls BuildCatchObjectHelperInternal 55293->55308 55296 7ffda33eee50 55294->55296 55309 7ffda33eeac0 55296->55309 55298 7ffda33c321f 55298->55288 55307 7ffda33f0220 FreeLibrary GetProcAddress LoadLibraryExW GetLastError LoadLibraryExW 55298->55307 55314 7ffda339b8e0 55299->55314 55307->55288 55308->55294 55310 7ffda33eead4 _get_purecall_handler std::_Debug_message 55309->55310 55312 7ffda33eeadf std::_Debug_message 55310->55312 55313 7ffda33eed40 FreeLibrary GetProcAddress LoadLibraryExW GetLastError LoadLibraryExW 55310->55313 55312->55298 55313->55312 55780 7ffda33aeda0 55314->55780 55317 7ffda339b960 55783 7ffda33adaa0 55317->55783 55319 7ffda339b91e 55319->55317 55322 7ffda33adaa0 20 API calls 55319->55322 55321 7ffda33aedc0 _Mtx_unlock 66 API calls 55323 7ffda339b912 55321->55323 55322->55317 55324 7ffda33aeda0 __ExceptionPtrDestroy 15 API calls 55323->55324 55324->55319 56225 7ffda33ae8e0 55780->56225 55784 7ffda33adac2 55783->55784 56247 7ffda33ad7a0 55784->56247 56226 7ffda33ae916 GetCurrentThreadId 56225->56226 56227 7ffda33ae990 56225->56227 56228 7ffda33ae929 _Mtx_destroy_in_situ 56226->56228 56238 7ffda33ae96c 56226->56238 56229 7ffda33ae9f5 56227->56229 56230 7ffda33ae9a3 GetCurrentThreadId 56227->56230 56240 7ffda33ae95b GetCurrentThreadId 56228->56240 56231 7ffda33aea1f GetCurrentThreadId 56229->56231 56232 7ffda33aea8d 56229->56232 56235 7ffda33ae9b6 _Mtx_destroy_in_situ 56230->56235 56231->56235 56242 7ffda33aea97 _Mtx_destroy_in_situ 56232->56242 56244 7ffda33b4480 GetSystemTimeAsFileTime _Xtime_get_ticks 56232->56244 56233 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56234 7ffda339b8f0 56233->56234 56234->55317 56234->55319 56234->55321 56235->56238 56239 7ffda33aebdb GetCurrentThreadId 56235->56239 56237 7ffda33aead7 GetCurrentThreadId 56237->56235 56237->56242 56238->56233 56239->56238 56240->56238 56242->56235 56242->56237 56245 7ffda33b44d0 8 API calls _Xtime_diff_to_millis2 56242->56245 56246 7ffda33b4480 GetSystemTimeAsFileTime _Xtime_get_ticks 56242->56246 56244->56242 56245->56242 56246->56242 56248 7ffda33ad7da 56247->56248 56260 7ffda338b600 56248->56260 56261 7ffda33a4180 13 API calls 56260->56261 56262 7ffda338b647 56261->56262 56263 7ffda338b66b 56262->56263 56264 7ffda33a4bf0 20 API calls 56262->56264 56265 7ffda33a4bf0 20 API calls 56263->56265 56264->56263 56266 7ffda338b699 56265->56266 56267 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56266->56267 56268 7ffda338b6a3 collate 56267->56268 56269 7ffda33b5270 new 5 API calls 56268->56269 56270 7ffda338b6cf 56269->56270 56271 7ffda338b6e5 56270->56271 56272 7ffda338b6f3 56270->56272 56291 7ffda338a260 17 API calls 3 library calls 56271->56291 56273 7ffda338a1f0 collate 17 API calls 56272->56273 56275 7ffda338b6f1 56273->56275 56276 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56275->56276 56277 7ffda338b723 collate 56276->56277 56287 7ffda33b83b0 56277->56287 56279 7ffda338b766 56280 7ffda338a1f0 collate 17 API calls 56279->56280 56282 7ffda338b779 collate 56280->56282 56281 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56283 7ffda338b83a 56281->56283 56282->56281 56284 7ffda338abc0 56283->56284 56285 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56284->56285 56286 7ffda338abce 56285->56286 56288 7ffda33b83c9 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 56287->56288 56289 7ffda33d16a0 _heap_alloc 3 API calls 56288->56289 56290 7ffda33b8428 Concurrency::cancel_current_task _aligned_msize Concurrency::details::_Scheduler::_Scheduler type_info::_name_internal_method __crt_unique_heap_ptr 56288->56290 56289->56290 56290->56279 56291->56275 56376 7ffda33a1720 56884 7ffda338c700 56376->56884 56378 7ffda33a1741 56894 7ffda338c8b0 56378->56894 56380 7ffda33a1771 56906 7ffda338ca60 56380->56906 56383 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56384 7ffda33a1798 56383->56384 56918 7ffda338cb70 56384->56918 56388 7ffda33a17cb 56944 7ffda338cf00 56388->56944 56390 7ffda33a182a 56391 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56390->56391 56392 7ffda33a185a collate 56391->56392 56956 7ffda338e0b0 56392->56956 56394 7ffda33a189a 56395 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56394->56395 56396 7ffda33a18ca collate 56395->56396 56397 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56396->56397 56398 7ffda33a190a 56397->56398 56968 7ffda338d0c0 56398->56968 56400 7ffda33a1913 56401 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56400->56401 56402 7ffda33a191c 56401->56402 56974 7ffda338d1c0 56402->56974 56405 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56406 7ffda33a1941 56405->56406 56984 7ffda338d2f0 56406->56984 56408 7ffda33a1959 56409 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56408->56409 56410 7ffda33a196b 56409->56410 56992 7ffda338d3d0 56410->56992 56412 7ffda33a1974 56413 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56412->56413 56414 7ffda33a197d 56413->56414 56996 7ffda338d470 56414->56996 56417 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56418 7ffda33a198f 56417->56418 57004 7ffda338d560 56418->57004 56420 7ffda33a1994 57010 7ffda338d6c0 56420->57010 56423 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56424 7ffda33a19b9 56423->56424 57018 7ffda338d7b0 56424->57018 56428 7ffda33a19c3 57030 7ffda338d9b0 56428->57030 56432 7ffda33a19e4 56433 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56432->56433 56434 7ffda33a19ed 56433->56434 57042 7ffda338de60 56434->57042 56438 7ffda33a1a0a 57054 7ffda338df60 56438->57054 56440 7ffda33a1a13 56441 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56440->56441 56442 7ffda33a1a1c 56441->56442 56443 7ffda338e0b0 17 API calls 56442->56443 56444 7ffda33a1a34 56443->56444 57058 7ffda338e2a0 56444->57058 56446 7ffda33a1a39 57065 7ffda338e320 56446->57065 56449 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56450 7ffda33a1a5e 56449->56450 57079 7ffda338e470 56450->57079 56452 7ffda33a1a76 57093 7ffda338e5c0 56452->57093 56454 7ffda33a1a8e 57096 7ffda338e5f0 56454->57096 56456 7ffda33a1a97 56457 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56456->56457 56458 7ffda33a1aa0 56457->56458 57100 7ffda338e740 56458->57100 56460 7ffda33a1aa9 56461 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56460->56461 56462 7ffda33a1ab2 56461->56462 57104 7ffda338e7e0 56462->57104 56464 7ffda33a1af8 56465 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56464->56465 56466 7ffda33a1b0a 56465->56466 57118 7ffda338e940 56466->57118 56468 7ffda33a1b0f 57122 7ffda338e9a0 56468->57122 56470 7ffda33a1b27 57140 7ffda338ebb0 56470->57140 56472 7ffda33a1b3f 57148 7ffda338ec50 56472->57148 56474 7ffda33a1b57 57155 7ffda338ecb0 56474->57155 56476 7ffda33a1b6f 57163 7ffda338efc0 56476->57163 56480 7ffda33a1b8c 57179 7ffda338f1e0 56480->57179 56482 7ffda33a1ba4 57182 7ffda338f210 56482->57182 56484 7ffda33a1ba9 57188 7ffda338f2d0 56484->57188 56486 7ffda33a1bae 57193 7ffda338f310 56486->57193 56489 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56490 7ffda33a1bc0 56489->56490 57201 7ffda338f3c0 56490->57201 56492 7ffda33a1c04 57215 7ffda338f590 56492->57215 56494 7ffda33a1c1c 57229 7ffda338f840 56494->57229 56496 7ffda33a1c34 57237 7ffda338f8e0 56496->57237 56500 7ffda33a1c51 57255 7ffda338fb90 56500->57255 56504 7ffda33a1c6e 57269 7ffda338fe20 56504->57269 56506 7ffda33a1c73 57275 7ffda3390000 56506->57275 56508 7ffda33a1c7c 56509 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56508->56509 56510 7ffda33a1c85 56509->56510 57279 7ffda33900a0 56510->57279 56512 7ffda33a1c8e 56513 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56512->56513 56514 7ffda33a1c97 56513->56514 57287 7ffda33901d0 56514->57287 56516 7ffda33a1c9c 56517 7ffda338f1e0 17 API calls 56516->56517 56518 7ffda33a1cb4 56517->56518 57297 7ffda3390440 56518->57297 56522 7ffda33a1cd5 56523 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56522->56523 56524 7ffda33a1cde 56523->56524 57317 7ffda33906d0 56524->57317 56527 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56528 7ffda33a1cf0 56527->56528 57321 7ffda33907b0 56528->57321 56530 7ffda33a1d08 57332 7ffda33908c0 56530->57332 56532 7ffda33a1d36 57342 7ffda3390990 56532->57342 56534 7ffda33a1d4e 57345 7ffda33909c0 56534->57345 56536 7ffda33a1d66 56537 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56536->56537 56538 7ffda33a1d78 56537->56538 57357 7ffda3390b40 56538->57357 56540 7ffda33a1d90 57360 7ffda3390b70 56540->57360 56542 7ffda33a1d99 56543 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56542->56543 56544 7ffda33a1da2 56543->56544 57364 7ffda3390c10 56544->57364 56546 7ffda33a1da7 57369 7ffda3390c50 56546->57369 56548 7ffda33a1dac 57375 7ffda3391000 56548->57375 56550 7ffda33a1db1 57379 7ffda3391060 56550->57379 56554 7ffda33a1dd2 56555 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56554->56555 56556 7ffda33a1ddb 56555->56556 57397 7ffda3391350 56556->57397 56558 7ffda33a1df3 57409 7ffda3391530 56558->57409 56561 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56562 7ffda33a1e18 56561->56562 57417 7ffda33918b0 56562->57417 56564 7ffda33a1e30 57420 7ffda3391ac0 56564->57420 56566 7ffda33a1e35 57426 7ffda3391c30 56566->57426 56568 7ffda33a1e3a 56569 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56568->56569 56570 7ffda33a1e4c 56569->56570 57432 7ffda3391dd0 56570->57432 56572 7ffda33a1e64 56573 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56572->56573 56574 7ffda33a1e76 56573->56574 57435 7ffda3391e40 56574->57435 56577 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56578 7ffda33a1ec7 56577->56578 57449 7ffda33923d0 56578->57449 56580 7ffda33a1ecc 57453 7ffda33924e0 56580->57453 56584 7ffda33a1eff 57469 7ffda3392920 56584->57469 56588 7ffda33a1f32 56589 7ffda338f1e0 17 API calls 56588->56589 56590 7ffda33a1f4a 56589->56590 57487 7ffda3392b80 56590->57487 56592 7ffda33a1f78 57492 7ffda3392be0 56592->57492 56594 7ffda33a1fa6 57506 7ffda3392d10 56594->57506 56596 7ffda33a1fbe 57516 7ffda3392eb0 56596->57516 56599 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56600 7ffda33a1fe3 56599->56600 57524 7ffda3392f90 56600->57524 56603 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56604 7ffda33a2008 56603->56604 57534 7ffda33930e0 56604->57534 56606 7ffda33a2020 57546 7ffda3393340 56606->57546 56608 7ffda33a2038 57554 7ffda3393490 56608->57554 56610 7ffda33a2050 57557 7ffda33934c0 56610->57557 56612 7ffda33a207e 56613 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56612->56613 56614 7ffda33a2090 56613->56614 57569 7ffda3393910 56614->57569 56616 7ffda33a20a8 57572 7ffda3393b80 56616->57572 56618 7ffda33a20b1 56619 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56618->56619 56620 7ffda33a20ba 56619->56620 57576 7ffda3393cd0 56620->57576 56622 7ffda33a20bf 57584 7ffda3393e90 56622->57584 56624 7ffda33a20c4 57590 7ffda3394000 56624->57590 56626 7ffda33a20c9 57598 7ffda33940f0 56626->57598 56628 7ffda33a20f7 56629 7ffda338f1e0 17 API calls 56628->56629 56630 7ffda33a210f 56629->56630 57603 7ffda3394150 56630->57603 56633 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56634 7ffda33a2134 56633->56634 56635 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56634->56635 56636 7ffda33a2146 56635->56636 56637 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56636->56637 56638 7ffda33a2158 56637->56638 56639 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56638->56639 56640 7ffda33a216a 56639->56640 57609 7ffda33942a0 56640->57609 56642 7ffda33a2182 57612 7ffda33942d0 56642->57612 56644 7ffda33a219a 57615 7ffda3394300 56644->57615 56646 7ffda33a21b2 57618 7ffda3394330 56646->57618 56648 7ffda33a21e0 57623 7ffda3394390 56648->57623 56650 7ffda33a220e 56651 7ffda3390b40 17 API calls 56650->56651 56652 7ffda33a2226 56651->56652 57628 7ffda33943f0 56652->57628 56655 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56656 7ffda33a2263 56655->56656 57636 7ffda33944a0 56656->57636 56659 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56660 7ffda33a229e 56659->56660 56661 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56660->56661 56662 7ffda33a22b0 56661->56662 56663 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56662->56663 56664 7ffda33a22c2 56663->56664 57644 7ffda33945d0 56664->57644 56666 7ffda33a22da 57647 7ffda3394600 56666->57647 56668 7ffda33a231e 56669 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56668->56669 56670 7ffda33a2330 56669->56670 57654 7ffda33946b0 56670->57654 56673 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56674 7ffda33a2355 56673->56674 57660 7ffda3394740 56674->57660 56676 7ffda33a2383 56677 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56676->56677 56678 7ffda33a2395 56677->56678 57665 7ffda33947e0 56678->57665 56680 7ffda33a23c5 56681 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56680->56681 56682 7ffda33a23d7 56681->56682 56683 7ffda3390b40 17 API calls 56682->56683 56684 7ffda33a23ef 56683->56684 57670 7ffda3394880 56684->57670 56686 7ffda33a241d 57675 7ffda33948e0 56686->57675 56688 7ffda33a2435 57678 7ffda3394910 56688->57678 56690 7ffda33a2463 57683 7ffda3394970 56690->57683 56692 7ffda33a2491 56693 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56692->56693 56694 7ffda33a24a3 56693->56694 57688 7ffda3394a10 56694->57688 56696 7ffda33a24d1 57693 7ffda3394a70 56696->57693 56698 7ffda33a24e9 56699 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56698->56699 56700 7ffda33a24fb 56699->56700 57696 7ffda3394ae0 56700->57696 56703 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56704 7ffda33a2520 56703->56704 57702 7ffda3394b70 56704->57702 56706 7ffda33a2538 57705 7ffda3394ba0 56706->57705 56708 7ffda33a2550 57708 7ffda3394bd0 56708->57708 56710 7ffda33a2568 57711 7ffda3394c00 56710->57711 56712 7ffda33a2580 57714 7ffda3394c30 56712->57714 56714 7ffda33a2598 56715 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56714->56715 56716 7ffda33a25aa 56715->56716 57717 7ffda3394ca0 56716->57717 56718 7ffda33a25c2 57720 7ffda3394cd0 56718->57720 56720 7ffda33a25da 57723 7ffda3394d10 56720->57723 56722 7ffda33a25f2 57726 7ffda3394d40 56722->57726 56724 7ffda33a260a 57729 7ffda3394d70 56724->57729 56726 7ffda33a2638 57734 7ffda3394dd0 56726->57734 56728 7ffda33a2650 57737 7ffda3394e00 56728->57737 56730 7ffda33a2668 57740 7ffda3394e30 56730->57740 56733 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56734 7ffda33a268d 56733->56734 56735 7ffda338f1e0 17 API calls 56734->56735 56736 7ffda33a26a5 56735->56736 57746 7ffda3394ec0 56736->57746 56738 7ffda33a26d3 57751 7ffda3394f20 56738->57751 56740 7ffda33a26eb 56741 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56740->56741 56742 7ffda33a26fd 56741->56742 56743 7ffda3390b40 17 API calls 56742->56743 56744 7ffda33a2715 56743->56744 56745 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56744->56745 56746 7ffda33a2727 56745->56746 57754 7ffda3394fe0 56746->57754 56748 7ffda33a273f 57757 7ffda3395010 56748->57757 56750 7ffda33a2757 57760 7ffda3395040 56750->57760 56752 7ffda33a276f 57763 7ffda3395070 56752->57763 56754 7ffda33a2787 57766 7ffda33950b0 56754->57766 56756 7ffda33a279f 57769 7ffda33950e0 56756->57769 56758 7ffda33a27b7 57772 7ffda3395110 56758->57772 56761 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56762 7ffda33a27dc 56761->56762 57778 7ffda33951a0 56762->57778 56764 7ffda33a27f4 57781 7ffda33951d0 56764->57781 56766 7ffda33a2822 57786 7ffda3395230 56766->57786 56769 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56770 7ffda33a2849 56769->56770 56771 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56770->56771 56772 7ffda33a285b 56771->56772 57792 7ffda3395300 56772->57792 56774 7ffda33a2873 56775 7ffda3390b40 17 API calls 56774->56775 56776 7ffda33a288b 56775->56776 57795 7ffda3395340 56776->57795 56778 7ffda33a28b9 57800 7ffda33953a0 56778->57800 56780 7ffda33a28e7 57805 7ffda3395400 56780->57805 56783 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56784 7ffda33a290c 56783->56784 57811 7ffda3395490 56784->57811 56786 7ffda33a2950 56787 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56786->56787 56788 7ffda33a2962 56787->56788 57818 7ffda3395540 56788->57818 56791 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56792 7ffda33a2987 56791->56792 56793 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56792->56793 56794 7ffda33a2999 56793->56794 57824 7ffda3395610 56794->57824 56796 7ffda33a29c7 57829 7ffda3395670 56796->57829 56798 7ffda33a29df 57832 7ffda33956a0 56798->57832 56800 7ffda33a2a0d 56801 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56800->56801 56802 7ffda33a2a1f 56801->56802 56803 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56802->56803 56804 7ffda33a2a31 56803->56804 56805 7ffda3394300 17 API calls 56804->56805 56806 7ffda33a2a49 56805->56806 56807 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56806->56807 56808 7ffda33a2a5b 56807->56808 57837 7ffda33957c0 56808->57837 56810 7ffda33a2a73 56811 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56810->56811 56812 7ffda33a2a85 56811->56812 57840 7ffda3395830 56812->57840 56815 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56816 7ffda33a2aaa 56815->56816 56817 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56816->56817 56818 7ffda33a2abc 56817->56818 57846 7ffda3395900 56818->57846 56820 7ffda33a2aea 56821 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56820->56821 56822 7ffda33a2afc 56821->56822 57851 7ffda33959a0 56822->57851 56824 7ffda33a2b14 57854 7ffda33959d0 56824->57854 56827 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56828 7ffda33a2b39 56827->56828 57860 7ffda3395a60 56828->57860 56831 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56832 7ffda33a2b8c 56831->56832 57870 7ffda3395b30 56832->57870 56834 7ffda33a2bba 56835 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56834->56835 56836 7ffda33a2bcc 56835->56836 56837 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56836->56837 56838 7ffda33a2bde 56837->56838 57875 7ffda3395c10 56838->57875 56840 7ffda33a2c0c 56841 7ffda3391dd0 17 API calls 56840->56841 56842 7ffda33a2c24 56841->56842 57880 7ffda3395c70 56842->57880 56844 7ffda33a2c3c 57883 7ffda3395ca0 56844->57883 56846 7ffda33a2c54 56847 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56846->56847 56848 7ffda33a2c66 56847->56848 57886 7ffda3395d10 56848->57886 56851 7ffda338abc0 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56852 7ffda33a2ca1 56851->56852 57894 7ffda3395dc0 56852->57894 56854 7ffda33a2cb9 56855 7ffda3394d70 17 API calls 56854->56855 56856 7ffda33a2ce7 56855->56856 57897 7ffda3395e00 56856->57897 56858 7ffda33a2cff 56859 7ffda33d16a0 _heap_alloc 3 API calls 56858->56859 56860 7ffda33a2d09 __std_exception_destroy memcpy_s 56859->56860 56883 7ffda33a2e40 56860->56883 57900 7ffda33a1120 56860->57900 56885 7ffda338c74c 56884->56885 56886 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56885->56886 56887 7ffda338c7b2 collate 56886->56887 56888 7ffda3392650 17 API calls 56887->56888 56889 7ffda338c7c7 56888->56889 56890 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56889->56890 56891 7ffda338c7d1 collate 56890->56891 56892 7ffda338a1f0 collate 17 API calls 56891->56892 56893 7ffda338c7eb collate 56892->56893 56893->56378 56895 7ffda338c912 56894->56895 58250 7ffda338ed60 56895->58250 56897 7ffda338c91c 56898 7ffda338a1f0 collate 17 API calls 56897->56898 56900 7ffda338c951 collate 56898->56900 56899 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56901 7ffda338ca04 collate 56899->56901 56900->56899 56902 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56901->56902 56903 7ffda338ca1d collate 56902->56903 56904 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56903->56904 56905 7ffda338ca3f 56904->56905 56905->56380 56907 7ffda338cabb 56906->56907 56908 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56907->56908 56909 7ffda338caf9 collate 56908->56909 56910 7ffda338f310 17 API calls 56909->56910 56911 7ffda338cb15 56910->56911 56912 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56911->56912 56913 7ffda338cb1f collate 56912->56913 56914 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56913->56914 56915 7ffda338cb3a collate 56914->56915 56916 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56915->56916 56917 7ffda338cb58 56916->56917 56917->56383 56919 7ffda338cbce 56918->56919 56920 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56919->56920 56921 7ffda338cc09 collate 56920->56921 56922 7ffda338a1f0 collate 17 API calls 56921->56922 56925 7ffda338cc23 collate 56922->56925 56923 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56924 7ffda338ccd0 collate 56923->56924 56926 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56924->56926 56925->56923 56927 7ffda338cce9 collate 56926->56927 56928 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56927->56928 56929 7ffda338cd0d 56928->56929 56930 7ffda338cd30 56929->56930 56931 7ffda338cd6a 56930->56931 56932 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56931->56932 56933 7ffda338cda2 collate 56932->56933 56934 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56933->56934 56935 7ffda338ce45 collate 56934->56935 56936 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56935->56936 56937 7ffda338ce5e collate 56936->56937 56938 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56937->56938 56939 7ffda338ce77 collate 56938->56939 56940 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56939->56940 56941 7ffda338ce91 collate 56940->56941 56942 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56941->56942 56943 7ffda338ced1 collate 56942->56943 56943->56388 56945 7ffda338cf5e 56944->56945 56946 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56945->56946 56947 7ffda338cf97 collate 56946->56947 56948 7ffda338a1f0 collate 17 API calls 56947->56948 56950 7ffda338cfb1 collate 56948->56950 56949 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56951 7ffda338d05e collate 56949->56951 56950->56949 56952 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56951->56952 56953 7ffda338d077 collate 56952->56953 56954 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56953->56954 56955 7ffda338d09b 56954->56955 56955->56390 56957 7ffda338e111 56956->56957 56958 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56957->56958 56959 7ffda338e179 collate 56958->56959 56960 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56959->56960 56961 7ffda338e194 collate 56960->56961 56962 7ffda338a1f0 collate 17 API calls 56961->56962 56965 7ffda338e1ae collate 56962->56965 56963 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56964 7ffda338e25b collate 56963->56964 56966 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56964->56966 56965->56963 56967 7ffda338e27f 56966->56967 56967->56394 56969 7ffda338d0fd 56968->56969 56970 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56969->56970 56971 7ffda338d176 collate 56970->56971 56972 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56971->56972 56973 7ffda338d192 collate 56972->56973 56973->56400 56975 7ffda338d216 56974->56975 56976 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56975->56976 56977 7ffda338d254 collate 56976->56977 56978 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56977->56978 56979 7ffda338d29c collate 56978->56979 56980 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56979->56980 56981 7ffda338d2b7 collate 56980->56981 56982 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56981->56982 56983 7ffda338d2d5 56982->56983 56983->56405 56985 7ffda338d33f 56984->56985 56986 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56985->56986 56987 7ffda338d349 collate 56986->56987 56988 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56987->56988 56989 7ffda338d364 collate 56988->56989 56990 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 56989->56990 56991 7ffda338d381 56990->56991 56991->56408 56993 7ffda338d40a 56992->56993 56994 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56993->56994 56995 7ffda338d448 collate 56994->56995 56995->56412 56997 7ffda338d4ac 56996->56997 56998 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56997->56998 56999 7ffda338d4ea collate 56998->56999 57000 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 56999->57000 57001 7ffda338d532 collate 57000->57001 57002 7ffda33929f0 17 API calls 57001->57002 57003 7ffda338d549 57002->57003 57003->56417 57005 7ffda338d598 57004->57005 57006 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57005->57006 57007 7ffda338d5a2 collate 57006->57007 57008 7ffda338a1f0 collate 17 API calls 57007->57008 57009 7ffda338d5e9 collate 57008->57009 57009->56420 57011 7ffda338d716 57010->57011 57012 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57011->57012 57013 7ffda338d756 collate 57012->57013 57014 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57013->57014 57015 7ffda338d771 collate 57014->57015 57016 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57015->57016 57017 7ffda338d78f 57016->57017 57017->56423 57019 7ffda338d7f0 57018->57019 58276 7ffda3390dc0 57019->58276 57022 7ffda338d840 57023 7ffda338d880 57022->57023 57024 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57023->57024 57025 7ffda338d88a collate 57024->57025 58292 7ffda338db00 57025->58292 57028 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57029 7ffda338d98b collate 57028->57029 57029->56428 57031 7ffda338da08 57030->57031 57032 7ffda338a1f0 collate 17 API calls 57031->57032 57034 7ffda338da12 collate 57032->57034 57033 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57035 7ffda338dac5 collate 57033->57035 57034->57033 57036 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57035->57036 57037 7ffda338dae7 57036->57037 57038 7ffda338dd10 57037->57038 57039 7ffda338dd56 57038->57039 57040 7ffda338a1f0 collate 17 API calls 57039->57040 57041 7ffda338dd9b collate 57040->57041 57041->56432 57043 7ffda338deaf 57042->57043 57044 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57043->57044 57045 7ffda338deb9 collate 57044->57045 57046 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57045->57046 57047 7ffda338ded4 collate 57046->57047 57048 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57047->57048 57049 7ffda338def4 57048->57049 57050 7ffda338df00 57049->57050 57051 7ffda338df34 57050->57051 57052 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57051->57052 57053 7ffda338df3e collate 57052->57053 57053->56438 57055 7ffda338dfa4 57054->57055 57056 7ffda338a1f0 collate 17 API calls 57055->57056 57057 7ffda338dfe9 collate 57056->57057 57057->56440 57059 7ffda33906d0 17 API calls 57058->57059 57060 7ffda338e2b0 57059->57060 57061 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57060->57061 57062 7ffda338e2ba collate 57061->57062 57063 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57062->57063 57064 7ffda338e304 collate 57063->57064 57064->56446 57066 7ffda338e377 57065->57066 58310 7ffda3392700 57066->58310 57068 7ffda338e387 57069 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57068->57069 57070 7ffda338e390 collate 57069->57070 57071 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57070->57071 57072 7ffda338e401 collate 57071->57072 57073 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57072->57073 57074 7ffda338e41a collate 57073->57074 57075 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57074->57075 57076 7ffda338e433 collate 57075->57076 57077 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57076->57077 57078 7ffda338e450 57077->57078 57078->56449 57080 7ffda338e4c5 57079->57080 57081 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57080->57081 57082 7ffda338e52e collate 57081->57082 57083 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57082->57083 57084 7ffda338e547 collate 57083->57084 57085 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57084->57085 57086 7ffda338e561 collate 57085->57086 57087 7ffda33923d0 17 API calls 57086->57087 57088 7ffda338e576 57087->57088 57089 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57088->57089 57090 7ffda338e57f collate 57089->57090 57091 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57090->57091 57092 7ffda338e59e 57091->57092 57092->56452 57094 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57093->57094 57095 7ffda338e5ce collate 57094->57095 57095->56454 57097 7ffda338e634 57096->57097 57098 7ffda338a1f0 collate 17 API calls 57097->57098 57099 7ffda338e679 collate 57098->57099 57099->56456 57101 7ffda338e77a 57100->57101 57102 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57101->57102 57103 7ffda338e7b8 collate 57102->57103 57103->56460 57105 7ffda338e843 57104->57105 57106 7ffda338ebb0 17 API calls 57105->57106 57107 7ffda338e84d 57106->57107 57108 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57107->57108 57109 7ffda338e883 collate 57108->57109 57110 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57109->57110 57111 7ffda338e89e collate 57110->57111 57112 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57111->57112 57113 7ffda338e8b5 collate 57112->57113 57114 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57113->57114 57115 7ffda338e8cc collate 57114->57115 57116 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57115->57116 57117 7ffda338e8e9 57116->57117 57117->56464 57119 7ffda338e974 57118->57119 57120 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57119->57120 57121 7ffda338e97e collate 57120->57121 57121->56468 57123 7ffda338e9f7 57122->57123 57124 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57123->57124 57125 7ffda338ea00 collate 57124->57125 57126 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57125->57126 57127 7ffda338eaa0 collate 57126->57127 57128 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57127->57128 57129 7ffda338eab9 collate 57128->57129 57130 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57129->57130 57131 7ffda338eb2a collate 57130->57131 57132 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57131->57132 57133 7ffda338eb43 collate 57132->57133 57134 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57133->57134 57135 7ffda338eb5d collate 57134->57135 57136 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57135->57136 57137 7ffda338eb76 collate 57136->57137 57138 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57137->57138 57139 7ffda338eb92 57138->57139 57139->56470 57141 7ffda338ebff 57140->57141 57142 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57141->57142 57143 7ffda338ec09 collate 57142->57143 57144 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57143->57144 57145 7ffda338ec24 collate 57144->57145 57146 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57145->57146 57147 7ffda338ec41 57146->57147 57147->56472 57149 7ffda338fc40 17 API calls 57148->57149 57150 7ffda338ec72 57149->57150 57151 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57150->57151 57152 7ffda338ec7b collate 57151->57152 57153 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57152->57153 57154 7ffda338eca1 57153->57154 57154->56474 57156 7ffda338ed01 57155->57156 57157 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57156->57157 57158 7ffda338ed0b collate 57157->57158 57159 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57158->57159 57160 7ffda338ed26 collate 57159->57160 57161 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57160->57161 57162 7ffda338ed49 57161->57162 57162->56476 57164 7ffda338f014 57163->57164 57165 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57164->57165 57166 7ffda338f01e collate 57165->57166 57167 7ffda338a1f0 collate 17 API calls 57166->57167 57168 7ffda338f065 collate 57167->57168 57169 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57168->57169 57170 7ffda338f118 collate 57169->57170 57171 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57170->57171 57172 7ffda338f137 57171->57172 57173 7ffda338f150 57172->57173 57174 7ffda338f184 57173->57174 57175 7ffda33907b0 17 API calls 57174->57175 57176 7ffda338f18e 57175->57176 57177 7ffda33909c0 17 API calls 57176->57177 57178 7ffda338f1c4 57177->57178 57178->56480 57180 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57179->57180 57181 7ffda338f1ee collate 57180->57181 57181->56482 57183 7ffda338f252 57182->57183 57184 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57183->57184 57185 7ffda338f28a collate 57184->57185 57186 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57185->57186 57187 7ffda338f2a6 collate 57186->57187 57187->56484 58320 7ffda33916c0 57188->58320 57190 7ffda338f2de 57191 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57190->57191 57192 7ffda338f2e8 collate 57191->57192 57192->56486 57194 7ffda338f34a 57193->57194 57195 7ffda3393b80 17 API calls 57194->57195 57196 7ffda338f35c 57195->57196 57197 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57196->57197 57198 7ffda338f366 collate 57197->57198 57199 7ffda3391060 17 API calls 57198->57199 57200 7ffda338f3ae 57199->57200 57200->56489 57202 7ffda338f425 57201->57202 57203 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57202->57203 57204 7ffda338f45f collate 57203->57204 57205 7ffda338a1f0 collate 17 API calls 57204->57205 57208 7ffda338f47a collate 57205->57208 57206 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57207 7ffda338f527 collate 57206->57207 57209 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57207->57209 57208->57206 57210 7ffda338f540 collate 57209->57210 57211 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57210->57211 57212 7ffda338f559 collate 57211->57212 57213 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57212->57213 57214 7ffda338f57a 57213->57214 57214->56492 57216 7ffda338f5ed 57215->57216 57217 7ffda338a1f0 collate 17 API calls 57216->57217 57218 7ffda338f5f6 collate 57217->57218 57219 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57218->57219 57220 7ffda338f6cc collate 57219->57220 57221 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57220->57221 57222 7ffda338f742 collate 57221->57222 57223 7ffda338a1f0 collate 17 API calls 57222->57223 57224 7ffda338f75d collate 57223->57224 57225 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57224->57225 57226 7ffda338f7fc collate 57225->57226 57227 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57226->57227 57228 7ffda338f820 57227->57228 57228->56494 57230 7ffda338f88f 57229->57230 57231 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57230->57231 57232 7ffda338f899 collate 57231->57232 57233 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57232->57233 57234 7ffda338f8b4 collate 57233->57234 57235 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57234->57235 57236 7ffda338f8d4 57235->57236 57236->56496 57238 7ffda338f93c 57237->57238 57239 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57238->57239 57240 7ffda338f974 collate 57239->57240 57241 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57240->57241 57242 7ffda338f990 collate 57241->57242 57243 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57242->57243 57244 7ffda338f9ab collate 57243->57244 57245 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57244->57245 57246 7ffda338f9d1 57245->57246 57247 7ffda338f9f0 57246->57247 57248 7ffda338fa31 57247->57248 57249 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57248->57249 57250 7ffda338fa3a collate 57249->57250 57251 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57250->57251 57252 7ffda338faac collate 57251->57252 57253 7ffda338a1f0 collate 17 API calls 57252->57253 57254 7ffda338fac5 collate 57253->57254 57254->56500 57256 7ffda338fbdf 57255->57256 57257 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57256->57257 57258 7ffda338fbe9 collate 57257->57258 57259 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57258->57259 57260 7ffda338fc04 collate 57259->57260 57261 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57260->57261 57262 7ffda338fc27 57261->57262 57263 7ffda338fc40 57262->57263 57264 7ffda338fc7f 57263->57264 57265 7ffda338a1f0 collate 17 API calls 57264->57265 57266 7ffda338fc89 collate 57265->57266 57267 7ffda338a1f0 collate 17 API calls 57266->57267 57268 7ffda338fd6a collate 57267->57268 57268->56504 57270 7ffda338fe5f 57269->57270 57271 7ffda338a1f0 collate 17 API calls 57270->57271 57272 7ffda338fe69 collate 57271->57272 57273 7ffda338a1f0 collate 17 API calls 57272->57273 57274 7ffda338ff4a collate 57273->57274 57274->56506 57276 7ffda339003a 57275->57276 57277 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57276->57277 57278 7ffda3390078 collate 57277->57278 57278->56508 57280 7ffda33900e5 57279->57280 57281 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57280->57281 57282 7ffda339014d collate 57281->57282 57283 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57282->57283 57284 7ffda3390166 collate 57283->57284 57285 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57284->57285 57286 7ffda33901a6 collate 57285->57286 57286->56512 57288 7ffda3390217 57287->57288 57289 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57288->57289 57290 7ffda3390220 collate 57289->57290 57291 7ffda338a1f0 collate 17 API calls 57290->57291 57292 7ffda3390262 collate 57291->57292 57293 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57292->57293 57294 7ffda339036a collate 57293->57294 57295 7ffda338a1f0 collate 17 API calls 57294->57295 57296 7ffda3390385 collate 57295->57296 57296->56516 57298 7ffda339049d 57297->57298 57299 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57298->57299 57300 7ffda33904cf collate 57299->57300 57301 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57300->57301 57302 7ffda33904e8 collate 57301->57302 57303 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57302->57303 57304 7ffda339055b collate 57303->57304 57305 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57304->57305 57306 7ffda3390574 collate 57305->57306 57307 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57306->57307 57308 7ffda339058d collate 57307->57308 57309 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57308->57309 57310 7ffda33905ac 57309->57310 57311 7ffda33905d0 57310->57311 57312 7ffda339060d 57311->57312 57313 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57312->57313 57314 7ffda3390686 collate 57313->57314 57315 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57314->57315 57316 7ffda33906a2 collate 57315->57316 57316->56522 57318 7ffda339070d 57317->57318 57319 7ffda3392be0 17 API calls 57318->57319 57320 7ffda339078d 57319->57320 57320->56527 58340 7ffda33921f0 57321->58340 57323 7ffda33907e4 57324 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57323->57324 57325 7ffda33907ee collate 57324->57325 57326 7ffda33924e0 17 API calls 57325->57326 57327 7ffda3390877 57326->57327 57328 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57327->57328 57329 7ffda3390880 collate 57328->57329 57330 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57329->57330 57331 7ffda33908a3 57330->57331 57331->56530 57333 7ffda3390917 57332->57333 57334 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57333->57334 57335 7ffda3390921 collate 57334->57335 57336 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57335->57336 57337 7ffda339093c collate 57336->57337 57338 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57337->57338 57339 7ffda3390953 collate 57338->57339 57340 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57339->57340 57341 7ffda3390970 57340->57341 57341->56532 57343 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57342->57343 57344 7ffda339099e collate 57343->57344 57344->56534 57346 7ffda3390a15 57345->57346 57347 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57346->57347 57348 7ffda3390a1e collate 57347->57348 57349 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57348->57349 57350 7ffda3390a8d collate 57349->57350 57351 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57350->57351 57352 7ffda3390aa7 collate 57351->57352 57353 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57352->57353 57354 7ffda3390ac0 collate 57353->57354 57355 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57354->57355 57356 7ffda3390ae2 57355->57356 57356->56536 57358 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57357->57358 57359 7ffda3390b51 collate 57358->57359 57359->56540 57361 7ffda3390baa 57360->57361 57362 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57361->57362 57363 7ffda3390bea collate 57362->57363 57363->56542 57365 7ffda33921f0 17 API calls 57364->57365 57366 7ffda3390c1e 57365->57366 57367 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57366->57367 57368 7ffda3390c28 collate 57367->57368 57368->56546 57370 7ffda3390c87 57369->57370 57371 7ffda338a1f0 collate 17 API calls 57370->57371 57372 7ffda3390c91 collate 57371->57372 57373 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57372->57373 57374 7ffda3390d87 collate 57373->57374 57374->56548 57376 7ffda3391034 57375->57376 57377 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57376->57377 57378 7ffda339103e collate 57377->57378 57378->56550 57380 7ffda33910bc 57379->57380 57381 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57380->57381 57382 7ffda33910f4 collate 57381->57382 57383 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57382->57383 57384 7ffda3391110 collate 57383->57384 57385 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57384->57385 57386 7ffda339112b collate 57385->57386 57387 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57386->57387 57388 7ffda3391151 57387->57388 57389 7ffda3391170 57388->57389 57390 7ffda33911ba 57389->57390 57391 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57390->57391 57392 7ffda3391224 collate 57391->57392 57393 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57392->57393 57394 7ffda339123e collate 57393->57394 57395 7ffda338a1f0 collate 17 API calls 57394->57395 57396 7ffda3391286 collate 57395->57396 57396->56554 57398 7ffda33913a9 57397->57398 57399 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57398->57399 57400 7ffda33913e2 collate 57399->57400 57401 7ffda338a1f0 collate 17 API calls 57400->57401 57402 7ffda33913fc collate 57401->57402 57403 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57402->57403 57404 7ffda33914d2 collate 57403->57404 57405 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57404->57405 57406 7ffda33914ed collate 57405->57406 57407 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57406->57407 57408 7ffda339150e 57407->57408 57408->56558 57410 7ffda339158c 57409->57410 57411 7ffda338a1f0 collate 17 API calls 57410->57411 57412 7ffda33915d1 collate 57411->57412 57413 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57412->57413 57414 7ffda3391684 collate 57413->57414 57415 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57414->57415 57416 7ffda33916a4 57415->57416 57416->56561 57418 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57417->57418 57419 7ffda33918be collate 57418->57419 57419->56564 57421 7ffda3391b03 57420->57421 57422 7ffda33934c0 17 API calls 57421->57422 57423 7ffda3391b39 57422->57423 57424 7ffda338a1f0 collate 17 API calls 57423->57424 57425 7ffda3391b69 collate 57424->57425 57425->56566 57427 7ffda3391c6a 57426->57427 57428 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57427->57428 57429 7ffda3391c74 collate 57428->57429 57430 7ffda338a1f0 collate 17 API calls 57429->57430 57431 7ffda3391cbb collate 57430->57431 57431->56568 57433 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57432->57433 57434 7ffda3391dde collate 57433->57434 57434->56572 57436 7ffda3391eaf 57435->57436 58348 7ffda3393950 57436->58348 57438 7ffda3391ebc 57439 7ffda338a1f0 collate 17 API calls 57438->57439 57440 7ffda3391efa collate 57439->57440 57441 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57440->57441 57442 7ffda3391fad collate 57441->57442 57443 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57442->57443 57444 7ffda3391fc6 collate 57443->57444 57445 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57444->57445 57446 7ffda3391fdf collate 57445->57446 57447 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57446->57447 57448 7ffda3392004 57447->57448 57448->56577 57450 7ffda3392407 57449->57450 57451 7ffda338a1f0 collate 17 API calls 57450->57451 57452 7ffda3392411 collate 57451->57452 57452->56580 57454 7ffda3392543 57453->57454 57455 7ffda338a1f0 collate 17 API calls 57454->57455 57456 7ffda339254d collate 57455->57456 57457 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57456->57457 57458 7ffda3392600 collate 57457->57458 57459 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57458->57459 57460 7ffda3392619 collate 57459->57460 57461 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57460->57461 57462 7ffda3392638 57461->57462 57463 7ffda3392650 57462->57463 57464 7ffda339268a 57463->57464 57465 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57464->57465 57466 7ffda33926c2 collate 57465->57466 57467 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57466->57467 57468 7ffda33926de collate 57467->57468 57468->56584 57470 7ffda3392977 57469->57470 57471 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57470->57471 57472 7ffda3392981 collate 57471->57472 57473 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57472->57473 57474 7ffda339299c collate 57473->57474 57475 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57474->57475 57476 7ffda33929b3 collate 57475->57476 57477 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57476->57477 57478 7ffda33929d3 57477->57478 57479 7ffda33929f0 57478->57479 57480 7ffda3392a35 57479->57480 57481 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57480->57481 57482 7ffda3392a67 collate 57481->57482 57483 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57482->57483 57484 7ffda3392a80 collate 57483->57484 57485 7ffda338a1f0 collate 17 API calls 57484->57485 57486 7ffda3392ac0 collate 57485->57486 57486->56588 57488 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57487->57488 57489 7ffda3392b98 collate 57488->57489 57490 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57489->57490 57491 7ffda3392bb4 collate 57490->57491 57491->56592 57493 7ffda3392c3f 57492->57493 58360 7ffda3393700 57493->58360 57496 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57497 7ffda3392c58 collate 57496->57497 57498 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57497->57498 57499 7ffda3392ca0 collate 57498->57499 57500 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57499->57500 57501 7ffda3392cbb collate 57500->57501 57502 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57501->57502 57503 7ffda3392cd2 collate 57502->57503 57504 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57503->57504 57505 7ffda3392cf2 57504->57505 57505->56594 57507 7ffda3392d64 57506->57507 57508 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57507->57508 57509 7ffda3392d6e collate 57508->57509 57510 7ffda338a1f0 collate 17 API calls 57509->57510 57512 7ffda3392db5 collate 57510->57512 57511 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57513 7ffda3392e68 collate 57511->57513 57512->57511 57514 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57513->57514 57515 7ffda3392e8d 57514->57515 57515->56596 57517 7ffda3392f06 57516->57517 57518 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57517->57518 57519 7ffda3392f44 collate 57518->57519 57520 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57519->57520 57521 7ffda3392f5f collate 57520->57521 57522 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57521->57522 57523 7ffda3392f7d 57522->57523 57523->56599 57525 7ffda3392fed 57524->57525 57526 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57525->57526 57527 7ffda3393066 collate 57526->57527 57528 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57527->57528 57529 7ffda3393082 collate 57528->57529 57530 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57529->57530 57531 7ffda339309d collate 57530->57531 57532 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57531->57532 57533 7ffda33930be 57532->57533 57533->56603 57535 7ffda339313d 57534->57535 57536 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57535->57536 57537 7ffda3393176 collate 57536->57537 57538 7ffda338a1f0 collate 17 API calls 57537->57538 57539 7ffda3393190 collate 57538->57539 57540 7ffda338a1f0 collate 17 API calls 57539->57540 57542 7ffda3393266 collate 57540->57542 57541 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57543 7ffda3393305 collate 57541->57543 57542->57541 57544 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57543->57544 57545 7ffda3393323 57544->57545 57545->56606 57547 7ffda3393398 57546->57547 57548 7ffda338a1f0 collate 17 API calls 57547->57548 57551 7ffda33933a2 collate 57548->57551 57549 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57550 7ffda3393455 collate 57549->57550 57552 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57550->57552 57551->57549 57553 7ffda3393474 57552->57553 57553->56608 57555 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57554->57555 57556 7ffda339349e collate 57555->57556 57556->56610 57558 7ffda3393520 57557->57558 57559 7ffda338a1f0 collate 17 API calls 57558->57559 57560 7ffda3393529 collate 57559->57560 57561 7ffda338a1f0 collate 17 API calls 57560->57561 57562 7ffda33935ff collate 57561->57562 57563 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57562->57563 57564 7ffda339369e collate 57563->57564 57565 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57564->57565 57566 7ffda33936b7 collate 57565->57566 57567 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57566->57567 57568 7ffda33936d8 57567->57568 57568->56612 57570 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57569->57570 57571 7ffda3393921 collate 57570->57571 57571->56616 57573 7ffda3393bc4 57572->57573 57574 7ffda338a1f0 collate 17 API calls 57573->57574 57575 7ffda3393c09 collate 57574->57575 57575->56618 57577 7ffda3393d1d 57576->57577 57578 7ffda3395a60 17 API calls 57577->57578 57579 7ffda3393d88 57578->57579 57580 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57579->57580 57581 7ffda3393d91 collate 57580->57581 57582 7ffda338a1f0 collate 17 API calls 57581->57582 57583 7ffda3393dd1 collate 57582->57583 57583->56622 57585 7ffda3393ecc 57584->57585 57586 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57585->57586 57587 7ffda3393f0f collate 57586->57587 57588 7ffda338a1f0 collate 17 API calls 57587->57588 57589 7ffda3393f2b collate 57588->57589 57589->56624 57591 7ffda339403c 57590->57591 57592 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57591->57592 57593 7ffda3394045 collate 57592->57593 57594 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57593->57594 57595 7ffda33940b6 collate 57594->57595 57596 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57595->57596 57597 7ffda33940cf collate 57596->57597 57597->56626 57599 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57598->57599 57600 7ffda3394108 collate 57599->57600 57601 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57600->57601 57602 7ffda3394124 collate 57601->57602 57602->56628 57604 7ffda33941a4 57603->57604 57605 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57604->57605 57606 7ffda33941ad collate 57605->57606 57607 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57606->57607 57608 7ffda33941cb 57607->57608 57608->56633 57610 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57609->57610 57611 7ffda33942b1 collate 57610->57611 57611->56642 57613 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57612->57613 57614 7ffda33942e1 collate 57613->57614 57614->56644 57616 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57615->57616 57617 7ffda3394311 collate 57616->57617 57617->56646 57619 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57618->57619 57620 7ffda3394345 collate 57619->57620 57621 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57620->57621 57622 7ffda3394361 collate 57621->57622 57622->56648 57624 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57623->57624 57625 7ffda33943a8 collate 57624->57625 57626 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57625->57626 57627 7ffda33943c4 collate 57626->57627 57627->56650 57629 7ffda339444c 57628->57629 57630 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57629->57630 57631 7ffda3394455 collate 57630->57631 57632 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57631->57632 57633 7ffda339446c collate 57632->57633 57634 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57633->57634 57635 7ffda339448a 57634->57635 57635->56655 57637 7ffda33944f7 57636->57637 57638 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57637->57638 57639 7ffda3394500 collate 57638->57639 57640 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57639->57640 57641 7ffda3394517 collate 57640->57641 57642 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57641->57642 57643 7ffda3394535 57642->57643 57643->56659 57645 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57644->57645 57646 7ffda33945de collate 57645->57646 57646->56666 57648 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57647->57648 57649 7ffda3394616 collate 57648->57649 57650 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57649->57650 57651 7ffda3394632 collate 57650->57651 57652 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57651->57652 57653 7ffda339464e collate 57652->57653 57653->56668 57655 7ffda3394702 57654->57655 57656 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57655->57656 57657 7ffda339470b collate 57656->57657 57658 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57657->57658 57659 7ffda3394729 57658->57659 57659->56673 57661 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57660->57661 57662 7ffda3394758 collate 57661->57662 57663 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57662->57663 57664 7ffda3394774 collate 57663->57664 57664->56676 57666 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57665->57666 57667 7ffda33947f7 collate 57666->57667 57668 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57667->57668 57669 7ffda3394813 collate 57668->57669 57669->56680 57671 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57670->57671 57672 7ffda3394895 collate 57671->57672 57673 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57672->57673 57674 7ffda33948b1 collate 57673->57674 57674->56686 57676 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57675->57676 57677 7ffda33948ee collate 57676->57677 57677->56688 57679 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57678->57679 57680 7ffda3394925 collate 57679->57680 57681 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57680->57681 57682 7ffda3394941 collate 57681->57682 57682->56690 57684 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57683->57684 57685 7ffda3394988 collate 57684->57685 57686 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57685->57686 57687 7ffda33949a4 collate 57686->57687 57687->56692 57689 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57688->57689 57690 7ffda3394a25 collate 57689->57690 57691 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57690->57691 57692 7ffda3394a41 collate 57691->57692 57692->56696 57694 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57693->57694 57695 7ffda3394a7e collate 57694->57695 57695->56698 57697 7ffda3394b32 57696->57697 57698 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57697->57698 57699 7ffda3394b3b collate 57698->57699 57700 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57699->57700 57701 7ffda3394b59 57700->57701 57701->56703 57703 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57702->57703 57704 7ffda3394b81 collate 57703->57704 57704->56706 57706 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57705->57706 57707 7ffda3394bae collate 57706->57707 57707->56708 57709 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57708->57709 57710 7ffda3394bde collate 57709->57710 57710->56710 57712 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57711->57712 57713 7ffda3394c0e collate 57712->57713 57713->56712 57715 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57714->57715 57716 7ffda3394c3e collate 57715->57716 57716->56714 57718 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57717->57718 57719 7ffda3394cb1 collate 57718->57719 57719->56718 57721 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57720->57721 57722 7ffda3394ce1 collate 57721->57722 57722->56720 57724 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57723->57724 57725 7ffda3394d21 collate 57724->57725 57725->56722 57727 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57726->57727 57728 7ffda3394d51 collate 57727->57728 57728->56724 57730 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57729->57730 57731 7ffda3394d88 collate 57730->57731 57732 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57731->57732 57733 7ffda3394da4 collate 57732->57733 57733->56726 57735 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57734->57735 57736 7ffda3394dde collate 57735->57736 57736->56728 57738 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57737->57738 57739 7ffda3394e0e collate 57738->57739 57739->56730 57741 7ffda3394e84 57740->57741 57742 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57741->57742 57743 7ffda3394e8d collate 57742->57743 57744 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57743->57744 57745 7ffda3394eab 57744->57745 57745->56733 57747 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57746->57747 57748 7ffda3394ed8 collate 57747->57748 57749 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57748->57749 57750 7ffda3394ef4 collate 57749->57750 57750->56738 57752 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57751->57752 57753 7ffda3394f31 collate 57752->57753 57753->56740 57755 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57754->57755 57756 7ffda3394ff1 collate 57755->57756 57756->56748 57758 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57757->57758 57759 7ffda3395021 collate 57758->57759 57759->56750 57761 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57760->57761 57762 7ffda339504e collate 57761->57762 57762->56752 57764 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57763->57764 57765 7ffda3395081 collate 57764->57765 57765->56754 57767 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57766->57767 57768 7ffda33950c1 collate 57767->57768 57768->56756 57770 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57769->57770 57771 7ffda33950ee collate 57770->57771 57771->56758 57773 7ffda3395162 57772->57773 57774 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57773->57774 57775 7ffda339516b collate 57774->57775 57776 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57775->57776 57777 7ffda3395189 57776->57777 57777->56761 57779 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57778->57779 57780 7ffda33951ae collate 57779->57780 57780->56764 57782 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57781->57782 57783 7ffda33951e5 collate 57782->57783 57784 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57783->57784 57785 7ffda3395201 collate 57784->57785 57785->56766 57787 7ffda3395284 57786->57787 57788 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57787->57788 57789 7ffda339528d collate 57788->57789 57790 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57789->57790 57791 7ffda33952ab 57790->57791 57791->56769 57793 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57792->57793 57794 7ffda3395311 collate 57793->57794 57794->56774 57796 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57795->57796 57797 7ffda3395358 collate 57796->57797 57798 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57797->57798 57799 7ffda3395374 collate 57798->57799 57799->56778 57801 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57800->57801 57802 7ffda33953b5 collate 57801->57802 57803 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57802->57803 57804 7ffda33953d1 collate 57803->57804 57804->56780 57806 7ffda3395452 57805->57806 57807 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57806->57807 57808 7ffda339545b collate 57807->57808 57809 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57808->57809 57810 7ffda3395479 57809->57810 57810->56783 57812 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57811->57812 57813 7ffda33954a6 collate 57812->57813 57814 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57813->57814 57815 7ffda33954c2 collate 57814->57815 57816 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57815->57816 57817 7ffda33954de collate 57816->57817 57817->56786 57819 7ffda3395592 57818->57819 57820 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57819->57820 57821 7ffda339559b collate 57820->57821 57822 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57821->57822 57823 7ffda33955b9 57822->57823 57823->56791 57825 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57824->57825 57826 7ffda3395625 collate 57825->57826 57827 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57826->57827 57828 7ffda3395641 collate 57827->57828 57828->56796 57830 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57829->57830 57831 7ffda339567e collate 57830->57831 57831->56798 57833 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57832->57833 57834 7ffda33956b8 collate 57833->57834 57835 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57834->57835 57836 7ffda33956d4 collate 57835->57836 57836->56800 57838 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57837->57838 57839 7ffda33957ce collate 57838->57839 57839->56810 57841 7ffda3395882 57840->57841 57842 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57841->57842 57843 7ffda339588b collate 57842->57843 57844 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57843->57844 57845 7ffda33958a9 57844->57845 57845->56815 57847 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57846->57847 57848 7ffda3395915 collate 57847->57848 57849 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57848->57849 57850 7ffda3395931 collate 57849->57850 57850->56820 57852 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57851->57852 57853 7ffda33959ae collate 57852->57853 57853->56824 57855 7ffda3395a22 57854->57855 57856 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57855->57856 57857 7ffda3395a2b collate 57856->57857 57858 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57857->57858 57859 7ffda3395a49 57858->57859 57859->56827 57861 7ffda3395ac3 57860->57861 57862 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57861->57862 57863 7ffda3395acc collate 57862->57863 57864 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57863->57864 57865 7ffda3395ae3 collate 57864->57865 57866 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57865->57866 57867 7ffda3395afa collate 57866->57867 57868 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57867->57868 57869 7ffda3395b18 57868->57869 57869->56831 57871 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57870->57871 57872 7ffda3395b48 collate 57871->57872 57873 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57872->57873 57874 7ffda3395b64 collate 57873->57874 57874->56834 57876 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57875->57876 57877 7ffda3395c25 collate 57876->57877 57878 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57877->57878 57879 7ffda3395c41 collate 57878->57879 57879->56840 57881 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57880->57881 57882 7ffda3395c81 collate 57881->57882 57882->56844 57884 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57883->57884 57885 7ffda3395cb1 collate 57884->57885 57885->56846 57887 7ffda3395d67 57886->57887 57888 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57887->57888 57889 7ffda3395d70 collate 57888->57889 57890 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57889->57890 57891 7ffda3395d87 collate 57890->57891 57892 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 57891->57892 57893 7ffda3395da5 57892->57893 57893->56851 57895 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57894->57895 57896 7ffda3395dd1 collate 57895->57896 57896->56854 57898 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57897->57898 57899 7ffda3395e0e collate 57898->57899 57899->56858 57901 7ffda3396730 24 API calls 57900->57901 57902 7ffda33a1165 57901->57902 57903 7ffda33a118e 57902->57903 57905 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57902->57905 57904 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57903->57904 57906 7ffda33a11c8 collate 57904->57906 57907 7ffda33a117c 57905->57907 57912 7ffda33aa550 24 API calls 57906->57912 57908 7ffda33a1190 57907->57908 57909 7ffda33a1183 57907->57909 57911 7ffda338a1f0 collate 17 API calls 57908->57911 58589 7ffda338a260 17 API calls 3 library calls 57909->58589 57911->57903 57913 7ffda33a11e9 57912->57913 57915 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57913->57915 57922 7ffda33a120b 57913->57922 57914 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 57916 7ffda33a1245 collate 57914->57916 57917 7ffda33a11f9 57915->57917 57923 7ffda33a85f0 20 API calls 57916->57923 57918 7ffda33a120d 57917->57918 57919 7ffda33a1200 57917->57919 57921 7ffda338a1f0 collate 17 API calls 57918->57921 58590 7ffda338a260 17 API calls 3 library calls 57919->58590 57921->57922 57922->57914 57924 7ffda33a1295 57923->57924 57925 7ffda33a4180 13 API calls 57924->57925 57926 7ffda33a12a7 57925->57926 58370 7ffda33980e0 57926->58370 57928 7ffda33a12b6 memcpy_s 58536 7ffda33a5090 57928->58536 57936 7ffda33a13c3 57937 7ffda33a85f0 20 API calls 57936->57937 58251 7ffda338edb9 58250->58251 58252 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58251->58252 58253 7ffda338edf5 collate 58252->58253 58254 7ffda338a1f0 collate 17 API calls 58253->58254 58255 7ffda338ee10 collate 58254->58255 58264 7ffda33918e0 58255->58264 58258 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58259 7ffda338ef67 collate 58258->58259 58260 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58259->58260 58261 7ffda338ef82 collate 58260->58261 58262 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58261->58262 58263 7ffda338efa0 58262->58263 58263->56897 58265 7ffda339194f 58264->58265 58266 7ffda338a1f0 collate 17 API calls 58265->58266 58267 7ffda3391995 collate 58266->58267 58268 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58267->58268 58269 7ffda3391a48 collate 58268->58269 58270 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58269->58270 58271 7ffda3391a61 collate 58270->58271 58272 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58271->58272 58273 7ffda3391a7a collate 58272->58273 58274 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58273->58274 58275 7ffda338ef5e 58274->58275 58275->58258 58277 7ffda3390e26 58276->58277 58278 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58277->58278 58279 7ffda3390e58 collate 58278->58279 58280 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58279->58280 58281 7ffda3390e72 collate 58280->58281 58282 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58281->58282 58283 7ffda3390eb3 collate 58282->58283 58284 7ffda338a1f0 collate 17 API calls 58283->58284 58286 7ffda3390ef4 collate 58284->58286 58285 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58287 7ffda3390fa1 collate 58285->58287 58286->58285 58288 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58287->58288 58289 7ffda3390fba collate 58288->58289 58290 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58289->58290 58291 7ffda338d82d 58290->58291 58291->57022 58293 7ffda338db74 58292->58293 58294 7ffda338a1f0 collate 17 API calls 58293->58294 58297 7ffda338dbb2 collate 58294->58297 58295 7ffda33905d0 17 API calls 58296 7ffda338dc65 58295->58296 58298 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58296->58298 58297->58295 58299 7ffda338dc6e collate 58298->58299 58300 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58299->58300 58301 7ffda338dc89 collate 58300->58301 58302 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58301->58302 58303 7ffda338dca2 collate 58302->58303 58304 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58303->58304 58305 7ffda338dcbb collate 58304->58305 58306 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58305->58306 58307 7ffda338dcd6 collate 58306->58307 58308 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58307->58308 58309 7ffda338d982 58308->58309 58309->57028 58311 7ffda339274c 58310->58311 58312 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58311->58312 58313 7ffda3392783 collate 58312->58313 58314 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58313->58314 58315 7ffda33927f3 collate 58314->58315 58316 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58315->58316 58317 7ffda3392834 collate 58316->58317 58318 7ffda338a1f0 collate 17 API calls 58317->58318 58319 7ffda3392855 collate 58318->58319 58319->57068 58321 7ffda339170a 58320->58321 58322 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58321->58322 58323 7ffda3391777 collate 58322->58323 58324 7ffda338a1f0 collate 17 API calls 58323->58324 58325 7ffda3391791 collate 58324->58325 58330 7ffda3392020 58325->58330 58328 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58329 7ffda3391874 collate 58328->58329 58329->57190 58331 7ffda339207f 58330->58331 58332 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58331->58332 58333 7ffda33920ec collate 58332->58333 58334 7ffda338a1f0 collate 17 API calls 58333->58334 58335 7ffda3392106 collate 58334->58335 58336 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58335->58336 58337 7ffda33921b3 collate 58336->58337 58338 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58337->58338 58339 7ffda339186b 58338->58339 58339->58328 58341 7ffda339223a 58340->58341 58342 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58341->58342 58343 7ffda33922a7 collate 58342->58343 58344 7ffda338a1f0 collate 17 API calls 58343->58344 58345 7ffda33922c1 collate 58344->58345 58346 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58345->58346 58347 7ffda3392397 collate 58346->58347 58347->57323 58349 7ffda3393995 58348->58349 58350 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58349->58350 58351 7ffda33939fd collate 58350->58351 58352 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58351->58352 58353 7ffda3393a17 collate 58352->58353 58354 7ffda338a1f0 collate 17 API calls 58353->58354 58355 7ffda3393a30 collate 58354->58355 58356 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58355->58356 58357 7ffda3393b39 collate 58356->58357 58358 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58357->58358 58359 7ffda3393b54 collate 58358->58359 58359->57438 58361 7ffda339375d 58360->58361 58362 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58361->58362 58363 7ffda33937ca collate 58362->58363 58364 7ffda338a1f0 collate 17 API calls 58363->58364 58365 7ffda33937e4 collate 58364->58365 58366 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58365->58366 58367 7ffda3393891 collate 58366->58367 58368 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58367->58368 58369 7ffda3392c4e 58368->58369 58369->57496 58371 7ffda33a4180 13 API calls 58370->58371 58372 7ffda339812f 58371->58372 58373 7ffda33b5270 new 5 API calls 58372->58373 58374 7ffda339814b 58373->58374 58591 7ffda3396490 58374->58591 58377 7ffda3396490 23 API calls 58378 7ffda3398183 58377->58378 58379 7ffda33981a8 58378->58379 58751 7ffda33d18c0 9 API calls 58378->58751 58381 7ffda33c37a0 30 API calls 58379->58381 58383 7ffda33981b4 58381->58383 58382 7ffda33981a0 58752 7ffda33c37e0 30 API calls __vcrt_getptd 58382->58752 58610 7ffda3396a80 58383->58610 58388 7ffda338abf0 20 API calls 58389 7ffda3398286 58388->58389 58390 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58389->58390 58391 7ffda3398297 58390->58391 58392 7ffda33982af 58391->58392 58393 7ffda339829f 58391->58393 58396 7ffda338a1f0 collate 17 API calls 58392->58396 58754 7ffda338a260 17 API calls 3 library calls 58393->58754 58394 7ffda33981f2 BuildCatchObjectHelperInternal 58394->58388 58397 7ffda33982ad 58396->58397 58398 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58397->58398 58399 7ffda33982e8 collate 58398->58399 58400 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58399->58400 58401 7ffda3398306 collate 58400->58401 58402 7ffda33a85f0 20 API calls 58401->58402 58403 7ffda3398351 58402->58403 58405 7ffda3398379 BuildCatchObjectHelperInternal 58403->58405 58755 7ffda33a7520 20 API calls 3 library calls 58403->58755 58406 7ffda338abf0 20 API calls 58405->58406 58407 7ffda339840e 58406->58407 58408 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58407->58408 58409 7ffda3398422 58408->58409 58410 7ffda339843a 58409->58410 58411 7ffda339842a 58409->58411 58413 7ffda338a1f0 collate 17 API calls 58410->58413 58756 7ffda338a260 17 API calls 3 library calls 58411->58756 58414 7ffda3398438 58413->58414 58415 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58414->58415 58416 7ffda3398473 collate 58415->58416 58417 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58416->58417 58418 7ffda3398493 collate 58417->58418 58419 7ffda33a85f0 20 API calls 58418->58419 58420 7ffda33984db 58419->58420 58421 7ffda33984f6 58420->58421 58757 7ffda33d18c0 9 API calls 58420->58757 58423 7ffda33c37a0 30 API calls 58421->58423 58425 7ffda3398502 58423->58425 58424 7ffda33984ee 58758 7ffda33c37e0 30 API calls __vcrt_getptd 58424->58758 58427 7ffda3396a80 35 API calls 58425->58427 58430 7ffda339851d 58427->58430 58428 7ffda33a6510 20 API calls 58429 7ffda3398591 58428->58429 58431 7ffda33a4bf0 20 API calls 58429->58431 58430->58428 58432 7ffda33985bc 58431->58432 58433 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58432->58433 58434 7ffda33985c7 collate 58433->58434 58435 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58434->58435 58436 7ffda33985e5 collate 58435->58436 58437 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58436->58437 58438 7ffda3398601 collate 58437->58438 58439 7ffda33a4180 13 API calls 58438->58439 58440 7ffda3398628 58439->58440 58441 7ffda33a4180 13 API calls 58440->58441 58442 7ffda339863b 58441->58442 58625 7ffda3396ec0 58442->58625 58444 7ffda3398647 58446 7ffda33a85f0 20 API calls 58444->58446 58447 7ffda3398bac collate 58444->58447 58448 7ffda3398692 58446->58448 58449 7ffda3398c21 58447->58449 58450 7ffda3398c26 58447->58450 58453 7ffda33a8460 24 API calls 58447->58453 58670 7ffda3396be0 58447->58670 58452 7ffda33986ba 58448->58452 58456 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58448->58456 58686 7ffda3396d70 58449->58686 58454 7ffda33a4180 13 API calls 58450->58454 58455 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58452->58455 58453->58447 58458 7ffda3398c33 58454->58458 58459 7ffda33986ed collate 58455->58459 58457 7ffda33986a7 58456->58457 58460 7ffda33986bc 58457->58460 58461 7ffda33986ae 58457->58461 58702 7ffda33970c0 58458->58702 58467 7ffda33a4bf0 20 API calls 58459->58467 58464 7ffda338a1f0 collate 17 API calls 58460->58464 58759 7ffda338a260 17 API calls 3 library calls 58461->58759 58464->58452 58466 7ffda3398c61 58468 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58466->58468 58470 7ffda3398726 58467->58470 58471 7ffda3398c94 collate 58468->58471 58469 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58472 7ffda3398c4f 58469->58472 58475 7ffda33a85f0 20 API calls 58470->58475 58479 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58471->58479 58473 7ffda3398c56 58472->58473 58474 7ffda3398c63 58472->58474 58761 7ffda338a260 17 API calls 3 library calls 58473->58761 58476 7ffda338a1f0 collate 17 API calls 58474->58476 58478 7ffda339875f 58475->58478 58476->58466 58481 7ffda33a4bf0 20 API calls 58478->58481 58480 7ffda3398cb3 collate 58479->58480 58484 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58480->58484 58482 7ffda339877b 58481->58482 58483 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58482->58483 58487 7ffda3398785 collate 58483->58487 58485 7ffda3398cd5 collate 58484->58485 58486 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58485->58486 58488 7ffda3398cf1 collate 58486->58488 58489 7ffda33a6790 13 API calls 58487->58489 58491 7ffda3398d4b 58487->58491 58493 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58488->58493 58490 7ffda33987e7 58489->58490 58492 7ffda33a4bf0 20 API calls 58490->58492 58494 7ffda339880f 58492->58494 58495 7ffda3398d0c collate 58493->58495 58496 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58494->58496 58497 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58495->58497 58498 7ffda339881a collate 58496->58498 58499 7ffda3398d30 58497->58499 58500 7ffda33a85f0 20 API calls 58498->58500 58499->57928 58501 7ffda3398867 58500->58501 58502 7ffda33a4bf0 20 API calls 58501->58502 58504 7ffda3398883 std::_Locinfo::_Locinfo_dtor 58502->58504 58503 7ffda3398a41 58505 7ffda33a85f0 20 API calls 58503->58505 58504->58503 58506 7ffda33988c9 58504->58506 58507 7ffda3398a7a 58505->58507 58506->58491 58508 7ffda33b5270 new 5 API calls 58506->58508 58507->58491 58510 7ffda33a6790 13 API calls 58507->58510 58509 7ffda3398917 58508->58509 58514 7ffda338b200 5 API calls 58509->58514 58516 7ffda3398942 BuildCatchObjectHelperInternal 58509->58516 58511 7ffda3398aca 58510->58511 58512 7ffda33a4bf0 20 API calls 58511->58512 58513 7ffda3398aef 58512->58513 58515 7ffda338abf0 20 API calls 58513->58515 58514->58516 58517 7ffda3398afc 58515->58517 58518 7ffda33a85f0 20 API calls 58516->58518 58519 7ffda33a4bf0 20 API calls 58517->58519 58522 7ffda33989e4 58518->58522 58520 7ffda3398b27 58519->58520 58521 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58520->58521 58523 7ffda3398b32 collate 58521->58523 58649 7ffda33968d0 58522->58649 58525 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58523->58525 58527 7ffda3398b51 collate 58525->58527 58529 7ffda33a4180 13 API calls 58527->58529 58528 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58532 7ffda3398a34 collate 58528->58532 58530 7ffda3398b75 58529->58530 58760 7ffda3397e20 73 API calls 3 library calls 58530->58760 58534 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58532->58534 58533 7ffda3398b7d 58535 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58533->58535 58534->58447 58535->58532 58537 7ffda33c6700 new[] 3 API calls 58536->58537 58538 7ffda33a50f9 58537->58538 58552 7ffda33a5202 58538->58552 58775 7ffda33ae050 58538->58775 58542 7ffda33a5208 58545 7ffda33a5189 58546 7ffda33a1325 58545->58546 58805 7ffda33ae4f0 9 API calls 2 library calls 58545->58805 58553 7ffda33a4650 58546->58553 58548 7ffda33a51b1 58806 7ffda338c260 20 API calls collate 58548->58806 58550 7ffda33a51f1 58551 7ffda33b8fb0 Concurrency::cancel_current_task 2 API calls 58550->58551 58551->58552 58807 7ffda33ad6a0 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task std::bad_alloc::bad_alloc 58552->58807 58554 7ffda33c6700 new[] 3 API calls 58553->58554 58555 7ffda33a4680 58554->58555 58556 7ffda33a4688 58555->58556 58557 7ffda33a4702 58555->58557 58559 7ffda33ae050 36 API calls 58556->58559 58814 7ffda33ad6a0 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task std::bad_alloc::bad_alloc 58557->58814 58560 7ffda33a139b 58559->58560 58562 7ffda33a7030 58560->58562 58561 7ffda33a4707 58563 7ffda33a706d 58562->58563 58567 7ffda33a70a2 58563->58567 58818 7ffda33a6b90 28 API calls 2 library calls 58563->58818 58565 7ffda33a722e 58815 7ffda33ae4e0 58565->58815 58567->58565 58569 7ffda33a726e 58567->58569 58820 7ffda338c260 20 API calls collate 58569->58820 58571 7ffda33a13b7 58576 7ffda33a59d0 58571->58576 58573 7ffda33a72b2 58574 7ffda33b8fb0 Concurrency::cancel_current_task 2 API calls 58573->58574 58575 7ffda33a72c3 58574->58575 58577 7ffda33a5a1c 58576->58577 58830 7ffda33a68c0 58577->58830 58579 7ffda33a5a2b 58580 7ffda33a5aec 58579->58580 58582 7ffda33a5410 69 API calls 58579->58582 58581 7ffda33a5b91 58580->58581 58847 7ffda338c260 20 API calls collate 58580->58847 58581->57936 58588 7ffda33a5a5d 58582->58588 58584 7ffda33a5bfd 58585 7ffda33b8fb0 Concurrency::cancel_current_task 2 API calls 58584->58585 58588->58580 58846 7ffda338adf0 20 API calls 2 library calls 58588->58846 58589->57903 58590->57922 58592 7ffda33b5270 new 5 API calls 58591->58592 58593 7ffda33964e5 58592->58593 58594 7ffda33a85f0 20 API calls 58593->58594 58595 7ffda339653e LoadLibraryA 58594->58595 58596 7ffda339655f 58595->58596 58597 7ffda3396602 58595->58597 58598 7ffda33a85f0 20 API calls 58596->58598 58600 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58597->58600 58599 7ffda3396597 GetProcAddress 58598->58599 58601 7ffda33965dd FreeLibrary 58599->58601 58602 7ffda33965b4 58599->58602 58603 7ffda3396640 collate 58600->58603 58601->58602 58604 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58602->58604 58606 7ffda338a1f0 collate 17 API calls 58603->58606 58605 7ffda33965f0 collate 58604->58605 58605->58597 58609 7ffda339665c collate 58606->58609 58607 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58608 7ffda3396711 58607->58608 58608->58377 58609->58607 58611 7ffda3396ade 58610->58611 58612 7ffda33a85f0 20 API calls 58611->58612 58613 7ffda3396aed 58612->58613 58614 7ffda33b5270 new 5 API calls 58613->58614 58615 7ffda3396b08 58614->58615 58762 7ffda33a3e00 58615->58762 58617 7ffda3396b95 58618 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58617->58618 58620 7ffda3396b9f collate 58618->58620 58619 7ffda33c37a0 30 API calls 58621 7ffda3396b35 58619->58621 58623 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58620->58623 58621->58617 58621->58619 58772 7ffda338adf0 20 API calls 2 library calls 58621->58772 58624 7ffda3396bc6 58623->58624 58624->58394 58753 7ffda33a7520 20 API calls 3 library calls 58624->58753 58626 7ffda3396f03 58625->58626 58627 7ffda3396be0 24 API calls 58626->58627 58628 7ffda3396f23 58627->58628 58629 7ffda33a85f0 20 API calls 58628->58629 58630 7ffda3396f89 LoadLibraryA 58629->58630 58631 7ffda3396faa 58630->58631 58632 7ffda3397028 collate 58630->58632 58635 7ffda33a85f0 20 API calls 58631->58635 58633 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58632->58633 58634 7ffda3397044 collate 58633->58634 58637 7ffda3396d70 24 API calls 58634->58637 58636 7ffda3396fe2 GetProcAddress 58635->58636 58638 7ffda3397015 FreeLibrary 58636->58638 58639 7ffda3396fff WriteFile 58636->58639 58641 7ffda339705e 58637->58641 58640 7ffda339701f 58638->58640 58639->58640 58642 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58640->58642 58643 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58641->58643 58642->58632 58644 7ffda3397067 collate 58643->58644 58645 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58644->58645 58646 7ffda3397080 collate 58645->58646 58647 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58646->58647 58648 7ffda33970a1 58647->58648 58648->58444 58650 7ffda3396930 58649->58650 58651 7ffda33a85f0 20 API calls 58650->58651 58652 7ffda339693e LoadLibraryA 58651->58652 58653 7ffda33969f7 collate 58652->58653 58654 7ffda3396962 58652->58654 58655 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58653->58655 58657 7ffda33a85f0 20 API calls 58654->58657 58656 7ffda3396a13 collate 58655->58656 58659 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58656->58659 58658 7ffda3396996 GetProcAddress 58657->58658 58660 7ffda33969e4 FreeLibrary 58658->58660 58663 7ffda33969b3 ShellExecuteA 58658->58663 58662 7ffda3396a2e collate 58659->58662 58661 7ffda33969ee 58660->58661 58665 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58661->58665 58666 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58662->58666 58663->58661 58665->58653 58667 7ffda3396a47 collate 58666->58667 58668 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58667->58668 58669 7ffda3396a66 58668->58669 58669->58528 58671 7ffda3396c4a 58670->58671 58672 7ffda33a85f0 20 API calls 58671->58672 58673 7ffda3396c58 LoadLibraryA 58672->58673 58674 7ffda3396d01 collate 58673->58674 58676 7ffda3396c79 58673->58676 58675 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58674->58675 58677 7ffda3396d21 collate 58675->58677 58678 7ffda33a85f0 20 API calls 58676->58678 58680 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58677->58680 58679 7ffda3396caf GetProcAddress 58678->58679 58681 7ffda3396ccc CreateFileA 58679->58681 58682 7ffda3396cee FreeLibrary 58679->58682 58683 7ffda3396d46 58680->58683 58684 7ffda3396cf8 58681->58684 58682->58684 58683->58447 58685 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58684->58685 58685->58674 58687 7ffda3396dc8 58686->58687 58688 7ffda33a85f0 20 API calls 58687->58688 58689 7ffda3396dd5 LoadLibraryA 58688->58689 58690 7ffda3396df6 58689->58690 58701 7ffda3396e63 collate 58689->58701 58693 7ffda33a85f0 20 API calls 58690->58693 58691 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58692 7ffda3396e7f collate 58691->58692 58695 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58692->58695 58694 7ffda3396e2a GetProcAddress 58693->58694 58696 7ffda3396e47 CloseHandle 58694->58696 58697 7ffda3396e50 FreeLibrary 58694->58697 58699 7ffda3396e9f 58695->58699 58698 7ffda3396e5a 58696->58698 58697->58698 58700 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58698->58700 58699->58450 58700->58701 58701->58691 58703 7ffda339711c 58702->58703 58704 7ffda3396be0 24 API calls 58703->58704 58705 7ffda3397140 58704->58705 58706 7ffda33a85f0 20 API calls 58705->58706 58707 7ffda3397195 LoadLibraryA 58706->58707 58708 7ffda3397275 58707->58708 58709 7ffda33971bf 58707->58709 58710 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58708->58710 58711 7ffda33a85f0 20 API calls 58709->58711 58715 7ffda3397287 collate memcpy_s 58710->58715 58712 7ffda339720a GetProcAddress 58711->58712 58713 7ffda3397240 FreeLibrary 58712->58713 58714 7ffda3397230 58712->58714 58713->58714 58716 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58714->58716 58718 7ffda33b5270 new 5 API calls 58715->58718 58750 7ffda33972ad collate 58715->58750 58717 7ffda339725b collate 58716->58717 58717->58708 58720 7ffda3397314 58718->58720 58719 7ffda338ad20 Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 17 API calls 58721 7ffda339783e collate 58719->58721 58722 7ffda33b5270 new 5 API calls 58720->58722 58724 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58721->58724 58723 7ffda3397389 58722->58723 58725 7ffda338b200 5 API calls 58723->58725 58729 7ffda33973af collate memcpy_s 58723->58729 58726 7ffda3397860 58724->58726 58725->58729 58726->58466 58726->58469 58727 7ffda33a85f0 20 API calls 58728 7ffda33974b0 LoadLibraryA 58727->58728 58728->58729 58729->58727 58730 7ffda338ad20 17 API calls Concurrency::details::UMSFreeVirtualProcessorRoot::Activate 58729->58730 58731 7ffda33a85f0 20 API calls 58729->58731 58735 7ffda33975dc 58729->58735 58730->58729 58732 7ffda3397525 GetProcAddress 58731->58732 58733 7ffda339756b FreeLibrary 58732->58733 58734 7ffda339754b ReadFile 58732->58734 58733->58729 58734->58729 58736 7ffda3396d70 24 API calls 58735->58736 58746 7ffda33975e4 58736->58746 58737 7ffda33976ab 58738 7ffda33b5270 new 5 API calls 58737->58738 58739 7ffda33976c7 58738->58739 58741 7ffda33976db 58739->58741 58742 7ffda33976ec 58739->58742 58774 7ffda338a260 17 API calls 3 library calls 58741->58774 58744 7ffda338a1f0 collate 17 API calls 58742->58744 58745 7ffda33976ea 58744->58745 58747 7ffda338a1f0 collate 17 API calls 58745->58747 58746->58737 58773 7ffda338adf0 20 API calls 2 library calls 58746->58773 58748 7ffda3397731 collate 58747->58748 58749 7ffda338a1f0 collate 17 API calls 58748->58749 58749->58750 58750->58719 58751->58382 58752->58379 58753->58394 58754->58397 58755->58405 58756->58414 58757->58424 58758->58421 58759->58452 58760->58533 58761->58466 58763 7ffda33a3e1c 58762->58763 58770 7ffda33a3eaa BuildCatchObjectHelperInternal collate 58762->58770 58764 7ffda33a3f73 58763->58764 58766 7ffda33a3e39 58763->58766 58763->58770 58768 7ffda338a1f0 collate 17 API calls 58764->58768 58764->58770 58765 7ffda33a4039 58766->58765 58767 7ffda338b200 5 API calls 58766->58767 58769 7ffda33a3e9f 58767->58769 58768->58770 58771 7ffda338a1f0 collate 17 API calls 58769->58771 58770->58621 58771->58770 58772->58621 58773->58746 58774->58745 58776 7ffda33ad210 std::_Lockit::_Lockit 7 API calls 58775->58776 58778 7ffda33ae06d 58776->58778 58777 7ffda33ae0be Concurrency::details::EventWaitNode::EventWaitNode __ExceptionPtrCreate 58780 7ffda33ad2f0 std::_Lockit::~_Lockit 2 API calls 58777->58780 58778->58777 58808 7ffda33ae370 RtlPcToFileHeader RaiseException HeapAlloc EnterCriticalSection LeaveCriticalSection 58778->58808 58782 7ffda33a5112 58780->58782 58781 7ffda33ae08b 58809 7ffda33ae3d0 31 API calls std::locale::_Setgloballocale 58781->58809 58786 7ffda33a5410 58782->58786 58784 7ffda33ae09a 58810 7ffda33ab960 HeapAlloc EnterCriticalSection LeaveCriticalSection BuildCatchObjectHelperInternal new[] 58784->58810 58787 7ffda33ad210 std::_Lockit::_Lockit 7 API calls 58786->58787 58788 7ffda33a5440 58787->58788 58789 7ffda33ad210 std::_Lockit::_Lockit 7 API calls 58788->58789 58793 7ffda33a548f 58788->58793 58790 7ffda33a5465 58789->58790 58794 7ffda33ad2f0 std::_Lockit::~_Lockit 2 API calls 58790->58794 58791 7ffda33a54dc 58792 7ffda33ad2f0 std::_Lockit::~_Lockit 2 API calls 58791->58792 58795 7ffda33a5520 58792->58795 58793->58791 58811 7ffda338be80 69 API calls 9 library calls 58793->58811 58794->58793 58796 7ffda33b4f10 _Xtime_diff_to_millis2 8 API calls 58795->58796 58797 7ffda33a513c 58796->58797 58797->58545 58797->58548 58799 7ffda33a54ee 58800 7ffda33a54f4 58799->58800 58801 7ffda33a5543 58799->58801 58812 7ffda33adfd0 5 API calls std::_Fac_node::_Fac_node 58800->58812 58813 7ffda338ba50 5 API calls Concurrency::cancel_current_task 58801->58813 58804 7ffda33a5548 58805->58546 58806->58550 58807->58542 58808->58781 58809->58784 58810->58777 58811->58799 58812->58791 58813->58804 58814->58561 58821 7ffda33b9790 58815->58821 58818->58567 58819 7ffda33a6db0 20 API calls Concurrency::cancel_current_task 58819->58571 58820->58573 58824 7ffda33ba5a0 58821->58824 58825 7ffda33a7233 58824->58825 58826 7ffda33ba5b1 GetLastError 58824->58826 58825->58571 58825->58819 58829 7ffda33c03e0 6 API calls __vcrt_getptd_noinit 58826->58829 58828 7ffda33ba5c6 SetLastError 58828->58825 58829->58828 58831 7ffda33a6920 58830->58831 58836 7ffda33a68eb 58830->58836 58833 7ffda33a692e 58831->58833 58848 7ffda33a6b90 28 API calls 2 library calls 58831->58848 58832 7ffda33a690f 58832->58579 58834 7ffda33a6aa8 58833->58834 58837 7ffda33a5410 69 API calls 58833->58837 58834->58579 58836->58832 58849 7ffda338c260 20 API calls collate 58836->58849 58841 7ffda33a696a 58837->58841 58839 7ffda33a6b06 58840 7ffda33b8fb0 Concurrency::cancel_current_task 2 API calls 58839->58840 58840->58841 58841->58834 58850 7ffda338c260 20 API calls collate 58841->58850 58843 7ffda33a6b58 58846->58588 58847->58584 58848->58833 58849->58839 58850->58843 59004 7ffda33c44b1 59006 7ffda33c44c1 type_info::_name_internal_method 59004->59006 59007 7ffda33c44bc new[] memcpy_s 59004->59007 59006->59007 59013 7ffda33c6010 59006->59013 59008 7ffda33c498f memcpy_s 59009 7ffda33f0680 type_info::_name_internal_method 2 API calls 59008->59009 59009->59007 59010 7ffda33c45d1 new[] type_info::_name_internal_method 59010->59008 59011 7ffda33c4a10 memcpy_s 59010->59011 59011->59007 59017 7ffda33f0680 59011->59017 59014 7ffda33c6025 type_info::_name_internal_method 59013->59014 59015 7ffda33c6021 59013->59015 59016 7ffda33c602f HeapValidate 59014->59016 59015->59010 59016->59015 59018 7ffda33f0693 type_info::_name_internal_method 59017->59018 59019 7ffda33f0691 _dosmaperr 59017->59019 59020 7ffda33f069d RtlFreeHeap 59018->59020 59019->59007 59020->59019 59021 7ffda33f06b1 GetLastError 59020->59021 59021->59019

                      Executed Functions

                      Function 00007FFDA33A1720 Relevance: 312.8, APIs: 1, Strings: 177, Instructions: 1285COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 7ffda33a1720-7ffda33a2d0f call 7ffda338c700 call 7ffda338ac80 * 2 call 7ffda338c8b0 call 7ffda338ac80 call 7ffda338ca60 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda338cb70 call 7ffda338cd30 call 7ffda338afb0 * 2 call 7ffda338cf00 call 7ffda338afb0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338afb0 call 7ffda338e0b0 call 7ffda338afb0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338afb0 call 7ffda338abc0 call 7ffda338d0c0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338d1c0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338d2f0 call 7ffda338d390 call 7ffda338abc0 call 7ffda338d3d0 call 7ffda338abc0 call 7ffda338d470 call 7ffda338abc0 call 7ffda338d560 call 7ffda338ac80 call 7ffda338d6c0 call 7ffda338abc0 call 7ffda338d7b0 call 7ffda338d840 call 7ffda338ac80 call 7ffda338d9b0 call 7ffda338dd10 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338de60 call 7ffda338df00 call 7ffda338df60 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338e0b0 call 7ffda338e2a0 call 7ffda338ac80 call 7ffda338e320 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338e470 call 7ffda338ac80 call 7ffda338e5c0 call 7ffda338e5f0 call 7ffda338abc0 call 7ffda338e740 call 7ffda338abc0 call 7ffda338ac80 * 3 call 7ffda338e7e0 call 7ffda338e900 call 7ffda338abc0 call 7ffda338e940 call 7ffda338ac80 call 7ffda338e9a0 call 7ffda338ac80 call 7ffda338ebb0 call 7ffda338ac80 call 7ffda338ec50 call 7ffda338ac80 call 7ffda338ecb0 call 7ffda338ac80 call 7ffda338efc0 call 7ffda338f150 call 7ffda338ac80 call 7ffda338f1e0 call 7ffda338f210 call 7ffda338f2d0 call 7ffda338f310 call 7ffda338abc0 call 7ffda338ac80 * 3 call 7ffda338f3c0 call 7ffda338ac80 call 7ffda338f590 call 7ffda338ac80 call 7ffda338f840 call 7ffda338ac80 call 7ffda338f8e0 call 7ffda338f9f0 call 7ffda338ac80 call 7ffda338fb90 call 7ffda338fc40 call 7ffda338fe20 call 7ffda3390000 call 7ffda338abc0 call 7ffda33900a0 call 7ffda338abc0 call 7ffda33901d0 call 7ffda338ac80 call 7ffda338f1e0 call 7ffda338ac80 call 7ffda3390440 call 7ffda33905d0 call 7ffda338abc0 call 7ffda33906d0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33907b0 call 7ffda338ac80 * 2 call 7ffda33908c0 call 7ffda338ac80 call 7ffda3390990 call 7ffda338ac80 call 7ffda33909c0 call 7ffda3390b00 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3390b40 call 7ffda3390b70 call 7ffda338abc0 call 7ffda3390c10 call 7ffda3390c50 call 7ffda3391000 call 7ffda338ac80 call 7ffda3391060 call 7ffda3391170 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3391350 call 7ffda338ac80 call 7ffda3391530 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33918b0 call 7ffda3391ac0 call 7ffda3391c30 call 7ffda3391d90 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3391dd0 call 7ffda3391e00 call 7ffda338abc0 call 7ffda338ac80 * 3 call 7ffda3391e40 call 7ffda338abc0 call 7ffda33923d0 call 7ffda338ac80 * 2 call 7ffda33924e0 call 7ffda3392650 call 7ffda338ac80 * 2 call 7ffda3392920 call 7ffda33929f0 call 7ffda338ac80 call 7ffda338f1e0 call 7ffda338ac80 * 2 call 7ffda3392b80 call 7ffda338ac80 * 2 call 7ffda3392be0 call 7ffda338ac80 call 7ffda3392d10 call 7ffda338ac80 call 7ffda3392eb0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3392f90 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33930e0 call 7ffda338ac80 call 7ffda3393340 call 7ffda338ac80 call 7ffda3393490 call 7ffda338ac80 * 2 call 7ffda33934c0 call 7ffda33938d0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3393910 call 7ffda3393b80 call 7ffda338abc0 call 7ffda3393cd0 call 7ffda3393e90 call 7ffda3394000 call 7ffda338ac80 * 2 call 7ffda33940f0 call 7ffda338ac80 call 7ffda338f1e0 call 7ffda338ac80 call 7ffda3394150 call 7ffda338abc0 call 7ffda33941e0 call 7ffda338abc0 call 7ffda3394220 call 7ffda338abc0 call 7ffda3394260 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33942a0 call 7ffda338ac80 call 7ffda33942d0 call 7ffda338ac80 call 7ffda3394300 call 7ffda338ac80 * 2 call 7ffda3394330 call 7ffda338ac80 * 2 call 7ffda3394390 call 7ffda338ac80 call 7ffda3390b40 call 7ffda338ac80 * 2 call 7ffda33943f0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda33944a0 call 7ffda338abc0 call 7ffda3394550 call 7ffda338abc0 call 7ffda3394590 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33945d0 call 7ffda338ac80 * 3 call 7ffda3394600 call 7ffda3394670 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33946b0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3394740 call 7ffda33947a0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda33947e0 call 7ffda3394840 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3390b40 call 7ffda338ac80 * 2 call 7ffda3394880 call 7ffda338ac80 call 7ffda33948e0 call 7ffda338ac80 * 2 call 7ffda3394910 call 7ffda338ac80 * 2 call 7ffda3394970 call 7ffda33949d0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3394a10 call 7ffda338ac80 call 7ffda3394a70 call 7ffda3394aa0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3394ae0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3394b70 call 7ffda338ac80 call 7ffda3394ba0 call 7ffda338ac80 call 7ffda3394bd0 call 7ffda338ac80 call 7ffda3394c00 call 7ffda338ac80 call 7ffda3394c30 call 7ffda3394c60 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3394ca0 call 7ffda338ac80 call 7ffda3394cd0 call 7ffda338ac80 call 7ffda3394d10 call 7ffda338ac80 call 7ffda3394d40 call 7ffda338ac80 * 2 call 7ffda3394d70 call 7ffda338ac80 call 7ffda3394dd0 call 7ffda338ac80 call 7ffda3394e00 call 7ffda338ac80 call 7ffda3394e30 call 7ffda338abc0 call 7ffda338ac80 call 7ffda338f1e0 call 7ffda338ac80 * 2 call 7ffda3394ec0 call 7ffda338ac80 call 7ffda3394f20 call 7ffda3394f60 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3390b40 call 7ffda3394fa0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3394fe0 call 7ffda338ac80 call 7ffda3395010 call 7ffda338ac80 call 7ffda3395040 call 7ffda338ac80 call 7ffda3395070 call 7ffda338ac80 call 7ffda33950b0 call 7ffda338ac80 call 7ffda33950e0 call 7ffda338ac80 call 7ffda3395110 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33951a0 call 7ffda338ac80 * 2 call 7ffda33951d0 call 7ffda338ac80 call 7ffda3395230 call 7ffda338abc0 call 7ffda33952c0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3395300 call 7ffda338ac80 call 7ffda3390b40 call 7ffda338ac80 * 2 call 7ffda3395340 call 7ffda338ac80 * 2 call 7ffda33953a0 call 7ffda338ac80 call 7ffda3395400 call 7ffda338abc0 call 7ffda338ac80 * 3 call 7ffda3395490 call 7ffda3395500 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3395540 call 7ffda338abc0 call 7ffda33955d0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3395610 call 7ffda338ac80 call 7ffda3395670 call 7ffda338ac80 * 2 call 7ffda33956a0 call 7ffda3395700 call 7ffda338abc0 call 7ffda3395740 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3394300 call 7ffda3395780 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33957c0 call 7ffda33957f0 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3395830 call 7ffda338abc0 call 7ffda33958c0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3395900 call 7ffda3395960 call 7ffda338abc0 call 7ffda338ac80 call 7ffda33959a0 call 7ffda338ac80 call 7ffda33959d0 call 7ffda338abc0 call 7ffda338ac80 * 3 call 7ffda3395a60 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3395b30 call 7ffda3395b90 call 7ffda338abc0 call 7ffda3395bd0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3395c10 call 7ffda338ac80 call 7ffda3391dd0 call 7ffda338ac80 call 7ffda3395c70 call 7ffda338ac80 call 7ffda3395ca0 call 7ffda3395cd0 call 7ffda338abc0 call 7ffda338ac80 * 2 call 7ffda3395d10 call 7ffda338abc0 call 7ffda338ac80 call 7ffda3395dc0 call 7ffda338ac80 * 2 call 7ffda3394d70 call 7ffda338ac80 call 7ffda3395e00 call 7ffda33d16a0 903 7ffda33a2d15-7ffda33a2d41 call 7ffda33b9810 call 7ffda33c8680 0->903 904 7ffda33a2e42 0->904 906 7ffda33a2e48-7ffda33a2e60 903->906 910 7ffda33a2d47-7ffda33a2d5d call 7ffda33a1120 903->910 904->906 913 7ffda33a2da9-7ffda33a2df1 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33a8460 call 7ffda3399360 call 7ffda3399ad0 910->913 914 7ffda33a2d5f-7ffda33a2d6c call 7ffda338ad20 910->914 933 7ffda33a2e29-7ffda33a2e3b call 7ffda33a8460 call 7ffda339e730 913->933 934 7ffda33a2df3-7ffda33a2e24 call 7ffda33a5c10 913->934 920 7ffda33a2d7b-7ffda33a2d7e call 7ffda338a1f0 914->920 921 7ffda33a2d6e-7ffda33a2d79 call 7ffda338a260 914->921 926 7ffda33a2d83-7ffda33a2da5 920->926 921->926 926->913 939 7ffda33a2e40 933->939 934->933 939->906
                      APIs
                      Strings
                      • pOvfheLFbDH82lWZnxiYedXYXBVeUIhseRM5F42, xrefs: 00007FFDA33A2C66
                      • ekQJFacKuz8aiqMdWID7fkMYuGT3J8P7njGsZ5c1XBWP0FrTXplEVbWPGvSEaHcvw9fsa9BXTZL2gxkBsyj3JA2QxYGjURzVRMm5g60yvlySzF0AdgXSWjuYxbyko1mthqprg, xrefs: 00007FFDA33A1E76
                      • k6j9XXshNwzqTNbSdK3rauNOh8gsXwpNnQCIAiaP6U2TceoqRBPiFMIpgd7dcEjWF24pPZhR7ArPeCNFLYcdmFwSpW4BMXKVvE22PxfEDs37Ej9XL, xrefs: 00007FFDA33A2090
                      • sVcpCRlTfFHviR81KuU9CDqzFGNcHraD2Ea267m, xrefs: 00007FFDA33A1941
                      • E5DQCHQoETb8mgoWVjSguTgluJJq7321T53pPahx02uhrxAkZ4NST7VOzaShkqT3BTucK3bRj7pBla6Vlv4Re8QWoIDbY, xrefs: 00007FFDA33A1E89
                      • NdpLob23sWDobG9oEGQSgdQe5sVtywhGmZov39NJErD0uqJ2Bm0ZC8BcVRcbiTDwjINFvSMXg2oCyYQoAM5aLQGpE6G7UwZnR, xrefs: 00007FFDA33A2182
                      • F0cXEiZuRLwVSrjqqM6Eb8s8rVfJ1v2raktyeuTlzMBsufon5RJhUIZN05mRt84JW5usOxaPirp7PP8TRcYaZzkv7631yZHPpkDLfl5ZhHUZX94CjFD6P, xrefs: 00007FFDA33A2568
                      • hfOzS39SmbeI3NlGBYaDWREkAB5MAyDWRIqjto1TyMz12fUFwpfFuv6jYgDUTOTHp1hjuMBdhhfY2NR1ykY48Quc5JD9A5Jhv7fVXYAV, xrefs: 00007FFDA33A285B
                      • msgrRi0fq5FJoB5PH2OoKb9bqpn9aRPAleaURWxmf7rfBqo41lkWU70oYCCjM2VgUsi0yXc7kUwnbaXxwCmYQNO5fp9O71wGZzQnAjq, xrefs: 00007FFDA33A2668
                      • roGGh5d1caXGgVVora2QWLmSos20Q, xrefs: 00007FFDA33A1D08
                      • RxI0CgsSIvs756vdkscIukcEtvz6jr6TqhuquiXI2QtJreveRkmldKkaixq9V5JjsE8Y9kniGg21b, xrefs: 00007FFDA33A1C04
                      • zbOs38kuN2CZd9CZnf5TnA16yrfOmIQYQGf7tVOIrUK2PEXBFfmgEDfX1EmrnQWdFhZVeLJZt4mqmzfVcidKWok4GHShMyeazc43MWFDMMq0t, xrefs: 00007FFDA33A19C3
                      • ueWCBJtfM9CtGlfAQWKp7OGlEGim09GLVPxCG0NDTlU5W7dxemBR9EARdt0T5ABf84xJQkuzpLTwM0jWNweEj1ppTweMLbFr4UbpukWSGVi6BFL5GuIEDhxD, xrefs: 00007FFDA33A2B8C
                      • UvSdmdlUrHUuZGb, xrefs: 00007FFDA33A21E0
                      • ktmdOXyFepH5GuYBxwwpaK9TtBCO9hdNMi7ctIohoNnu3DAXNCFLkKuTwL5oEoowWQiT2NbivzaPUfs6tqG5O3T7jk51LNYjKAvpmchfun5jWVZxRWfgKGnNsdhDRqZtnPdML, xrefs: 00007FFDA33A1F5A
                      • BvF7JGKkRr5pSFO3TfPJgkd0RQBfJ3uZuKhyoOYRUeZnIKRpKGx9Yt7VKxNgD86WZz, xrefs: 00007FFDA33A1A5E
                      • mCjHXJkgCUv7LEkiS71ASaL3Q7gwWfa5HlmbQ, xrefs: 00007FFDA33A1FBE
                      • rDaCXx5a4godXbMUsOTvtUyZECIq0Vgy0nvpMSeyYxLkH8SPQi1xdnMRpH1ubqeBzn2Ze2aCyXKJl4YJ6ftC0jbfzRKEDSPVE8GVXutW3GoQCMJo63WZcPoEFmdbSh3GHKPg8XlKjmAa8, xrefs: 00007FFDA33A20D9
                      • O0sNIV6QqNFRdBmDXDx34taihYvOff0mZjoOlyRrll3Iln4UqvJlv0ou5OcFyE4devbnGr5pVFNC67X, xrefs: 00007FFDA33A216A
                      • Sgl1UDBL3Pv5TIk26iB0UXIdlObrhN7lNY3fl, xrefs: 00007FFDA33A2757
                      • VMPzYYCCCx9oVUq6RE5fas84dxGCzR3om1cQVG53UfF2M03JtS1eUyWqxDOM607U2lLECZOyamBcvJy7TQLY3hJUSqNLZnuQrmCIP0eZQUbf2C48nRUwiAB7i4XgilS1L9mXTIIY2hoJEce, xrefs: 00007FFDA33A241D
                      • xXU0qzm4D8QC, xrefs: 00007FFDA33A27F4
                      • TVSIupNpkVGJ9TpiU2qrlaF8rGwALPt1mah0UDrasAJscbmcBsnaXCsXkL5Jg2FsuUbkjhanE9FC6Jq5QvYH8MXZDLKohFwSbhHusTQwcvmxwt0QMYsx1sUiC5d925yHz4UTfNMuz94c5i, xrefs: 00007FFDA33A220E
                      • FeXN2K2N7CyNYVlXXVVqKKN4UOVLByzyEwdE3tlQixXrF471lLARii80f0jO8Robaay0gupM4rrOAKnmEFrW, xrefs: 00007FFDA33A2999
                      • mPKRirT0K3EdMH5oHucJvozhOEUp, xrefs: 00007FFDA33A2273
                      • H6iLt8bJxoGOrYrcBjQzVw1acyEPYNWP4oU0rAt3Ob7EBpAaco8qbVlALAztMzB1PSyaqVlzyk, xrefs: 00007FFDA33A273F
                      • vcVlOUB0YPAzvKp7IUu0NYyI37HatzyUF8gAiKdGtPxrGwOOMWXBG6Y0WOYbaL5vLQUA9faub7diNW8Xw9pVOU0t5mPtIk5ERTlFCGbmzQJfGAntZTrSftB, xrefs: 00007FFDA33A21F0
                      • q1OEm0y9ubVhPJCw4DuznBaBD83s2lyC1yUvjQqAAIODqrkI9sZ9zVjrtR3yYTlvxIDAU4RECuytbF1RH3LGl, xrefs: 00007FFDA33A26A5
                      • nU1tBlLFM2QYzoslsGK9U3lxRpJLG1y2T, xrefs: 00007FFDA33A2B49
                      • elVwZRDFh66mpgXn0kMwFaz0GlunWQPdrUnfeGWnrnRJa0clNDsb0KIDWwoLSY7n, xrefs: 00007FFDA33A1F4A
                      • EltQ5DTlsbxXQLXeUEkTPWT7o4f8j0sNYAofno3y8adrIcPYysiW, xrefs: 00007FFDA33A1741
                      • KpccYfHXySsJKXAdRXEOE9aD1O7BuNxLzWamUm7MEhqW3L7vI04hW8EJDCP7yflAqUCtDZYG5gadEOXmE8JMiq6Nrc95jjRpRyXe6EVb7hjt3foIeSW8dYcc3w3U0deVIf61bLIrv9, xrefs: 00007FFDA33A23D7
                      • ALRnkMG4u7ffJm2MKsWUxD9x3jV0mRlwud2, xrefs: 00007FFDA33A289B
                      • KuMoorqiPIWlh18IRg1IffCmi1qUeFziFzCOSE5yrbg5DY29ty0wiNf8aPTKwWyyC2Eo6J6HWZAx23ktBedCef4sAZonAMnhL9cI3bEyH4hvh0tHZBAJ, xrefs: 00007FFDA33A28E7
                      • RDs61tUsfj8wOlcYwbiQF2rHXICSDhBGKxg2iZUBtbnWfsqI61V0D78zM0pb9vFd6Zt8gmWOwyjQiv1qQXogL1HDQKnLduHegP1TszmS0CHKFay0FOTrDfM2T, xrefs: 00007FFDA33A2C0C
                      • yQkcFaqwMvsEVWl2wCetR8F3t2RNwog72BHNGLpT, xrefs: 00007FFDA33A1F0F
                      • CPikiQ2nTWk6WC9pHtcaYPJVQUE1cXllaXNvifwTiAAwMF60PnFInMLhm9aq7MyyPKx9lRteDLJM3bN7PNik0rtDZhm397vtn, xrefs: 00007FFDA33A1C51
                      • t76jpCmDv78a1xcJvG6YxvJ8eaoC6AAETDxP8wmPHqMiybNPubBci32VrJqQsuafZDUmjahZQD8ST20r7H, xrefs: 00007FFDA33A23A5
                      • Xk2idUFOEs5YTB4usavlwLRW6XteoPUffst5qTtBYqyDO5AxCrOozgeGoP6WU7dWgBMERXvKbCLUyW4zBO6FqsWzG6isopkZkPkFkAkZhqEKm4Lr1R7x3GjBKb7dpXIObde, xrefs: 00007FFDA33A1C34
                      • EV8BmYPEGSoNs8opMDfIiNsmcAfVAJMKPLinWW, xrefs: 00007FFDA33A21C2
                      • muuPTEApDj0qiqPqWNODf4KP36U7RVLWq, xrefs: 00007FFDA33A24FB
                      • w4rHmPhAVhKNTjo7w3A1STeA, xrefs: 00007FFDA33A1EDC
                      • JwKiTZRszn4fsiV7n2RkAG0Ah59yd6kFolZ49TRNjyAwtlZxekKd3rHPJBq1zLbChMVczTc8, xrefs: 00007FFDA33A1B57
                      • eOehgxWaukxZOPTwMonAcLEIJIGiguyIcwfXDTeJHZ3gj7tiKCQIzv4HD, xrefs: 00007FFDA33A21B2
                      • WhIsp3ChARiaRYsLUFFcpf54ELSvaMUkYyr8QIrPTGyhqsp1H8L1XvD0fxaVrwEpe7y1rSShcwp, xrefs: 00007FFDA33A1D36
                      • ZEed0lx42mERgV5eZmC21t73NyZ3j9eHeDxtS4EQUOUxTWZsgraeMvCE7XA3UjOtqU0mUmmMjvzQ2eX26MEHqY9RSK8fGvDZHagzTOjEU7O43mCXaRqztmtPSCDmNDcrNbAppVAIjT, xrefs: 00007FFDA33A2650
                      • ezDzEO2qQQsdgAThXPVxSQgiEA1e7KqSAvr71sq3dQoNXuO56KwuprHcko2UoiC9mT0W13ZEIfurK9JCmu4P8o7evKQaE4Uhpe3r84W7xW7VZjCC0aFR8kRcySguFBQx0lGXkg9s, xrefs: 00007FFDA33A2B9C
                      • ioiVZ8Dkhvkt38SUAJRM78x2rGDEWAuda6Q7nF, xrefs: 00007FFDA33A2355
                      • PIN7ij3ba1LttfnCyqf89cgDqGgtxnR2PV20jhiHauxuWG, xrefs: 00007FFDA33A2C3C
                      • IdljbgtDzy4ummdQzzjX1cOd97OizqRTyS46SamkPHYNCaQYegrMnnBwzydTP4vKxek9grosLLIl6, xrefs: 00007FFDA33A1771
                      • o7mFoFdV8iqG6QBwB9dKvAhvlCjIwrNKDk1m3BxiDRRApOHUcSfpPSumVGFYyXs40FZBga20Jk6xLZo33T9w1xYhI4naqLyxLdb4DiYjUD84hLVcRYLPLr1Lrtun4pJp5, xrefs: 00007FFDA33A1F32
                      • spiMy4RFOd, xrefs: 00007FFDA33A1751
                      • FtIRpAwFDdY6xifErwMIYeM3catNs0RoUlwqbIciVpZbjq8BPUS6ap3XIkuJQ7leCRVkmP9rSpG40cP66KkRM7j58Rv3nbleKWJ, xrefs: 00007FFDA33A210F
                      • MaOPnZDJtA13x8bU09D6SGx7DEnpD82Om2RbVRBKXCVHKbWnp1T4b4XnT8xmZNsfzYgKyznUeNuXe, xrefs: 00007FFDA33A29DF
                      • ItjfoBj5qf4jFMrWe57soUEkepSzXsIupJWWma665h3K2s2alUTv3B96LcbK5TalJa8wVT67, xrefs: 00007FFDA33A2BEE
                      • y1NwslQEzzphYhY44JgOOq4hfxLtp6OAu2NpyVx5HFVyLUXq2rKPWtQZKRm8VTDi8ZlLiDSpvJVVWmcW5Zds5zo07MuwFrAN6dThYqRQZqywGRMVkG6pSfMl, xrefs: 00007FFDA33A2BDE
                      • xJDxYadGfoMiprpiitKrxmRoSVdd8a8axVCPfzekIW24BZHnCY, xrefs: 00007FFDA33A1A76
                      • QQPDZg3MD5OF, xrefs: 00007FFDA33A1B6F
                      • dfUhBp8b6ByFPAbFuKzZP6pBtaO2SRg7PiiSuDJUaGD, xrefs: 00007FFDA33A268D
                      • RAPAZykQbBhS3Zf, xrefs: 00007FFDA33A2B39
                      • xcd4YKkqcN5qpGBOuhjvwvpUMxBxT57Nkc0wThREy7IfkTXU4Z3fBAj9s, xrefs: 00007FFDA33A1ECC
                      • BR5NIUYa3m3IpgvHfP2sAXMjPGO8umZXmU5QgmEx6pVPyxu8tjmFXpXWQx6c7ICavyAy8eyHGRRuudIIQXwnYWF9I0odAEww4SSzKXTNC54i78Q, xrefs: 00007FFDA33A2B14
                      • Qa7PiOmTUlesoxQBQO20zsG9h3XENpScO39oyIxeD5k5WtbRiJ3ddJCYi0f4JvPKwZJ, xrefs: 00007FFDA33A1FA6
                      • aEmasd9wAlwcWkP4VJo4focCnRDlJSdfybQeAXcA4tPMYn3QKQcB1WOo5RMym49wPTPu0MEkqztTQD8JzFo8rljlXwriOHAjGQpWvVM2KiUsqathQZgzl1tQMgY6gNvDWHQdzps, xrefs: 00007FFDA33A1B8C
                      • UoxxdjyWpMUlLKrJxp5ekAA6Jc4Nz0jJcfR79kZMK6NIrWE12fdQkGcSYUI8AAEsEatRgV4WeMKG8lef7ZJ7YAdNYwUgtXZ4BcSNJM, xrefs: 00007FFDA33A1DB1
                      • EnnhLak83LvKomVIYHhOX7USpzxD9k16wvLj3qq79BVgkvSa3Kh, xrefs: 00007FFDA33A2330
                      • rrLu4dCjqsQIUwX2oqygqdOvWIElpjAXHM2MjhdcrmgxqLL, xrefs: 00007FFDA33A2038
                      • mpS3iRdynB5iQebxlbXM385hzRoXhbalplisDLQU0jO4kwwacxSybK6HzzVbj, xrefs: 00007FFDA33A1F78
                      • zFUm8E06IgyfrGU4blURoV5lmHYl88MfLRffF7KuKGTVGQkXx, xrefs: 00007FFDA33A2787
                      • Ylp9LD7I39FpmIBCoxesfd1n20yzNmMX6CegsMIVqkEWSZUdUSyOEImxontuPOOfVdLyVOVuoX5M4vB2uVcWKI, xrefs: 00007FFDA33A29EF
                      • xEx6Egmoua6ItK5UFviFMTBST0NViGdUpHXkPL2jWWBane1hV4SlQrHEkHPzLD03bqlnjbNMFu, xrefs: 00007FFDA33A1E99
                      • gfffffff, xrefs: 00007FFDA33A2DFA
                      • m0mhgq9WbHwagF9IDEK3VvohOC0wekOC9Z2iVtsb5mHFbTmMGlkXKytmetduQ6M2FVX5qOhSLWYteW792f1fXDKXaLXppdBcL90r82ihvF6I43f9sewizOqC3ul17IU9NaywDXW58ke, xrefs: 00007FFDA33A2638
                      • OqLhJQnpKrzwWNMy47nVURlzEQOZTU5gkk9Bl5IBb7ZLluUKvmaF6AwPU1k0XJt4wRogMca4EKVfxWhgEmMsGJ82QLxhvSxxpFa9LkCrFF72XFvxUyqqpUho0AaSwOnskmQXmhlGywTQ6Bt7Fmn0Hz, xrefs: 00007FFDA33A1DDB
                      • eTy4V1AXxYk4d8K1UnP85C32zcnMUMegtBL8xXotTplUGCBY7ZtJ3RnJNBGxNgx2jmRFhYmdkCVIP, xrefs: 00007FFDA33A2520
                      • gvaMY4fYHcDBp5bDNyDpsGBPHUBmcQgMYturmGxOmLxgiefgDe208Uweo1HGYaa4EERsMK0lgdU0bujDz2tyMbUdt794GzwOKInS2WBAWFgOQJiF1RcgJIiwwAYyBaTvzipcO9Lpwqa5ozb3QtPe, xrefs: 00007FFDA33A1EFF
                      • rZIFyw2VD3aKzlvUkbzoSEngNcWi2rosz9WNVyklVnxrpGDunRKublCyb2ehtwB9qkwbXeEgFLIrYsZxcmB3kVhFjWx52YjE, xrefs: 00007FFDA33A279F
                      • hDjD6UVd43H3jHfu4E4tRAKly5g21oPViHbl8oYc3F96VGWQ5K65mqTwQpXQTGbMwDFMJTVbFu6hrnw8VzLnkS9xf0rZMrt31kDs3qmEyHvtqsHJqYXEMAFio91yqgZiu5XdMag, xrefs: 00007FFDA33A25C2
                      • eOzRfgFcOd4Hz6eTf, xrefs: 00007FFDA33A2580
                      • djV8jtCPfN2XSdF14UOlCItiVtTfp2Zd24q1KUwemQn6XhZEjU9isIhaTbDIn8Lf4d, xrefs: 00007FFDA33A2B5C
                      • eVqmgCVcQe9XpPNpgS2jJTd2S59QwVun7, xrefs: 00007FFDA33A22FD
                      • mKtKs1sgnF4rrRwbtjD5, xrefs: 00007FFDA33A2ABC
                      • xjSWQOKSmT8TSjNTvO8E9f945E0RL4cLk5GmKePGjnhmG0bQ6j8JJSdogsBQKv9kdaL3fOxjk0qI8NLdkA65deGC2WfaXASUvMBY3uGLaduxFoFc1BeWkfcNegidy7edZh9Z0Acahy, xrefs: 00007FFDA33A2060
                      • ooR1HoZWkNyLkKs7T3Sdk6MRM9kcqsGdx9UvM24bJxhYD0eYcyuUF40OOHHbMUHAT5w7NwxdFYqQ6m4ppriECGE3NjHOVPIX1OdtXQAHNheA6sAq48WceJilKAlr6pzrgkzXX6X, xrefs: 00007FFDA33A1BE3
                      • xaY6fpB24ufsFqkSB9OU3FNJV5spU6wi7gOs1ixqORAq8L0Yn4A10jTWMCUHBCCbsTZ8E, xrefs: 00007FFDA33A2020
                      • bVeuMLdZ9wJcPqUEyIJm72PZwLnmDKDX4uD61oBCGZgWGBuzxbsDF60Ou1uiIXIULN037X9M6TfEVWSmdcsj36lmW0hHC7pqra6PU3tQqAC9BhH41vTZrw4teoYodHha, xrefs: 00007FFDA33A1BC0
                      • EEJ6pCRi7vWo8SVmOvC1etdrjHRZUp5W09jQcjjE4q5PC2v4XP4EvK8dmZW8GYSeuyvGnbwYz1A4I8T, xrefs: 00007FFDA33A288B
                      • LWD4C09t2rwJV0svyiWiIAIg5TtzrixRTtBQIjAPOuJLFiXwhfXmCAkOvGLPT2TDngWYyD1sH, xrefs: 00007FFDA33A1838
                      • h8ETDhy4YBI2RbWuEtDg9, xrefs: 00007FFDA33A2873
                      • BnDDd6PUECDco3sQIBSzdiKVzXDiMnDLvURpFbdtna9Vfc4x, xrefs: 00007FFDA33A2CC9
                      • VQo1TOJ1xOp1oGKtP5D3cvcNCDxpVorBqYnwmcRDmaItK9EtbwnxFW, xrefs: 00007FFDA33A261A
                      • KzPk2xqmPw7IS1tlAN3rV5BdnSrbnIZLStwL2PobU8APQhnBdE5VKqwkBjoqCAoy51FS8A3LM2nHO0w4hwBV9CXYyqif9Emfd66PKqWHqF, xrefs: 00007FFDA33A24B3
                      • gwCphyyKw7Oo6MQkeSyTfJ7nLQ1SNYkWYlQCLUl2zhJxroxDj1pXgDdF5cvwwKaf0upzi9WZ5, xrefs: 00007FFDA33A2822
                      • CSFh1Zj3nxhJGvSHiRUrdWqYXUGyHuLzFswcEkLCIumxhHdcl5zwscTcNxmFkJxB1kFIrXgS9iofGODmZc81lxfe1YStcKQq7nDEkFq, xrefs: 00007FFDA33A23FF
                      • kJ80Bcv20jJTJxGddWCNDuPsty8z7xSxBLz, xrefs: 00007FFDA33A276F
                      • D2U12Qqw79O7TgqlChzCcxMcQT4SXuCByvGsU3LRbrXNGadiJkGWZUpQ2aTyuaa5EeYXa5nynZzQxRDEYpk4Z9Q6GU0ytYPdhSSR6cDfYMheizIEfEpw7rzJag3MRaFiKpGhF5bq, xrefs: 00007FFDA33A1D18
                      • z4Z69sRq1mBrayBBw1Irh0CDbukG03SP99sbSADSJapo3iVwDfqvmYCo4ZXz9AMCE1xue14yNdgfdKZr0OExudibRKukDhXN5QoHDBrgUfphOtuHfqFA4f, xrefs: 00007FFDA33A2050
                      • zX82hUIMfVd0tqZm9jUOd0bfTUfHu8t5zWsa24owOljsSaEg17LIpI5yc4CiK, xrefs: 00007FFDA33A1C1C
                      • za8gCtECI3Tk5uce9XM982CLo184nplRDYw6wOBWLBPduzga1kkHeTDtt9Wf7v2hjP4mdYAW2ZILPnDyoCSVA8h5ViMRoIfVp35i7rHr, xrefs: 00007FFDA33A290C
                      • ymN1ZzivQ2SAcJAgcaWmMw9yZv5pUOgW3zPKF982B6hriTSI5mGx3AXcMT7i3X7zUjhutrT4j6q9n8Wh3qYe6TK0PrYC58o64tdx2, xrefs: 00007FFDA33A25F2
                      • hmgHfedz43rdSdSwYGvm9KouHUMCmzl0vfWcSMBUuoY5VV2uvIru3x4optehX, xrefs: 00007FFDA33A1CF0
                      • nvTfqXpeRJiMxKBCzZVKgYCTQ9MQwTa5CdrYrArBSYLLxXJrVZcNEgqR0oXgi5zbhkTRsBWc4UcQ6r7QJayKOVNHcpz3D0lCJL04Gd2nDFuMRQpN9aSlOtCo99qs, xrefs: 00007FFDA33A292F
                      • cMg3LbsXQDVcJwWgHCgzs14ahuBVFDtrtnOBhLOjLijlJRtlrXjTnpmsqs0EGs6ye9WLVHPDVyM6tSm2khcJQE8k01kY0rf43DdWNY2n5UQb3XI47k9MFRSD7XnWMk6yqnFKlNGO30, xrefs: 00007FFDA33A17FE
                      • gHqj4WAA2Bx9J, xrefs: 00007FFDA33A24A3
                      • sUlQQ51zhdfOyXYm8Irs0OUG5UHdCo41PGseBoVlWmPFovRQmmSXdfipzW17ukAyyxwWBJAdYmL, xrefs: 00007FFDA33A1FE3
                      • IMt2yT8Lq2cA0EtwO, xrefs: 00007FFDA33A1B27
                      • EFeCvERIHvpQJvrOTHGIo0Zqv2iOiD2SaEpxATtDLugOuQ3AE2eJ9fPC546tb1OcZaKnycZsM2d8GddLxOFuJUb1OPVh4Ri7aIIKz0AzPHMn, xrefs: 00007FFDA33A1C9C
                      • su3GlNgIOQoS01yMN1x24eK5h3pUzM1qKvDnU9vSj06frV0GUQ07RM4vBQr8WLLe, xrefs: 00007FFDA33A2ACC
                      • Oc5kDyu92uXDxG8Ud6MiGE38MCQLVYudSLi45a61upgAAsjlvl2Bm4Vnr9CiTxxvHlJLUpcknzgJJqpYPfQwjXhukfZnnVuDm86rDr0MC, xrefs: 00007FFDA33A1A1C
                      • xANxV6QELncmHuSp7PJ, xrefs: 00007FFDA33A2CB9
                      • FHrMK4W8lIqRIBzzNkcbKFQCHaZALohj2HAO2LhWv0lxEJ7fe6pMVaIZ6tygnnaKUOro6HQaQrf0w054wWwWIRIMNuuCi9epPhMSOSHEOLLniDgMwiujlUh5gK2RGMLY5TH7zFbnnD52YkuGPkbCV0, xrefs: 00007FFDA33A2538
                      • Zzjc4e5WdcKtQVtYaHoXVzjLeeDMqSo, xrefs: 00007FFDA33A2236
                      • N3dpDiQwFNogaIA0d2M2uoL0tZbZug7AIVAJWIMcS6Ga7sjAOcjoFBywKOfe0S34u, xrefs: 00007FFDA33A2CA1
                      • ouBieozXjpNpoZn0T2zTioPU8q14tW9nqF3AmnK6414L2y2X7D3ZTIHRBET3bEj29pdKZtwTO4R8LnrtmPlf0yBEfavFM0qOd9DyCr, xrefs: 00007FFDA33A20C9
                      • QCrJcLb4NdJOmR6JNIyYy7uJ7yYQCDsHK5GVyaBMAxpOD4dBE7zE8RMhUOL1LFmETAGk2iDFX2nB53SHgFCysg0CHg2jKJqoUb2cBoHHm2jAYn1hBlHyiiaEtPBVSsFTEnZJ8seHH443Ga, xrefs: 00007FFDA33A24D1
                      • dAxg5XI0Qb9VNzuK89o2Q3kNaLnkVdfkGsLZjAyMJqLJLS, xrefs: 00007FFDA33A2435
                      • nIx72nnxBpexXT3ikI3qsDCDX, xrefs: 00007FFDA33A2AFC
                      • DfbKuEyuCX3CrurjEP9NbbVa39RJNXpArI59wh3lNYEPs9d3WDC5hEMC8kxk2wiKQGE0H7AfFp5GmQVBf4CoHJtNtIwnLxjaTodYrhbdG9lSO5rNYC8hCCRUiMZdBRAdLLtTilhDBgIV6ZQJDBSk, xrefs: 00007FFDA33A23EF
                      • at5haOICNAiRT7xz1G5L53cqlZOzVtB85cxtdWOWN3s3LjKJqa43Q0WOWrdbqNnx4hGBmCcEA, xrefs: 00007FFDA33A2463
                      • qzWywin7LxtVy3LxwIEguLGLNZs, xrefs: 00007FFDA33A1E4C
                      • KUuGvf641oMMMrHZSx2gz0J1Enfj1s8c00DXhHzySNrxRLA4Ud, xrefs: 00007FFDA33A2395
                      • C8Q9GcJSdxAQRtSvHnW63G21NFXd9xxpB3a5dVBxwHWIb3IcxAXVU, xrefs: 00007FFDA33A29C7
                      • FNocscYSPJq1PLUgu, xrefs: 00007FFDA33A1A39
                      • RqMjsrAzrsQCaNeIHln2fJUq9owtQDOqahgBGVxK, xrefs: 00007FFDA33A28C9
                      • ZCS3AsqIkSU9eFqCcqDT6BGp4KDmIve3SUHciBmed3dBXry6CqYLxZSykyXnVH98fmtDEIhnb9f1kXV8aUQsFDrGYm8PyB00Pwcn7iemh0iL6GiBAMM7J7WXChGsIjsefa, xrefs: 00007FFDA33A2C24
                      • WRQcvBNNVrIRpN6GsKJ5k0J8YIgskTlGtm7AsaifQVWJbwQGMDgQckjAOdF7xOOIlyRRVyxL47VNnXkeGTy3SNIWUUeYFJ40dE4bLmxR8cDj8PMwZkUiwdG3ECjA42, xrefs: 00007FFDA33A1AC2
                      • VFjV8HALcqu, xrefs: 00007FFDA33A1D78
                      • dValRzJgRZEsKy2Rkuuf3ieZYwH, xrefs: 00007FFDA33A1CB4
                      • piqtVuLKsksRlNy8eAzIyUW216auuAmD0PREzqeMbVWQ, xrefs: 00007FFDA33A29A9
                      • Ii07JKAVdpsghC6ISDDRmu6yg, xrefs: 00007FFDA33A18E8
                      • bUQmfMScXK5srKLsSjJUlEwnzZeUh581x6LsRh2tb4DZa5BPbsAExfZuc5yAfXe3Kklchr0LV3z5hT0uJ3knAyDpCpuWLvgCixGLB9oeG83JpzY3nLyhzrZ5c4c, xrefs: 00007FFDA33A1994
                      • KsMpdFxFIyw62jG2PptY1yUOx4BRbQDWew0rMzhugzNm4dCJmtTDP48K8SgzW9rznrb9r8wZ5DK1yQd897aqSwrUfKqxEGFOZRdchoWbMfnWKX7y8VDzJlZ1iX94LoJdlyzpVjg2X, xrefs: 00007FFDA33A2A31
                      • wMdLVYhycHqBRKiETxHMnbe1XlXSdL3HHksHNDdTqKrXlWj2pyr4xCUzZLahOrvX59nSjYQTu1a4rsjhe2G8QYY7uSq1oTXIIpCUyn1OPmu3YitKIFcfv5E5SzZxo48GMgqeJ6GDBdkbXXsga, xrefs: 00007FFDA33A20F7
                      • iyUvsEHF4fAafH6f84M, xrefs: 00007FFDA33A27DC
                      • MyRwIBV7rZ4, xrefs: 00007FFDA33A260A
                      • AK6wpAn1AN, xrefs: 00007FFDA33A2A5B
                      • vFTN5y0cSoIeM7dHhAfZhPYsV, xrefs: 00007FFDA33A2C76
                      • vUGcgFOyNkPcNVWvBm4uOp76IBC8kSMRZmlOGN1R5krL31ij1xTHABm3SEziyG, xrefs: 00007FFDA33A2CE7
                      • Ob2CxIc67JsEf9j4D5VzK0f5FvdHP, xrefs: 00007FFDA33A2962
                      • jnoIBkx75VWJkRxBO0YGILGcnAixsZt3, xrefs: 00007FFDA33A26D3
                      • Ga7EAURI2FYwynEWO7QwZR35tsnONt9F8NlFsQlnbAWNkKdB8zzMUhN7T71, xrefs: 00007FFDA33A19ED
                      • oEcAcdq9b0DVf6j2Se1h2VaS9S, xrefs: 00007FFDA33A1878
                      • hzx0de0hwDh0gPjSDfB7UBljAxN3OeOv7x035BfSum1dvvXSRmfG9FpYK7LkYIHSaJGFJo7yBTZNrk24Fsm3GwsZyEuZNco58bOlyNrY1suGDMOnW0yOMVH5nF, xrefs: 00007FFDA33A1B3F
                      • XdTyVqnOxpgMhkW9Wm6WoJV8yZAUcI1HpbqdaybtXPrmdaLLGITfiBhLX6I0aStmRHTbrkFaPptpxVal1aqkKPO2ad0FMhcvck73MsgmiLNTRv5IEfpm878xGF2HdwCMmvpkzLKdqrJWYh0OPyJ9ok, xrefs: 00007FFDA33A1D4E
                      • CFc7qtFEk5pVu8ZY, xrefs: 00007FFDA33A2226
                      • MXN11HorrSLPeux7IpwizaQ343iJuLRC19Za00nbYwZZ5sYm3cH3ABbRErL17lNMEcj1oap1WbpFJ5e08ZbLGz2Q3QWA7KXio8r3TWQAuO45tDXefUzmuWLmadiNDElgluaorJFFldNaSJAdmOCP0v, xrefs: 00007FFDA33A26B5
                      • xwJY6otIrxpp826mDz5MSqJDf42WlxEyV49byhipJ7ZXHFbSx7pBqKONApa1LpX5Hb, xrefs: 00007FFDA33A1798
                      • GEEoHmZyM4FTFhzThpSmcRm0nOPJfbJo2QmaCOjk1L4Y5rSvPnfFwybsNYQvMSAPzGyoJ1Ba93ZH2L7Plp2zvWETq9traz5IMJc9mUWWDjxzTcY2OWSEt8LeG1fE, xrefs: 00007FFDA33A1AD5
                      • ejWbQhUmf1HxilYcuFryoOxtbTSanIstlOvHnouB2KOKHelDulbDNHJ8cNMuP8M, xrefs: 00007FFDA33A22C2
                      • flVXadWlMtEJDtEda9yYi3aSsv4rkgcoeQZMjUowmBckYfXsCmZhIxJunjEjTNQPLgXTd9sGAS4h, xrefs: 00007FFDA33A2A85
                      • fjimmSqKFMtZrilP0lWIWrCkolIaGEpCDAjMSHlfD5SNztnsooDjxSzB, xrefs: 00007FFDA33A1AB2
                      • V4PYfcj3Po, xrefs: 00007FFDA33A1F88
                      • UiVG5h2Dk6c9SHhN5yeJVluQLxy, xrefs: 00007FFDA33A2550
                      • vS4Jto596phHQ1cSSUDQkcJHBRFxXlg3lxQjFN8FaOvfr1PacPhdzufmqnbfsCWxdHEYUAdNN25Z9nCWW1WyxEhEUd9GnzW6Qxxaz8gpTcX8mbVmpjK2cgEuIY8sMfoJ6RjCh5z0gTc3gpeo4ujIvN, xrefs: 00007FFDA33A1B0F
                      • br0uI7JOfkgwGQbufAvbZC4I, xrefs: 00007FFDA33A28B9
                      • laU6eWVaOdxL3L1lvO6mBpNJuoIqwvsyCP87VHj1eLf52sbrLB1dqbltsFkrlev057glXvhq96toE1zOHwDv1iX4uduaZf3qe8Zj, xrefs: 00007FFDA33A17CD
                      • CfG1vIH76heiGQRNj5AF30iKAAouhjEQ3fSSCphQqZNDcr, xrefs: 00007FFDA33A2473
                      • hSsCAeKKqWx1VRwbyzw6hfnXistTfQITHqLRBrYZQ2HA19zGlJN9Pq47bGMw9rpreRTnlboP, xrefs: 00007FFDA33A191C
                      • XYdJpnVTJC5zRgWtpC4hLQOJ2sqorOjv4Nvqe2KO, xrefs: 00007FFDA33A27B7
                      • EBsN8GNqMOKjq, xrefs: 00007FFDA33A26FD
                      • oIeyCoixadgzSeWqr14RvDBSIMXigelbW, xrefs: 00007FFDA33A1DF3
                      • mOtEPsyXuxpOnEMVDVmfmA5YPpmxf1570bWvKAMHjJFl7pgyjvcHl5NazFUtzONvYyq, xrefs: 00007FFDA33A18AC
                      • FJyghV0lgo9CHxpsgwLDlObLgs9szbaCzDTlUaVsA3Xh4isg5f0Lo4rz8Gq170tcgBidVA2TWfEvXgtQ0nZ7VRBJvVtMfUP3aS, xrefs: 00007FFDA33A22ED
                      • B0hy31X9iELwAhsEb9G5civCczgAidanWy8ZEHfSKbSEx4BS5Rh78Zi3aUubfHmS7NKbkmhnFbSAKpeWsscGqQQFjyZFpwswBh2RpjcYu3vNaJJ20Vt1Z6BlxwECyj4UTb4IAQfrhBnJ6bWsm, xrefs: 00007FFDA33A1BD0
                      • AcWprmxEtzNUAgv3Zxvk0DaTVSbEbI2jlOEbB7VOPEGVJA1zQDUp3BVVzMyt2uOGCP5cv0tjZTiJYDGBFtY6cHoxmL6jsgtLGsn4Xt8gn3qjjEy8TZRGd7Be5Bka45N0D9tbMogKjhlKUjHYe0, xrefs: 00007FFDA33A2804
                      • qErVHhr4Osmv1oIk6AHWrdbd9otAxGTH6U3sULZJX7xxzldUAUaegR5YfCEOwuzDG4fYzXM8RSs0YbbAubx0kCNB2ckIZYEHfBicjymnt7NomSeox, xrefs: 00007FFDA33A219A
                      • uQaj3xERxNFIly3zhlNKu0IudLtMQo, xrefs: 00007FFDA33A22DA
                      • nKGrDOrxWSczdooJl7sOPopImE8h5C2zINi5UT7t0OJErHhNfr8OZYcKpJ7jF21v5fZdIaV, xrefs: 00007FFDA33A25AA
                      • E446Pgu75s1H3i, xrefs: 00007FFDA33A2445
                      • XbJDpwePdiGw6WXA2cjgTgT3IcbS7r9vLOnLBo1gIQtgUdxlqJYmhuOkObNLOq886BPjrrHeqDABw3yzvY4GP3NUM0jxF4p0NEYayWXhmTTFpoUFATXJs5W01Jnj0ZeVc, xrefs: 00007FFDA33A25DA
                      • ZZYoJCsl8rS1PTaXXgTlf9bXzL2LvgHw2BEMSGoyJOFDXQMlTkHwr36MNdXtUGN3oylyKhAaJlKYbbmoneRajtMdMf5QO2lnXUAU4O10epWbqXrFUBhXibOFKUEvdjd8VJ4jWYcoxwhI, xrefs: 00007FFDA33A1E18
                      • HCbQj6xqvwxSk4fRh2kQxVWwCj8QTl6eahAXfBzOfTUT0Db13WdxXhTvKyCcpOy688hes5fZ4PTQRVsTRy, xrefs: 00007FFDA33A2008
                      • eiLBVvhh7mKwZes1DBz8xaCMOPuWuKtgR3qOMxgCycSkXU1kMz4, xrefs: 00007FFDA33A2263
                      • ZCZlchxpPRRamkH6NI, xrefs: 00007FFDA33A2727
                      • ac0c2OdmkvSLhRsTCcRLOApjdDjOAbymSPR9oz0LPr8bW9O9c7lGb9GJLIIeHh2UEvXHceeAbjhmNA1E2aoNLCCjYE5jBIXXZp7cui7gz71BlhF4588300Q7GSEk1q, xrefs: 00007FFDA33A2365
                      • NWi9SUmeAXnrVq4w5viXe1CZHGs62NusaV9lAbAPG8Kt1C3ZocVb9Nw9Z7N, xrefs: 00007FFDA33A291C
                      • r7RBKcnXAZVwqQ6ogYikzl4H3IyrEyL83AD8Hrq8YMErp66S3gFLA5AZ5ccdBIbcGL72mLjAiIhasB6TG4DMJdA3vXRUNBbp0nWEn1DRYhcZ4ExSTCMxD0bkhlr30ZTQ8eK2yZuEDV5N, xrefs: 00007FFDA33A17A8
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~__heap_allocnew[]
                      • String ID: AK6wpAn1AN$ALRnkMG4u7ffJm2MKsWUxD9x3jV0mRlwud2$AcWprmxEtzNUAgv3Zxvk0DaTVSbEbI2jlOEbB7VOPEGVJA1zQDUp3BVVzMyt2uOGCP5cv0tjZTiJYDGBFtY6cHoxmL6jsgtLGsn4Xt8gn3qjjEy8TZRGd7Be5Bka45N0D9tbMogKjhlKUjHYe0$B0hy31X9iELwAhsEb9G5civCczgAidanWy8ZEHfSKbSEx4BS5Rh78Zi3aUubfHmS7NKbkmhnFbSAKpeWsscGqQQFjyZFpwswBh2RpjcYu3vNaJJ20Vt1Z6BlxwECyj4UTb4IAQfrhBnJ6bWsm$BR5NIUYa3m3IpgvHfP2sAXMjPGO8umZXmU5QgmEx6pVPyxu8tjmFXpXWQx6c7ICavyAy8eyHGRRuudIIQXwnYWF9I0odAEww4SSzKXTNC54i78Q$BnDDd6PUECDco3sQIBSzdiKVzXDiMnDLvURpFbdtna9Vfc4x$BvF7JGKkRr5pSFO3TfPJgkd0RQBfJ3uZuKhyoOYRUeZnIKRpKGx9Yt7VKxNgD86WZz$C8Q9GcJSdxAQRtSvHnW63G21NFXd9xxpB3a5dVBxwHWIb3IcxAXVU$CFc7qtFEk5pVu8ZY$CPikiQ2nTWk6WC9pHtcaYPJVQUE1cXllaXNvifwTiAAwMF60PnFInMLhm9aq7MyyPKx9lRteDLJM3bN7PNik0rtDZhm397vtn$CSFh1Zj3nxhJGvSHiRUrdWqYXUGyHuLzFswcEkLCIumxhHdcl5zwscTcNxmFkJxB1kFIrXgS9iofGODmZc81lxfe1YStcKQq7nDEkFq$CfG1vIH76heiGQRNj5AF30iKAAouhjEQ3fSSCphQqZNDcr$D2U12Qqw79O7TgqlChzCcxMcQT4SXuCByvGsU3LRbrXNGadiJkGWZUpQ2aTyuaa5EeYXa5nynZzQxRDEYpk4Z9Q6GU0ytYPdhSSR6cDfYMheizIEfEpw7rzJag3MRaFiKpGhF5bq$DfbKuEyuCX3CrurjEP9NbbVa39RJNXpArI59wh3lNYEPs9d3WDC5hEMC8kxk2wiKQGE0H7AfFp5GmQVBf4CoHJtNtIwnLxjaTodYrhbdG9lSO5rNYC8hCCRUiMZdBRAdLLtTilhDBgIV6ZQJDBSk$E446Pgu75s1H3i$E5DQCHQoETb8mgoWVjSguTgluJJq7321T53pPahx02uhrxAkZ4NST7VOzaShkqT3BTucK3bRj7pBla6Vlv4Re8QWoIDbY$EBsN8GNqMOKjq$EEJ6pCRi7vWo8SVmOvC1etdrjHRZUp5W09jQcjjE4q5PC2v4XP4EvK8dmZW8GYSeuyvGnbwYz1A4I8T$EFeCvERIHvpQJvrOTHGIo0Zqv2iOiD2SaEpxATtDLugOuQ3AE2eJ9fPC546tb1OcZaKnycZsM2d8GddLxOFuJUb1OPVh4Ri7aIIKz0AzPHMn$EV8BmYPEGSoNs8opMDfIiNsmcAfVAJMKPLinWW$EltQ5DTlsbxXQLXeUEkTPWT7o4f8j0sNYAofno3y8adrIcPYysiW$EnnhLak83LvKomVIYHhOX7USpzxD9k16wvLj3qq79BVgkvSa3Kh$F0cXEiZuRLwVSrjqqM6Eb8s8rVfJ1v2raktyeuTlzMBsufon5RJhUIZN05mRt84JW5usOxaPirp7PP8TRcYaZzkv7631yZHPpkDLfl5ZhHUZX94CjFD6P$FHrMK4W8lIqRIBzzNkcbKFQCHaZALohj2HAO2LhWv0lxEJ7fe6pMVaIZ6tygnnaKUOro6HQaQrf0w054wWwWIRIMNuuCi9epPhMSOSHEOLLniDgMwiujlUh5gK2RGMLY5TH7zFbnnD52YkuGPkbCV0$FJyghV0lgo9CHxpsgwLDlObLgs9szbaCzDTlUaVsA3Xh4isg5f0Lo4rz8Gq170tcgBidVA2TWfEvXgtQ0nZ7VRBJvVtMfUP3aS$FNocscYSPJq1PLUgu$FeXN2K2N7CyNYVlXXVVqKKN4UOVLByzyEwdE3tlQixXrF471lLARii80f0jO8Robaay0gupM4rrOAKnmEFrW$FtIRpAwFDdY6xifErwMIYeM3catNs0RoUlwqbIciVpZbjq8BPUS6ap3XIkuJQ7leCRVkmP9rSpG40cP66KkRM7j58Rv3nbleKWJ$GEEoHmZyM4FTFhzThpSmcRm0nOPJfbJo2QmaCOjk1L4Y5rSvPnfFwybsNYQvMSAPzGyoJ1Ba93ZH2L7Plp2zvWETq9traz5IMJc9mUWWDjxzTcY2OWSEt8LeG1fE$Ga7EAURI2FYwynEWO7QwZR35tsnONt9F8NlFsQlnbAWNkKdB8zzMUhN7T71$H6iLt8bJxoGOrYrcBjQzVw1acyEPYNWP4oU0rAt3Ob7EBpAaco8qbVlALAztMzB1PSyaqVlzyk$HCbQj6xqvwxSk4fRh2kQxVWwCj8QTl6eahAXfBzOfTUT0Db13WdxXhTvKyCcpOy688hes5fZ4PTQRVsTRy$IMt2yT8Lq2cA0EtwO$IdljbgtDzy4ummdQzzjX1cOd97OizqRTyS46SamkPHYNCaQYegrMnnBwzydTP4vKxek9grosLLIl6$Ii07JKAVdpsghC6ISDDRmu6yg$ItjfoBj5qf4jFMrWe57soUEkepSzXsIupJWWma665h3K2s2alUTv3B96LcbK5TalJa8wVT67$JwKiTZRszn4fsiV7n2RkAG0Ah59yd6kFolZ49TRNjyAwtlZxekKd3rHPJBq1zLbChMVczTc8$KUuGvf641oMMMrHZSx2gz0J1Enfj1s8c00DXhHzySNrxRLA4Ud$KpccYfHXySsJKXAdRXEOE9aD1O7BuNxLzWamUm7MEhqW3L7vI04hW8EJDCP7yflAqUCtDZYG5gadEOXmE8JMiq6Nrc95jjRpRyXe6EVb7hjt3foIeSW8dYcc3w3U0deVIf61bLIrv9$KsMpdFxFIyw62jG2PptY1yUOx4BRbQDWew0rMzhugzNm4dCJmtTDP48K8SgzW9rznrb9r8wZ5DK1yQd897aqSwrUfKqxEGFOZRdchoWbMfnWKX7y8VDzJlZ1iX94LoJdlyzpVjg2X$KuMoorqiPIWlh18IRg1IffCmi1qUeFziFzCOSE5yrbg5DY29ty0wiNf8aPTKwWyyC2Eo6J6HWZAx23ktBedCef4sAZonAMnhL9cI3bEyH4hvh0tHZBAJ$KzPk2xqmPw7IS1tlAN3rV5BdnSrbnIZLStwL2PobU8APQhnBdE5VKqwkBjoqCAoy51FS8A3LM2nHO0w4hwBV9CXYyqif9Emfd66PKqWHqF$LWD4C09t2rwJV0svyiWiIAIg5TtzrixRTtBQIjAPOuJLFiXwhfXmCAkOvGLPT2TDngWYyD1sH$MXN11HorrSLPeux7IpwizaQ343iJuLRC19Za00nbYwZZ5sYm3cH3ABbRErL17lNMEcj1oap1WbpFJ5e08ZbLGz2Q3QWA7KXio8r3TWQAuO45tDXefUzmuWLmadiNDElgluaorJFFldNaSJAdmOCP0v$MaOPnZDJtA13x8bU09D6SGx7DEnpD82Om2RbVRBKXCVHKbWnp1T4b4XnT8xmZNsfzYgKyznUeNuXe$MyRwIBV7rZ4$N3dpDiQwFNogaIA0d2M2uoL0tZbZug7AIVAJWIMcS6Ga7sjAOcjoFBywKOfe0S34u$NWi9SUmeAXnrVq4w5viXe1CZHGs62NusaV9lAbAPG8Kt1C3ZocVb9Nw9Z7N$NdpLob23sWDobG9oEGQSgdQe5sVtywhGmZov39NJErD0uqJ2Bm0ZC8BcVRcbiTDwjINFvSMXg2oCyYQoAM5aLQGpE6G7UwZnR$O0sNIV6QqNFRdBmDXDx34taihYvOff0mZjoOlyRrll3Iln4UqvJlv0ou5OcFyE4devbnGr5pVFNC67X$Ob2CxIc67JsEf9j4D5VzK0f5FvdHP$Oc5kDyu92uXDxG8Ud6MiGE38MCQLVYudSLi45a61upgAAsjlvl2Bm4Vnr9CiTxxvHlJLUpcknzgJJqpYPfQwjXhukfZnnVuDm86rDr0MC$OqLhJQnpKrzwWNMy47nVURlzEQOZTU5gkk9Bl5IBb7ZLluUKvmaF6AwPU1k0XJt4wRogMca4EKVfxWhgEmMsGJ82QLxhvSxxpFa9LkCrFF72XFvxUyqqpUho0AaSwOnskmQXmhlGywTQ6Bt7Fmn0Hz$PIN7ij3ba1LttfnCyqf89cgDqGgtxnR2PV20jhiHauxuWG$QCrJcLb4NdJOmR6JNIyYy7uJ7yYQCDsHK5GVyaBMAxpOD4dBE7zE8RMhUOL1LFmETAGk2iDFX2nB53SHgFCysg0CHg2jKJqoUb2cBoHHm2jAYn1hBlHyiiaEtPBVSsFTEnZJ8seHH443Ga$QQPDZg3MD5OF$Qa7PiOmTUlesoxQBQO20zsG9h3XENpScO39oyIxeD5k5WtbRiJ3ddJCYi0f4JvPKwZJ$RAPAZykQbBhS3Zf$RDs61tUsfj8wOlcYwbiQF2rHXICSDhBGKxg2iZUBtbnWfsqI61V0D78zM0pb9vFd6Zt8gmWOwyjQiv1qQXogL1HDQKnLduHegP1TszmS0CHKFay0FOTrDfM2T$RqMjsrAzrsQCaNeIHln2fJUq9owtQDOqahgBGVxK$RxI0CgsSIvs756vdkscIukcEtvz6jr6TqhuquiXI2QtJreveRkmldKkaixq9V5JjsE8Y9kniGg21b$Sgl1UDBL3Pv5TIk26iB0UXIdlObrhN7lNY3fl$TVSIupNpkVGJ9TpiU2qrlaF8rGwALPt1mah0UDrasAJscbmcBsnaXCsXkL5Jg2FsuUbkjhanE9FC6Jq5QvYH8MXZDLKohFwSbhHusTQwcvmxwt0QMYsx1sUiC5d925yHz4UTfNMuz94c5i$UiVG5h2Dk6c9SHhN5yeJVluQLxy$UoxxdjyWpMUlLKrJxp5ekAA6Jc4Nz0jJcfR79kZMK6NIrWE12fdQkGcSYUI8AAEsEatRgV4WeMKG8lef7ZJ7YAdNYwUgtXZ4BcSNJM$UvSdmdlUrHUuZGb$V4PYfcj3Po$VFjV8HALcqu$VMPzYYCCCx9oVUq6RE5fas84dxGCzR3om1cQVG53UfF2M03JtS1eUyWqxDOM607U2lLECZOyamBcvJy7TQLY3hJUSqNLZnuQrmCIP0eZQUbf2C48nRUwiAB7i4XgilS1L9mXTIIY2hoJEce$VQo1TOJ1xOp1oGKtP5D3cvcNCDxpVorBqYnwmcRDmaItK9EtbwnxFW$WRQcvBNNVrIRpN6GsKJ5k0J8YIgskTlGtm7AsaifQVWJbwQGMDgQckjAOdF7xOOIlyRRVyxL47VNnXkeGTy3SNIWUUeYFJ40dE4bLmxR8cDj8PMwZkUiwdG3ECjA42$WhIsp3ChARiaRYsLUFFcpf54ELSvaMUkYyr8QIrPTGyhqsp1H8L1XvD0fxaVrwEpe7y1rSShcwp$XYdJpnVTJC5zRgWtpC4hLQOJ2sqorOjv4Nvqe2KO$XbJDpwePdiGw6WXA2cjgTgT3IcbS7r9vLOnLBo1gIQtgUdxlqJYmhuOkObNLOq886BPjrrHeqDABw3yzvY4GP3NUM0jxF4p0NEYayWXhmTTFpoUFATXJs5W01Jnj0ZeVc$XdTyVqnOxpgMhkW9Wm6WoJV8yZAUcI1HpbqdaybtXPrmdaLLGITfiBhLX6I0aStmRHTbrkFaPptpxVal1aqkKPO2ad0FMhcvck73MsgmiLNTRv5IEfpm878xGF2HdwCMmvpkzLKdqrJWYh0OPyJ9ok$Xk2idUFOEs5YTB4usavlwLRW6XteoPUffst5qTtBYqyDO5AxCrOozgeGoP6WU7dWgBMERXvKbCLUyW4zBO6FqsWzG6isopkZkPkFkAkZhqEKm4Lr1R7x3GjBKb7dpXIObde$Ylp9LD7I39FpmIBCoxesfd1n20yzNmMX6CegsMIVqkEWSZUdUSyOEImxontuPOOfVdLyVOVuoX5M4vB2uVcWKI$ZCS3AsqIkSU9eFqCcqDT6BGp4KDmIve3SUHciBmed3dBXry6CqYLxZSykyXnVH98fmtDEIhnb9f1kXV8aUQsFDrGYm8PyB00Pwcn7iemh0iL6GiBAMM7J7WXChGsIjsefa$ZCZlchxpPRRamkH6NI$ZEed0lx42mERgV5eZmC21t73NyZ3j9eHeDxtS4EQUOUxTWZsgraeMvCE7XA3UjOtqU0mUmmMjvzQ2eX26MEHqY9RSK8fGvDZHagzTOjEU7O43mCXaRqztmtPSCDmNDcrNbAppVAIjT$ZZYoJCsl8rS1PTaXXgTlf9bXzL2LvgHw2BEMSGoyJOFDXQMlTkHwr36MNdXtUGN3oylyKhAaJlKYbbmoneRajtMdMf5QO2lnXUAU4O10epWbqXrFUBhXibOFKUEvdjd8VJ4jWYcoxwhI$Zzjc4e5WdcKtQVtYaHoXVzjLeeDMqSo$aEmasd9wAlwcWkP4VJo4focCnRDlJSdfybQeAXcA4tPMYn3QKQcB1WOo5RMym49wPTPu0MEkqztTQD8JzFo8rljlXwriOHAjGQpWvVM2KiUsqathQZgzl1tQMgY6gNvDWHQdzps$ac0c2OdmkvSLhRsTCcRLOApjdDjOAbymSPR9oz0LPr8bW9O9c7lGb9GJLIIeHh2UEvXHceeAbjhmNA1E2aoNLCCjYE5jBIXXZp7cui7gz71BlhF4588300Q7GSEk1q$at5haOICNAiRT7xz1G5L53cqlZOzVtB85cxtdWOWN3s3LjKJqa43Q0WOWrdbqNnx4hGBmCcEA$bUQmfMScXK5srKLsSjJUlEwnzZeUh581x6LsRh2tb4DZa5BPbsAExfZuc5yAfXe3Kklchr0LV3z5hT0uJ3knAyDpCpuWLvgCixGLB9oeG83JpzY3nLyhzrZ5c4c$bVeuMLdZ9wJcPqUEyIJm72PZwLnmDKDX4uD61oBCGZgWGBuzxbsDF60Ou1uiIXIULN037X9M6TfEVWSmdcsj36lmW0hHC7pqra6PU3tQqAC9BhH41vTZrw4teoYodHha$br0uI7JOfkgwGQbufAvbZC4I$cMg3LbsXQDVcJwWgHCgzs14ahuBVFDtrtnOBhLOjLijlJRtlrXjTnpmsqs0EGs6ye9WLVHPDVyM6tSm2khcJQE8k01kY0rf43DdWNY2n5UQb3XI47k9MFRSD7XnWMk6yqnFKlNGO30$dAxg5XI0Qb9VNzuK89o2Q3kNaLnkVdfkGsLZjAyMJqLJLS$dValRzJgRZEsKy2Rkuuf3ieZYwH$dfUhBp8b6ByFPAbFuKzZP6pBtaO2SRg7PiiSuDJUaGD$djV8jtCPfN2XSdF14UOlCItiVtTfp2Zd24q1KUwemQn6XhZEjU9isIhaTbDIn8Lf4d$eOehgxWaukxZOPTwMonAcLEIJIGiguyIcwfXDTeJHZ3gj7tiKCQIzv4HD$eOzRfgFcOd4Hz6eTf$eTy4V1AXxYk4d8K1UnP85C32zcnMUMegtBL8xXotTplUGCBY7ZtJ3RnJNBGxNgx2jmRFhYmdkCVIP$eVqmgCVcQe9XpPNpgS2jJTd2S59QwVun7$eiLBVvhh7mKwZes1DBz8xaCMOPuWuKtgR3qOMxgCycSkXU1kMz4$ejWbQhUmf1HxilYcuFryoOxtbTSanIstlOvHnouB2KOKHelDulbDNHJ8cNMuP8M$ekQJFacKuz8aiqMdWID7fkMYuGT3J8P7njGsZ5c1XBWP0FrTXplEVbWPGvSEaHcvw9fsa9BXTZL2gxkBsyj3JA2QxYGjURzVRMm5g60yvlySzF0AdgXSWjuYxbyko1mthqprg$elVwZRDFh66mpgXn0kMwFaz0GlunWQPdrUnfeGWnrnRJa0clNDsb0KIDWwoLSY7n$ezDzEO2qQQsdgAThXPVxSQgiEA1e7KqSAvr71sq3dQoNXuO56KwuprHcko2UoiC9mT0W13ZEIfurK9JCmu4P8o7evKQaE4Uhpe3r84W7xW7VZjCC0aFR8kRcySguFBQx0lGXkg9s$fjimmSqKFMtZrilP0lWIWrCkolIaGEpCDAjMSHlfD5SNztnsooDjxSzB$flVXadWlMtEJDtEda9yYi3aSsv4rkgcoeQZMjUowmBckYfXsCmZhIxJunjEjTNQPLgXTd9sGAS4h$gHqj4WAA2Bx9J$gfffffff$gvaMY4fYHcDBp5bDNyDpsGBPHUBmcQgMYturmGxOmLxgiefgDe208Uweo1HGYaa4EERsMK0lgdU0bujDz2tyMbUdt794GzwOKInS2WBAWFgOQJiF1RcgJIiwwAYyBaTvzipcO9Lpwqa5ozb3QtPe$gwCphyyKw7Oo6MQkeSyTfJ7nLQ1SNYkWYlQCLUl2zhJxroxDj1pXgDdF5cvwwKaf0upzi9WZ5$h8ETDhy4YBI2RbWuEtDg9$hDjD6UVd43H3jHfu4E4tRAKly5g21oPViHbl8oYc3F96VGWQ5K65mqTwQpXQTGbMwDFMJTVbFu6hrnw8VzLnkS9xf0rZMrt31kDs3qmEyHvtqsHJqYXEMAFio91yqgZiu5XdMag$hSsCAeKKqWx1VRwbyzw6hfnXistTfQITHqLRBrYZQ2HA19zGlJN9Pq47bGMw9rpreRTnlboP$hfOzS39SmbeI3NlGBYaDWREkAB5MAyDWRIqjto1TyMz12fUFwpfFuv6jYgDUTOTHp1hjuMBdhhfY2NR1ykY48Quc5JD9A5Jhv7fVXYAV$hmgHfedz43rdSdSwYGvm9KouHUMCmzl0vfWcSMBUuoY5VV2uvIru3x4optehX$hzx0de0hwDh0gPjSDfB7UBljAxN3OeOv7x035BfSum1dvvXSRmfG9FpYK7LkYIHSaJGFJo7yBTZNrk24Fsm3GwsZyEuZNco58bOlyNrY1suGDMOnW0yOMVH5nF$ioiVZ8Dkhvkt38SUAJRM78x2rGDEWAuda6Q7nF$iyUvsEHF4fAafH6f84M$jnoIBkx75VWJkRxBO0YGILGcnAixsZt3$k6j9XXshNwzqTNbSdK3rauNOh8gsXwpNnQCIAiaP6U2TceoqRBPiFMIpgd7dcEjWF24pPZhR7ArPeCNFLYcdmFwSpW4BMXKVvE22PxfEDs37Ej9XL$kJ80Bcv20jJTJxGddWCNDuPsty8z7xSxBLz$ktmdOXyFepH5GuYBxwwpaK9TtBCO9hdNMi7ctIohoNnu3DAXNCFLkKuTwL5oEoowWQiT2NbivzaPUfs6tqG5O3T7jk51LNYjKAvpmchfun5jWVZxRWfgKGnNsdhDRqZtnPdML$laU6eWVaOdxL3L1lvO6mBpNJuoIqwvsyCP87VHj1eLf52sbrLB1dqbltsFkrlev057glXvhq96toE1zOHwDv1iX4uduaZf3qe8Zj$m0mhgq9WbHwagF9IDEK3VvohOC0wekOC9Z2iVtsb5mHFbTmMGlkXKytmetduQ6M2FVX5qOhSLWYteW792f1fXDKXaLXppdBcL90r82ihvF6I43f9sewizOqC3ul17IU9NaywDXW58ke$mCjHXJkgCUv7LEkiS71ASaL3Q7gwWfa5HlmbQ$mKtKs1sgnF4rrRwbtjD5$mOtEPsyXuxpOnEMVDVmfmA5YPpmxf1570bWvKAMHjJFl7pgyjvcHl5NazFUtzONvYyq$mPKRirT0K3EdMH5oHucJvozhOEUp$mpS3iRdynB5iQebxlbXM385hzRoXhbalplisDLQU0jO4kwwacxSybK6HzzVbj$msgrRi0fq5FJoB5PH2OoKb9bqpn9aRPAleaURWxmf7rfBqo41lkWU70oYCCjM2VgUsi0yXc7kUwnbaXxwCmYQNO5fp9O71wGZzQnAjq$muuPTEApDj0qiqPqWNODf4KP36U7RVLWq$nIx72nnxBpexXT3ikI3qsDCDX$nKGrDOrxWSczdooJl7sOPopImE8h5C2zINi5UT7t0OJErHhNfr8OZYcKpJ7jF21v5fZdIaV$nU1tBlLFM2QYzoslsGK9U3lxRpJLG1y2T$nvTfqXpeRJiMxKBCzZVKgYCTQ9MQwTa5CdrYrArBSYLLxXJrVZcNEgqR0oXgi5zbhkTRsBWc4UcQ6r7QJayKOVNHcpz3D0lCJL04Gd2nDFuMRQpN9aSlOtCo99qs$o7mFoFdV8iqG6QBwB9dKvAhvlCjIwrNKDk1m3BxiDRRApOHUcSfpPSumVGFYyXs40FZBga20Jk6xLZo33T9w1xYhI4naqLyxLdb4DiYjUD84hLVcRYLPLr1Lrtun4pJp5$oEcAcdq9b0DVf6j2Se1h2VaS9S$oIeyCoixadgzSeWqr14RvDBSIMXigelbW$ooR1HoZWkNyLkKs7T3Sdk6MRM9kcqsGdx9UvM24bJxhYD0eYcyuUF40OOHHbMUHAT5w7NwxdFYqQ6m4ppriECGE3NjHOVPIX1OdtXQAHNheA6sAq48WceJilKAlr6pzrgkzXX6X$ouBieozXjpNpoZn0T2zTioPU8q14tW9nqF3AmnK6414L2y2X7D3ZTIHRBET3bEj29pdKZtwTO4R8LnrtmPlf0yBEfavFM0qOd9DyCr$pOvfheLFbDH82lWZnxiYedXYXBVeUIhseRM5F42$piqtVuLKsksRlNy8eAzIyUW216auuAmD0PREzqeMbVWQ$q1OEm0y9ubVhPJCw4DuznBaBD83s2lyC1yUvjQqAAIODqrkI9sZ9zVjrtR3yYTlvxIDAU4RECuytbF1RH3LGl$qErVHhr4Osmv1oIk6AHWrdbd9otAxGTH6U3sULZJX7xxzldUAUaegR5YfCEOwuzDG4fYzXM8RSs0YbbAubx0kCNB2ckIZYEHfBicjymnt7NomSeox$qzWywin7LxtVy3LxwIEguLGLNZs$r7RBKcnXAZVwqQ6ogYikzl4H3IyrEyL83AD8Hrq8YMErp66S3gFLA5AZ5ccdBIbcGL72mLjAiIhasB6TG4DMJdA3vXRUNBbp0nWEn1DRYhcZ4ExSTCMxD0bkhlr30ZTQ8eK2yZuEDV5N$rDaCXx5a4godXbMUsOTvtUyZECIq0Vgy0nvpMSeyYxLkH8SPQi1xdnMRpH1ubqeBzn2Ze2aCyXKJl4YJ6ftC0jbfzRKEDSPVE8GVXutW3GoQCMJo63WZcPoEFmdbSh3GHKPg8XlKjmAa8$rZIFyw2VD3aKzlvUkbzoSEngNcWi2rosz9WNVyklVnxrpGDunRKublCyb2ehtwB9qkwbXeEgFLIrYsZxcmB3kVhFjWx52YjE$roGGh5d1caXGgVVora2QWLmSos20Q$rrLu4dCjqsQIUwX2oqygqdOvWIElpjAXHM2MjhdcrmgxqLL$sUlQQ51zhdfOyXYm8Irs0OUG5UHdCo41PGseBoVlWmPFovRQmmSXdfipzW17ukAyyxwWBJAdYmL$sVcpCRlTfFHviR81KuU9CDqzFGNcHraD2Ea267m$spiMy4RFOd$su3GlNgIOQoS01yMN1x24eK5h3pUzM1qKvDnU9vSj06frV0GUQ07RM4vBQr8WLLe$t76jpCmDv78a1xcJvG6YxvJ8eaoC6AAETDxP8wmPHqMiybNPubBci32VrJqQsuafZDUmjahZQD8ST20r7H$uQaj3xERxNFIly3zhlNKu0IudLtMQo$ueWCBJtfM9CtGlfAQWKp7OGlEGim09GLVPxCG0NDTlU5W7dxemBR9EARdt0T5ABf84xJQkuzpLTwM0jWNweEj1ppTweMLbFr4UbpukWSGVi6BFL5GuIEDhxD$vFTN5y0cSoIeM7dHhAfZhPYsV$vS4Jto596phHQ1cSSUDQkcJHBRFxXlg3lxQjFN8FaOvfr1PacPhdzufmqnbfsCWxdHEYUAdNN25Z9nCWW1WyxEhEUd9GnzW6Qxxaz8gpTcX8mbVmpjK2cgEuIY8sMfoJ6RjCh5z0gTc3gpeo4ujIvN$vUGcgFOyNkPcNVWvBm4uOp76IBC8kSMRZmlOGN1R5krL31ij1xTHABm3SEziyG$vcVlOUB0YPAzvKp7IUu0NYyI37HatzyUF8gAiKdGtPxrGwOOMWXBG6Y0WOYbaL5vLQUA9faub7diNW8Xw9pVOU0t5mPtIk5ERTlFCGbmzQJfGAntZTrSftB$w4rHmPhAVhKNTjo7w3A1STeA$wMdLVYhycHqBRKiETxHMnbe1XlXSdL3HHksHNDdTqKrXlWj2pyr4xCUzZLahOrvX59nSjYQTu1a4rsjhe2G8QYY7uSq1oTXIIpCUyn1OPmu3YitKIFcfv5E5SzZxo48GMgqeJ6GDBdkbXXsga$xANxV6QELncmHuSp7PJ$xEx6Egmoua6ItK5UFviFMTBST0NViGdUpHXkPL2jWWBane1hV4SlQrHEkHPzLD03bqlnjbNMFu$xJDxYadGfoMiprpiitKrxmRoSVdd8a8axVCPfzekIW24BZHnCY$xXU0qzm4D8QC$xaY6fpB24ufsFqkSB9OU3FNJV5spU6wi7gOs1ixqORAq8L0Yn4A10jTWMCUHBCCbsTZ8E$xcd4YKkqcN5qpGBOuhjvwvpUMxBxT57Nkc0wThREy7IfkTXU4Z3fBAj9s$xjSWQOKSmT8TSjNTvO8E9f945E0RL4cLk5GmKePGjnhmG0bQ6j8JJSdogsBQKv9kdaL3fOxjk0qI8NLdkA65deGC2WfaXASUvMBY3uGLaduxFoFc1BeWkfcNegidy7edZh9Z0Acahy$xwJY6otIrxpp826mDz5MSqJDf42WlxEyV49byhipJ7ZXHFbSx7pBqKONApa1LpX5Hb$y1NwslQEzzphYhY44JgOOq4hfxLtp6OAu2NpyVx5HFVyLUXq2rKPWtQZKRm8VTDi8ZlLiDSpvJVVWmcW5Zds5zo07MuwFrAN6dThYqRQZqywGRMVkG6pSfMl$yQkcFaqwMvsEVWl2wCetR8F3t2RNwog72BHNGLpT$ymN1ZzivQ2SAcJAgcaWmMw9yZv5pUOgW3zPKF982B6hriTSI5mGx3AXcMT7i3X7zUjhutrT4j6q9n8Wh3qYe6TK0PrYC58o64tdx2$z4Z69sRq1mBrayBBw1Irh0CDbukG03SP99sbSADSJapo3iVwDfqvmYCo4ZXz9AMCE1xue14yNdgfdKZr0OExudibRKukDhXN5QoHDBrgUfphOtuHfqFA4f$zFUm8E06IgyfrGU4blURoV5lmHYl88MfLRffF7KuKGTVGQkXx$zX82hUIMfVd0tqZm9jUOd0bfTUfHu8t5zWsa24owOljsSaEg17LIpI5yc4CiK$za8gCtECI3Tk5uce9XM982CLo184nplRDYw6wOBWLBPduzga1kkHeTDtt9Wf7v2hjP4mdYAW2ZILPnDyoCSVA8h5ViMRoIfVp35i7rHr$zbOs38kuN2CZd9CZnf5TnA16yrfOmIQYQGf7tVOIrUK2PEXBFfmgEDfX1EmrnQWdFhZVeLJZt4mqmzfVcidKWok4GHShMyeazc43MWFDMMq0t
                      • API String ID: 227004004-45517875
                      • Opcode ID: 1c4b96c31d85c26139e70a089bf661ce048b6f0b20b527040447f1b5c9caadac
                      • Instruction ID: 18dfdea1895cdaa261cebaa04f5bb8276e9c32489b774af8cbc078510fd7cd54
                      • Opcode Fuzzy Hash: 1c4b96c31d85c26139e70a089bf661ce048b6f0b20b527040447f1b5c9caadac
                      • Instruction Fuzzy Hash: C9E2CC51F1FD4296FA00FBA4D4710FD2336AF54788B804076E50DA679BEE6EE609C398
                      Function 00007FFDA339B8E0 Relevance: 158.1, APIs: 60, Strings: 29, Instructions: 2332networkCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException$Mtx_unlock$CurrentStartupThreadmtx_do_lock
                      • String ID: "You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: " "If a function argument is bound to a$"vector subscript out of range"$178.156.131.83$19045$By4gPS1jcAQaDgJ0$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$DDU5PQ==$DRI4Hh1FdDgVKyJYNw==$FwkIARQEB3gwIyM=$Gz4y$LAQBARdoagk=$NA4yMic=$NhUf$You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: If a function argument is bound to an rvalue reference parameter, the implementation may assume that this parameter is a unique reference to this argument, except that th$ZQ==$dA==$dQc=$dT5bWklWAmdifX9VPXNX$fw==$gfffffff$gfffffff$gfffffff$gfffffff$gfffffff$vector subscript out of range$yyy1
                      • API String ID: 1529169025-3096168647
                      • Opcode ID: 4c166ab7bc0393e30a9b03d934e34b898af4555327b1a2a9a69d15fd3ff672fc
                      • Instruction ID: a3799a80c9a2e44d1192ba42b77fa4e20b99ea00d1bf88212d236a996b67dc0c
                      • Opcode Fuzzy Hash: 4c166ab7bc0393e30a9b03d934e34b898af4555327b1a2a9a69d15fd3ff672fc
                      • Instruction Fuzzy Hash: 2A436331B0AEC689EB70EF64D8A02E92362FB45748F504535DA4D5B7ABDF3AD644C308
                      Function 00007FFDA339E730 Relevance: 119.4, APIs: 36, Strings: 31, Instructions: 2157libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyExceptionMtx_unlock$Lockitstd::_$AddressLibraryLockit::_Proc$LoadLockit::~_exit$CurrentExecuteFreeHandleModuleShellThreadclosesocketmtx_do_lock
                      • String ID: "null pointer cannot point to a block of non-zero size"$AAQBCAxScz84Kg4=$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Users\user\Desktop\dat5E54.dll.dll$CypM$DwQfAx1bBmR6KyNd$FhUBKh1DYzMmPCZeNw==$Fy4uJlh+ZnZxKw==$GwMyDydVag==$Gz4yMidoagk=$Gz4yMidoagkLEA==$JwwJ$JwwJMido$KhUJARQ=$LQwKMido$MAAeBhNeWTo=$MAAeBhNeWTp0YAkRdhQoKU0=$MAQAHVZDTSI=$YSUhITVyYR4bC2o=$YSc4ITRxfBoRAQ58HGE=$___$awJNHRFZUnY4ICxQNSwOHhlYGlt2Z29xETcxDU1LWFNQOnQ=$aydNQih+cXY=$clFd$clFf$dA==$dQ==$fFFf$null pointer cannot point to a block of non-zero size$vector subscript out of range
                      • API String ID: 1069402700-3411073733
                      • Opcode ID: 7b2f2a532ea4195091b29a550d6d9c2cbdfa6b8cc30d10e69e0f03d10a1057ee
                      • Instruction ID: 90733dc350bc10063cad523e11b8609cceabc1edea6930b57fb7efb6122b34da
                      • Opcode Fuzzy Hash: 7b2f2a532ea4195091b29a550d6d9c2cbdfa6b8cc30d10e69e0f03d10a1057ee
                      • Instruction Fuzzy Hash: 06336032B1EAC689E720EF64D8A06E96362FB41348F401535DA4D5BB9BDF7ED684C304
                      Function 00007FFDA33970C0 Relevance: 37.2, APIs: 10, Strings: 11, Instructions: 400libraryloaderfileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 3029 7ffda33970c0-7ffda339711a 3030 7ffda339711c 3029->3030 3031 7ffda339711f-7ffda33971b9 call 7ffda3396be0 call 7ffda338afb0 call 7ffda33a85f0 LoadLibraryA 3029->3031 3030->3031 3038 7ffda3397275 3031->3038 3039 7ffda33971bf-7ffda339722e call 7ffda338afb0 call 7ffda33a85f0 GetProcAddress 3031->3039 3041 7ffda339727b-7ffda33972ab call 7ffda338ad20 call 7ffda338b0a0 3038->3041 3049 7ffda3397240-7ffda3397249 FreeLibrary 3039->3049 3050 7ffda3397230-7ffda339723e 3039->3050 3051 7ffda33972d6-7ffda33973a6 call 7ffda33b9810 call 7ffda33b5270 * 2 3041->3051 3052 7ffda33972ad-7ffda33972d1 call 7ffda338afb0 3041->3052 3053 7ffda339724f-7ffda3397273 call 7ffda338ad20 call 7ffda338b0a0 3049->3053 3050->3053 3072 7ffda33973d5-7ffda33973e9 3051->3072 3073 7ffda33973a8-7ffda33973ce call 7ffda338b200 call 7ffda33b9810 3051->3073 3061 7ffda3397836-7ffda339787a call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33b4f10 3052->3061 3053->3041 3074 7ffda33973f0-7ffda3397407 3072->3074 3073->3072 3077 7ffda3397409-7ffda339742f call 7ffda33c15a0 3074->3077 3078 7ffda339745e-7ffda33974d4 call 7ffda338afb0 call 7ffda33a85f0 LoadLibraryA 3074->3078 3087 7ffda3397431 3077->3087 3088 7ffda3397432-7ffda3397457 call 7ffda33c1f80 3077->3088 3092 7ffda33974da-7ffda3397549 call 7ffda338afb0 call 7ffda33a85f0 GetProcAddress 3078->3092 3093 7ffda339759e 3078->3093 3087->3088 3088->3078 3104 7ffda339756b-7ffda3397574 FreeLibrary 3092->3104 3105 7ffda339754b-7ffda3397569 ReadFile 3092->3105 3096 7ffda33975a1-7ffda33975c8 call 7ffda338ad20 call 7ffda338b0a0 3093->3096 3106 7ffda33975ca-7ffda33975d6 3096->3106 3107 7ffda33975dc-7ffda3397616 call 7ffda3396d70 3096->3107 3108 7ffda3397575-7ffda339759c call 7ffda338ad20 call 7ffda338b0a0 3104->3108 3105->3108 3106->3074 3106->3107 3113 7ffda33976ab-7ffda33976d9 call 7ffda33b5270 3107->3113 3114 7ffda339761c 3107->3114 3108->3096 3123 7ffda33976db-7ffda33976ea call 7ffda338a260 3113->3123 3124 7ffda33976ec-7ffda33976f3 call 7ffda338a1f0 3113->3124 3117 7ffda3397623-7ffda3397629 3114->3117 3120 7ffda339762b-7ffda3397651 call 7ffda33c15a0 3117->3120 3121 7ffda3397680-7ffda3397696 call 7ffda338adf0 3117->3121 3133 7ffda3397653 3120->3133 3134 7ffda3397654-7ffda3397679 call 7ffda33c1f80 3120->3134 3121->3113 3130 7ffda3397698-7ffda33976a6 3121->3130 3132 7ffda33976f8-7ffda339773b call 7ffda338a1f0 3123->3132 3124->3132 3130->3117 3139 7ffda339773d-7ffda339775a call 7ffda338b0a0 3132->3139 3140 7ffda3397761-7ffda3397791 call 7ffda338b0a0 call 7ffda338a1f0 3132->3140 3133->3134 3134->3121 3139->3140 3147 7ffda3397806-7ffda3397835 call 7ffda338b0a0 3140->3147 3148 7ffda3397793-7ffda33977a0 3140->3148 3147->3061 3150 7ffda33977fb-7ffda3397801 call 7ffda338b0a0 3148->3150 3151 7ffda33977a2-7ffda33977a5 3148->3151 3150->3147 3151->3150 3153 7ffda33977a7-7ffda33977d3 call 7ffda33c15a0 3151->3153 3157 7ffda33977d5 3153->3157 3158 7ffda33977d6-7ffda33977f6 call 7ffda33c1f80 3153->3158 3157->3158 3158->3150
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressConcurrency::cancel_current_taskFreeLoadProc$FileRead_heap_alloc
                      • String ID: "null pointer cannot point to a block of non-zero size"$"vector subscript out of range"$AwQZKxFbUAU9NSo=$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$DwQfAx1bBmR6KyNd$FgQMCT5eWTM=$null pointer cannot point to a block of non-zero size$vector subscript out of range
                      • API String ID: 2269400828-2916814703
                      • Opcode ID: 718da0982c7a4da421be561eb1a6a37d4e196d7513459c9cc81a2883334ec51b
                      • Instruction ID: e74a989372df01e9a86a749a13c3c71feea4bcc0d1767acf8174cbdafed0a179
                      • Opcode Fuzzy Hash: 718da0982c7a4da421be561eb1a6a37d4e196d7513459c9cc81a2883334ec51b
                      • Instruction Fuzzy Hash: 5C227C22B0EEC285E770EF24D8606E923A2FB84348F505135DA4D5BB5ADF7EE684C744
                      Function 00007FFDA33980E0 Relevance: 23.5, APIs: 2, Strings: 11, Instructions: 747COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 3160 7ffda33980e0-7ffda3398197 call 7ffda33a4180 call 7ffda33b5270 call 7ffda3396490 * 2 3169 7ffda3398199-7ffda33981a8 call 7ffda33d18c0 call 7ffda33c37e0 3160->3169 3170 7ffda33981af-7ffda33981f0 call 7ffda33c37a0 call 7ffda3396a80 3160->3170 3169->3170 3179 7ffda33981f2-7ffda3398202 3170->3179 3180 7ffda3398261-7ffda3398276 call 7ffda33a7520 3170->3180 3182 7ffda3398207-7ffda339820e 3179->3182 3183 7ffda3398204 3179->3183 3187 7ffda3398279-7ffda339829d call 7ffda338abf0 call 7ffda338ad20 3180->3187 3185 7ffda3398226 3182->3185 3186 7ffda3398210-7ffda3398217 3182->3186 3183->3182 3189 7ffda3398229-7ffda339825f call 7ffda33b9120 * 3 3185->3189 3186->3185 3188 7ffda3398219-7ffda339821c 3186->3188 3199 7ffda33982af-7ffda33982b4 call 7ffda338a1f0 3187->3199 3200 7ffda339829f-7ffda33982ad call 7ffda338a260 3187->3200 3188->3189 3191 7ffda339821e-7ffda3398224 3188->3191 3189->3187 3191->3189 3206 7ffda33982b9-7ffda3398377 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338afb0 call 7ffda33a85f0 3199->3206 3200->3206 3219 7ffda33983e9-7ffda33983fe call 7ffda33a7520 3206->3219 3220 7ffda3398379-7ffda3398389 3206->3220 3228 7ffda3398401-7ffda3398428 call 7ffda338abf0 call 7ffda338ad20 3219->3228 3222 7ffda339838b 3220->3222 3223 7ffda339838e-7ffda3398395 3220->3223 3222->3223 3225 7ffda3398397-7ffda339839e 3223->3225 3226 7ffda33983b1 3223->3226 3225->3226 3229 7ffda33983a0-7ffda33983a3 3225->3229 3227 7ffda33983b4-7ffda33983e7 call 7ffda33b9120 * 3 3226->3227 3227->3228 3240 7ffda339843a-7ffda339843f call 7ffda338a1f0 3228->3240 3241 7ffda339842a-7ffda3398438 call 7ffda338a260 3228->3241 3232 7ffda33983a5-7ffda33983a7 3229->3232 3233 7ffda33983a9-7ffda33983af 3229->3233 3232->3227 3233->3227 3247 7ffda3398444-7ffda33984e5 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338afb0 call 7ffda33a85f0 3240->3247 3241->3247 3260 7ffda33984e7-7ffda33984f6 call 7ffda33d18c0 call 7ffda33c37e0 3247->3260 3261 7ffda33984fd-7ffda3398523 call 7ffda33c37a0 call 7ffda3396a80 3247->3261 3260->3261 3270 7ffda3398525-7ffda3398559 call 7ffda33c15a0 3261->3270 3271 7ffda3398581-7ffda3398653 call 7ffda33a6510 call 7ffda33a4bf0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33a4180 * 2 call 7ffda3396ec0 3261->3271 3277 7ffda339855c-7ffda339857c call 7ffda33c1f80 3270->3277 3278 7ffda339855b 3270->3278 3299 7ffda3398659-7ffda339869c call 7ffda338afb0 call 7ffda33a85f0 3271->3299 3300 7ffda3398bbe-7ffda3398bc8 3271->3300 3277->3271 3278->3277 3313 7ffda339869e-7ffda33986ac call 7ffda338ad20 3299->3313 3314 7ffda33986e4-7ffda3398769 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33a4bf0 call 7ffda338afb0 call 7ffda33a85f0 3299->3314 3302 7ffda3398bd0-7ffda3398c01 call 7ffda3396be0 3300->3302 3308 7ffda3398c21 call 7ffda3396d70 3302->3308 3309 7ffda3398c03-7ffda3398c09 3302->3309 3310 7ffda3398c26-7ffda3398c45 call 7ffda33a4180 call 7ffda33970c0 3308->3310 3309->3310 3311 7ffda3398c0b-7ffda3398c1f call 7ffda33a8460 3309->3311 3333 7ffda3398c47-7ffda3398c54 call 7ffda338ad20 3310->3333 3334 7ffda3398c8b-7ffda3398d4a call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33b4f10 3310->3334 3311->3302 3323 7ffda33986bc-7ffda33986bf call 7ffda338a1f0 3313->3323 3324 7ffda33986ae-7ffda33986ba call 7ffda338a260 3313->3324 3354 7ffda339876b 3314->3354 3355 7ffda339876e-7ffda33987af call 7ffda33a4bf0 call 7ffda338ad20 call 7ffda338b0a0 3314->3355 3332 7ffda33986c4-7ffda33986e0 3323->3332 3324->3332 3332->3314 3343 7ffda3398c56-7ffda3398c61 call 7ffda338a260 3333->3343 3344 7ffda3398c63-7ffda3398c66 call 7ffda338a1f0 3333->3344 3351 7ffda3398c6b-7ffda3398c87 3343->3351 3344->3351 3351->3334 3354->3355 3370 7ffda33987b5-7ffda33988a5 call 7ffda33a6790 call 7ffda33a4bf0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338afb0 call 7ffda33a85f0 call 7ffda33a4bf0 3355->3370 3371 7ffda3398d51-7ffda3398d56 call 7ffda338a2e0 3355->3371 3400 7ffda33988a7 3370->3400 3401 7ffda33988aa-7ffda33988b6 3370->3401 3378 7ffda3398d57-7ffda3398d5f call 7ffda338a2e0 3371->3378 3400->3401 3402 7ffda33988bc-7ffda33988c3 call 7ffda33b9c50 3401->3402 3403 7ffda3398a41-7ffda3398a89 call 7ffda338afb0 call 7ffda33a85f0 3401->3403 3402->3403 3409 7ffda33988c9-7ffda33988ff 3402->3409 3413 7ffda3398d4b-7ffda3398d50 call 7ffda338a2e0 3403->3413 3414 7ffda3398a8f-7ffda3398b91 call 7ffda33a6790 call 7ffda33a4bf0 call 7ffda338abf0 call 7ffda33a4bf0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33a4180 call 7ffda3397e20 call 7ffda338ad20 3403->3414 3409->3378 3411 7ffda3398905-7ffda3398940 call 7ffda33b5270 3409->3411 3419 7ffda3398952-7ffda339895c 3411->3419 3420 7ffda3398942-7ffda3398950 3411->3420 3413->3371 3457 7ffda3398b98-7ffda3398bb9 call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 3414->3457 3424 7ffda339895e-7ffda3398969 3419->3424 3425 7ffda339896d-7ffda339899b call 7ffda338b200 call 7ffda33b9120 3419->3425 3423 7ffda339899c-7ffda33989ee call 7ffda338afb0 call 7ffda33a85f0 3420->3423 3439 7ffda33989f0 3423->3439 3440 7ffda33989f3-7ffda3398a02 3423->3440 3424->3425 3425->3423 3439->3440 3441 7ffda3398a06-7ffda3398a0d 3440->3441 3441->3441 3443 7ffda3398a0f-7ffda3398a25 call 7ffda338afb0 call 7ffda33968d0 3441->3443 3451 7ffda3398a2a-7ffda3398a3c call 7ffda338ad20 3443->3451 3451->3457 3457->3300
                      APIs
                      Strings
                      • FwQZQD1PUDUhOyZeNxQOAQQbThUEMSIgRTwXCAoDHVMVewcsIEE8ZDEfAhtSRiV0YgleKycETUA7WFswPT0iC30iAAEeHQwRBgcLKlc4MQ0ZPRlFVDsxOypDDyUNGAgLFwh2FDRofiwwTCsEFFIPEzosIFUwKgZKTUUXEiMgKXcWJH9BT00=, xrefs: 00007FFDA3398673
                      • ZkERTTdCQXsSJiNUeWkEAw4XU1w4M28aZR98QU8=, xrefs: 00007FFDA3398740
                      • dUE=, xrefs: 00007FFDA3398A5A
                      • "You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: " "If a function argument is bound to a, xrefs: 00007FFDA3398575
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring, xrefs: 00007FFDA3398567
                      • NA4aCApEXTM4I2FUISE=, xrefs: 00007FFDA33989C1
                      • You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: If a function argument is bound to an rvalue reference parameter, the implementation may assume that this parameter is a unique reference to this argument, except that th, xrefs: 00007FFDA3398525
                      • dUEdAg9SRyU8KiNddyEZCE0=, xrefs: 00007FFDA3398848
                      • ahUVGQ==, xrefs: 00007FFDA3398332
                      • ahEeXA==, xrefs: 00007FFDA33984BC
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring, xrefs: 00007FFDA3398546
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLockitstd::_$AddressFreeLoadLockit::_Lockit::~_Proc__vcrt_getptd_heap_allocdelete
                      • String ID: "You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: " "If a function argument is bound to a$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$FwQZQD1PUDUhOyZeNxQOAQQbThUEMSIgRTwXCAoDHVMVewcsIEE8ZDEfAhtSRiV0YgleKycETUA7WFswPT0iC30iAAEeHQwRBgcLKlc4MQ0ZPRlFVDsxOypDDyUNGAgLFwh2FDRofiwwTCsEFFIPEzosIFUwKgZKTUUXEiMgKXcWJH9BT00=$NA4aCApEXTM4I2FUISE=$You cannot concatenate the same moved string to itself. See N4950 [res.on.arguments]/1.3: If a function argument is bound to an rvalue reference parameter, the implementation may assume that this parameter is a unique reference to this argument, except that th$ZkERTTdCQXsSJiNUeWkEAw4XU1w4M28aZR98QU8=$ahEeXA==$ahUVGQ==$dUE=$dUEdAg9SRyU8KiNddyEZCE0=
                      • API String ID: 3296537014-2181890029
                      • Opcode ID: 0db56ca923643c5c4c94130aa899c7fcef1caf84b8496cbafb545f3e93e6f392
                      • Instruction ID: 75374d0b6718ff7ecdb215cfb77ac3fd62c8c30476dd5c6b21c7bf98750850a5
                      • Opcode Fuzzy Hash: 0db56ca923643c5c4c94130aa899c7fcef1caf84b8496cbafb545f3e93e6f392
                      • Instruction Fuzzy Hash: 4A729422B0DB8686E710EF64E4602ED6762FB80388F501531EA4D67B9BDF7EE584C344
                      Function 00007FFDA33C44B1 Relevance: 17.9, Strings: 14, Instructions: 414COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 3469 7ffda33c44b1-7ffda33c44ba 3470 7ffda33c44bc 3469->3470 3471 7ffda33c44c1-7ffda33c44c9 3469->3471 3472 7ffda33c4c06-7ffda33c4c0d 3470->3472 3473 7ffda33c44cb-7ffda33c44dd call 7ffda33c5220 3471->3473 3474 7ffda33c4522-7ffda33c452a 3471->3474 3473->3474 3481 7ffda33c44df-7ffda33c450d call 7ffda33c15a0 3473->3481 3476 7ffda33c4530-7ffda33c458e 3474->3476 3477 7ffda33c45c4-7ffda33c45d3 call 7ffda33c6010 3474->3477 3476->3477 3483 7ffda33c4590-7ffda33c45ba call 7ffda33c15a0 3476->3483 3485 7ffda33c45d5-7ffda33c460a call 7ffda33c1620 3477->3485 3486 7ffda33c460f-7ffda33c4633 call 7ffda33c4c10 call 7ffda33c5260 3477->3486 3493 7ffda33c450f-7ffda33c4510 3481->3493 3494 7ffda33c4512-7ffda33c451d call 7ffda33c39f0 3481->3494 3497 7ffda33c45bc-7ffda33c45bd 3483->3497 3498 7ffda33c45bf 3483->3498 3485->3486 3500 7ffda33c460c-7ffda33c460d 3485->3500 3503 7ffda33c4635-7ffda33c466a call 7ffda33c1620 3486->3503 3504 7ffda33c466f-7ffda33c467a 3486->3504 3493->3494 3494->3472 3497->3498 3498->3472 3500->3486 3503->3504 3512 7ffda33c466c-7ffda33c466d 3503->3512 3506 7ffda33c4980-7ffda33c4989 3504->3506 3507 7ffda33c4680-7ffda33c469e call 7ffda33c3fa0 3504->3507 3510 7ffda33c4a10-7ffda33c4a1f 3506->3510 3511 7ffda33c498f-7ffda33c499b 3506->3511 3523 7ffda33c47fb-7ffda33c4823 call 7ffda33c3a20 call 7ffda33c3fa0 3507->3523 3524 7ffda33c46a4-7ffda33c46ae 3507->3524 3513 7ffda33c4a70-7ffda33c4a98 3510->3513 3514 7ffda33c4a21-7ffda33c4a2a 3510->3514 3516 7ffda33c49a8-7ffda33c49dd call 7ffda33c1620 3511->3516 3517 7ffda33c499d-7ffda33c49a6 3511->3517 3512->3504 3518 7ffda33c4bbc-7ffda33c4c05 call 7ffda33c3a20 call 7ffda33b9810 3513->3518 3519 7ffda33c4a9e-7ffda33c4aa7 3513->3519 3521 7ffda33c4a36-7ffda33c4a6b call 7ffda33c1620 3514->3521 3522 7ffda33c4a2c-7ffda33c4a34 3514->3522 3525 7ffda33c49e2-7ffda33c4a0b call 7ffda33b9810 call 7ffda33f0680 3516->3525 3536 7ffda33c49df-7ffda33c49e0 3516->3536 3517->3516 3517->3525 3518->3472 3526 7ffda33c4aa9-7ffda33c4abe 3519->3526 3527 7ffda33c4ac0-7ffda33c4acc 3519->3527 3521->3513 3552 7ffda33c4a6d-7ffda33c4a6e 3521->3552 3522->3513 3522->3521 3523->3506 3568 7ffda33c4829-7ffda33c4833 3523->3568 3533 7ffda33c46b4-7ffda33c4769 call 7ffda33c3a20 call 7ffda33c15a0 3524->3533 3534 7ffda33c4773-7ffda33c47f6 call 7ffda33c3a20 call 7ffda33c15a0 3524->3534 3525->3472 3535 7ffda33c4b18-7ffda33c4b22 3526->3535 3537 7ffda33c4b08-7ffda33c4b11 3527->3537 3538 7ffda33c4ace-7ffda33c4b03 call 7ffda33c1620 3527->3538 3569 7ffda33c476b-7ffda33c476c 3533->3569 3570 7ffda33c476e 3533->3570 3534->3523 3572 7ffda33c47f8-7ffda33c47f9 3534->3572 3549 7ffda33c4b3a-7ffda33c4b46 3535->3549 3550 7ffda33c4b24-7ffda33c4b38 3535->3550 3536->3525 3537->3535 3538->3537 3565 7ffda33c4b05-7ffda33c4b06 3538->3565 3559 7ffda33c4b48-7ffda33c4b7d call 7ffda33c1620 3549->3559 3560 7ffda33c4b82-7ffda33c4b8a 3549->3560 3558 7ffda33c4b91-7ffda33c4bb5 call 7ffda33b9810 call 7ffda33f0680 3550->3558 3552->3513 3581 7ffda33c4bba 3558->3581 3559->3560 3579 7ffda33c4b7f-7ffda33c4b80 3559->3579 3560->3558 3565->3537 3574 7ffda33c48f8-7ffda33c497b call 7ffda33c3a20 call 7ffda33c15a0 3568->3574 3575 7ffda33c4839-7ffda33c48ee call 7ffda33c3a20 call 7ffda33c15a0 3568->3575 3569->3570 3570->3523 3572->3523 3574->3506 3589 7ffda33c497d-7ffda33c497e 3574->3589 3587 7ffda33c48f0-7ffda33c48f1 3575->3587 3588 7ffda33c48f3 3575->3588 3579->3560 3581->3472 3587->3588 3588->3506 3589->3506
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_CrtIsValidHeapPointer(block)$__acrt_first_block == header$__acrt_last_block == header$header->_block_use == block_use || header->_block_use == _CRT_BLOCK && block_use == _NORMAL_BLOCK$header->_line_number == line_number_for_ignore_blocks && header->_request_number == request_number_for_ignore_blocks$is_block_type_valid(header->_block_use)$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp
                      • API String ID: 0-3956125450
                      • Opcode ID: 04c3127c5ccb3e0e910b98b0128e8a1ff7397646b3e1f31c3c47c146ae34c2b1
                      • Instruction ID: 40c8d536c53c252f6f0aeb46a5b30045719564da05dfa1b312ca5c4c6850d493
                      • Opcode Fuzzy Hash: 04c3127c5ccb3e0e910b98b0128e8a1ff7397646b3e1f31c3c47c146ae34c2b1
                      • Instruction Fuzzy Hash: 56226136B0EF4586E760DB59E49136AB3A5FB88790F000036EA8D93B66DF7ED454CB04
                      Function 00007FFDA33C4CC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 228memoryCOMMONLIBRARYCODE
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 3672 7ffda33c4cc0-7ffda33c4d01 call 7ffda33d1950 call 7ffda33c5d20 3677 7ffda33c4d10-7ffda33c4d18 3672->3677 3678 7ffda33c4d03-7ffda33c4d0d 3672->3678 3680 7ffda33c4e00-7ffda33c4e0f 3677->3680 3681 7ffda33c4d1e-7ffda33c4d82 3677->3681 3678->3677 3679 7ffda33c4d0f 3678->3679 3679->3677 3682 7ffda33c4e25 3680->3682 3683 7ffda33c4e11-7ffda33c4e1c 3680->3683 3681->3680 3689 7ffda33c4d84-7ffda33c4d8d 3681->3689 3685 7ffda33c4e2a-7ffda33c4e3c 3682->3685 3683->3682 3684 7ffda33c4e1e-7ffda33c4e23 3683->3684 3684->3685 3687 7ffda33c4e60-7ffda33c4e71 call 7ffda33c5260 3685->3687 3688 7ffda33c4e3e-7ffda33c4e4e call 7ffda33c39f0 3685->3688 3698 7ffda33c4ea5-7ffda33c4edb HeapAlloc 3687->3698 3699 7ffda33c4e73-7ffda33c4ea0 call 7ffda33c15a0 3687->3699 3701 7ffda33c4e5b 3688->3701 3702 7ffda33c4e50-7ffda33c4e55 3688->3702 3692 7ffda33c4dcc-7ffda33c4df6 call 7ffda33c15a0 3689->3692 3693 7ffda33c4d8f-7ffda33c4dc5 call 7ffda33c15a0 3689->3693 3706 7ffda33c4df8-7ffda33c4df9 3692->3706 3707 7ffda33c4dfb 3692->3707 3710 7ffda33c4dc7-7ffda33c4dc8 3693->3710 3711 7ffda33c4dca 3693->3711 3708 7ffda33c4eff-7ffda33c4f14 3698->3708 3709 7ffda33c4edd-7ffda33c4eed call 7ffda33c39f0 3698->3709 3699->3698 3719 7ffda33c4ea2-7ffda33c4ea3 3699->3719 3704 7ffda33c50fc-7ffda33c510f call 7ffda33d19e0 3701->3704 3702->3701 3706->3707 3707->3704 3715 7ffda33c4f76-7ffda33c4f8c 3708->3715 3716 7ffda33c4f16-7ffda33c4f71 3708->3716 3725 7ffda33c4efa 3709->3725 3726 7ffda33c4eef-7ffda33c4ef4 3709->3726 3710->3711 3711->3707 3717 7ffda33c4fac 3715->3717 3718 7ffda33c4f8e-7ffda33c4faa 3715->3718 3722 7ffda33c508d-7ffda33c50f7 call 7ffda33b9810 call 7ffda33c3a20 call 7ffda33b9810 call 7ffda33c3a20 call 7ffda33b9810 call 7ffda33c3a20 3716->3722 3723 7ffda33c4fb7-7ffda33c4fe1 3717->3723 3718->3723 3719->3698 3722->3704 3727 7ffda33c4fe3-7ffda33c4fea 3723->3727 3728 7ffda33c4ff1-7ffda33c4ff9 3723->3728 3725->3704 3726->3725 3727->3728 3730 7ffda33c4ffb-7ffda33c500b 3728->3730 3731 7ffda33c500d-7ffda33c5012 3728->3731 3733 7ffda33c5019-7ffda33c5086 3730->3733 3731->3733 3733->3722
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock$AllocCriticalEnterHeapSection
                      • String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.
                      • API String ID: 3996555514-2973468218
                      • Opcode ID: 9eec8e6e2a025aa0dec23a20c95f9d83e12799d972d10009c5d33cd90d0f8dcf
                      • Instruction ID: a07534cb6206819bc5bcd277bb2078d09e6d17e662bcba9487f0c8b0782fa04a
                      • Opcode Fuzzy Hash: 9eec8e6e2a025aa0dec23a20c95f9d83e12799d972d10009c5d33cd90d0f8dcf
                      • Instruction Fuzzy Hash: 85C14F32B0EB8585E721DB19F46132A77A2FB85790F104135DA9D93BAACF3ED444CB04
                      Function 00007FFDA339AE20 Relevance: 39.5, APIs: 26, Instructions: 542networkCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 2809 7ffda339ae20-7ffda339ae6b call 7ffda33aeda0 2812 7ffda339b5b2-7ffda339b5bc call 7ffda33adaa0 2809->2812 2813 7ffda339ae71-7ffda339ae7b 2809->2813 2814 7ffda339b5bd-7ffda339b5d1 call 7ffda33adaa0 2812->2814 2813->2814 2815 7ffda339ae81-7ffda339ae96 2813->2815 2819 7ffda339b5ac-7ffda339b5b1 call 7ffda338a2e0 2815->2819 2820 7ffda339ae9c-7ffda339aea5 2815->2820 2819->2812 2823 7ffda339aea7 2820->2823 2824 7ffda339aeaa-7ffda339aeda call 7ffda33a6790 2820->2824 2823->2824 2828 7ffda339aee0-7ffda339aee2 2824->2828 2829 7ffda339b521-7ffda339b54a send 2824->2829 2828->2829 2830 7ffda339aee8-7ffda339af43 call 7ffda33a4180 call 7ffda33962a0 call 7ffda33b5270 2828->2830 2831 7ffda339b54b-7ffda339b5ab call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33aedc0 call 7ffda338ad20 call 7ffda338b0a0 call 7ffda33b4f10 2829->2831 2845 7ffda339afa6-7ffda339afb4 call 7ffda33a72d0 2830->2845 2846 7ffda339af45-7ffda339af68 call 7ffda33ad210 2830->2846 2854 7ffda339afb8-7ffda339afc1 2845->2854 2855 7ffda339af6a 2846->2855 2856 7ffda339af90-7ffda339afa4 call 7ffda33ad2f0 2846->2856 2859 7ffda339b01e-7ffda339b02c call 7ffda33a72d0 2854->2859 2860 7ffda339afc3-7ffda339afe6 call 7ffda33ad210 2854->2860 2861 7ffda339af70-7ffda339af74 2855->2861 2856->2854 2872 7ffda339b030-7ffda339b051 2859->2872 2873 7ffda339b008-7ffda339b01c call 7ffda33ad2f0 2860->2873 2874 7ffda339afe8-7ffda339afec 2860->2874 2866 7ffda339af76 2861->2866 2867 7ffda339af84-7ffda339af88 2861->2867 2866->2867 2868 7ffda339af78-7ffda339af82 2866->2868 2869 7ffda339af8b-7ffda339af8e 2867->2869 2868->2869 2869->2856 2869->2861 2876 7ffda339b0b5-7ffda339b0be 2872->2876 2877 7ffda339b053-7ffda339b061 call 7ffda33b9c50 2872->2877 2873->2872 2878 7ffda339affc-7ffda339b000 2874->2878 2879 7ffda339afee 2874->2879 2882 7ffda339b11b-7ffda339b12c call 7ffda33a72d0 2876->2882 2883 7ffda339b0c0-7ffda339b0e3 call 7ffda33ad210 2876->2883 2877->2876 2891 7ffda339b063-7ffda339b06b 2877->2891 2880 7ffda339b003-7ffda339b006 2878->2880 2879->2878 2885 7ffda339aff0-7ffda339affa 2879->2885 2880->2873 2880->2874 2892 7ffda339b130-7ffda339b139 2882->2892 2893 7ffda339b105-7ffda339b119 call 7ffda33ad2f0 2883->2893 2894 7ffda339b0e5-7ffda339b0e9 2883->2894 2885->2880 2891->2882 2895 7ffda339b071-7ffda339b091 call 7ffda33ad210 2891->2895 2897 7ffda339b196-7ffda339b1a4 call 7ffda33a72d0 2892->2897 2898 7ffda339b13b-7ffda339b15e call 7ffda33ad210 2892->2898 2893->2892 2899 7ffda339b0f9-7ffda339b0fd 2894->2899 2900 7ffda339b0eb 2894->2900 2895->2893 2908 7ffda339b093-7ffda339b097 2895->2908 2913 7ffda339b1a8-7ffda339b1ba 2897->2913 2914 7ffda339b180-7ffda339b194 call 7ffda33ad2f0 2898->2914 2915 7ffda339b160-7ffda339b164 2898->2915 2906 7ffda339b100-7ffda339b103 2899->2906 2900->2899 2905 7ffda339b0ed-7ffda339b0f7 2900->2905 2905->2906 2906->2893 2906->2894 2911 7ffda339b0a7-7ffda339b0ab 2908->2911 2912 7ffda339b099 2908->2912 2917 7ffda339b0ae-7ffda339b0b1 2911->2917 2912->2911 2916 7ffda339b09b-7ffda339b0a5 2912->2916 2918 7ffda339b21a-7ffda339b223 call 7ffda33a72d0 2913->2918 2919 7ffda339b1bc-7ffda339b1e2 call 7ffda33ad210 2913->2919 2914->2913 2920 7ffda339b166 2915->2920 2921 7ffda339b174-7ffda339b178 2915->2921 2916->2917 2917->2908 2925 7ffda339b0b3 2917->2925 2931 7ffda339b227-7ffda339b239 2918->2931 2932 7ffda339b204-7ffda339b218 call 7ffda33ad2f0 2919->2932 2933 7ffda339b1e4-7ffda339b1e8 2919->2933 2920->2921 2927 7ffda339b168-7ffda339b172 2920->2927 2928 7ffda339b17b-7ffda339b17e 2921->2928 2925->2893 2927->2928 2928->2914 2928->2915 2934 7ffda339b299-7ffda339b2a2 call 7ffda33a72d0 2931->2934 2935 7ffda339b23b-7ffda339b261 call 7ffda33ad210 2931->2935 2932->2931 2936 7ffda339b1f8-7ffda339b1fc 2933->2936 2937 7ffda339b1ea 2933->2937 2946 7ffda339b2a6-7ffda339b2b8 2934->2946 2947 7ffda339b283-7ffda339b297 call 7ffda33ad2f0 2935->2947 2948 7ffda339b263-7ffda339b267 2935->2948 2942 7ffda339b1ff-7ffda339b202 2936->2942 2937->2936 2941 7ffda339b1ec-7ffda339b1f6 2937->2941 2941->2942 2942->2932 2942->2933 2949 7ffda339b318-7ffda339b321 call 7ffda33a72d0 2946->2949 2950 7ffda339b2ba-7ffda339b2e0 call 7ffda33ad210 2946->2950 2947->2946 2951 7ffda339b277-7ffda339b27b 2948->2951 2952 7ffda339b269 2948->2952 2961 7ffda339b325-7ffda339b337 2949->2961 2962 7ffda339b302-7ffda339b316 call 7ffda33ad2f0 2950->2962 2963 7ffda339b2e2-7ffda339b2e6 2950->2963 2956 7ffda339b27e-7ffda339b281 2951->2956 2952->2951 2955 7ffda339b26b-7ffda339b275 2952->2955 2955->2956 2956->2947 2956->2948 2964 7ffda339b397-7ffda339b3a0 call 7ffda33a72d0 2961->2964 2965 7ffda339b339-7ffda339b35f call 7ffda33ad210 2961->2965 2962->2961 2966 7ffda339b2f6-7ffda339b2fa 2963->2966 2967 7ffda339b2e8 2963->2967 2976 7ffda339b3a4-7ffda339b3b7 2964->2976 2977 7ffda339b381-7ffda339b395 call 7ffda33ad2f0 2965->2977 2978 7ffda339b361-7ffda339b365 2965->2978 2971 7ffda339b2fd-7ffda339b300 2966->2971 2967->2966 2970 7ffda339b2ea-7ffda339b2f4 2967->2970 2970->2971 2971->2962 2971->2963 2979 7ffda339b416-7ffda339b424 call 7ffda33a72d0 2976->2979 2980 7ffda339b3b9-7ffda339b3db call 7ffda33ad210 2976->2980 2977->2976 2981 7ffda339b375-7ffda339b379 2978->2981 2982 7ffda339b367 2978->2982 2991 7ffda339b428-7ffda339b433 2979->2991 2992 7ffda339b3dd 2980->2992 2993 7ffda339b400-7ffda339b414 call 7ffda33ad2f0 2980->2993 2986 7ffda339b37c-7ffda339b37f 2981->2986 2982->2981 2985 7ffda339b369-7ffda339b373 2982->2985 2985->2986 2986->2977 2986->2978 2994 7ffda339b496-7ffda339b4a4 call 7ffda33a72d0 2991->2994 2995 7ffda339b435-7ffda339b457 call 7ffda33ad210 2991->2995 2996 7ffda339b3e0-7ffda339b3e4 2992->2996 2993->2991 3007 7ffda339b4a8-7ffda339b4d7 send call 7ffda338a1f0 2994->3007 3008 7ffda339b459 2995->3008 3009 7ffda339b480-7ffda339b494 call 7ffda33ad2f0 2995->3009 2999 7ffda339b3e6 2996->2999 3000 7ffda339b3f4-7ffda339b3f8 2996->3000 2999->3000 3004 7ffda339b3e8-7ffda339b3f2 2999->3004 3005 7ffda339b3fb-7ffda339b3fe 3000->3005 3004->3005 3005->2993 3005->2996 3017 7ffda339b4d9-7ffda339b4ed call 7ffda338b0a0 3007->3017 3018 7ffda339b4f1-7ffda339b51f call 7ffda338b0a0 call 7ffda338ad20 call 7ffda338b0a0 3007->3018 3011 7ffda339b460-7ffda339b464 3008->3011 3009->3007 3014 7ffda339b466 3011->3014 3015 7ffda339b474-7ffda339b478 3011->3015 3014->3015 3019 7ffda339b468-7ffda339b472 3014->3019 3020 7ffda339b47b-7ffda339b47e 3015->3020 3017->3018 3018->2831 3019->3020 3020->3009 3020->3011
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_$Lockit::~_$send$DestroyExceptionMtx_unlockmtx_do_lock
                      • String ID:
                      • API String ID: 4003222900-0
                      • Opcode ID: 4b011ccc7a308af8f2263b1ff2f48820660ebe327cb4bee9226e38b4bb81225d
                      • Instruction ID: 5c51475b0d8f2577f4df8d9b577dbe0807f74a56b440ae51430226ea98e14492
                      • Opcode Fuzzy Hash: 4b011ccc7a308af8f2263b1ff2f48820660ebe327cb4bee9226e38b4bb81225d
                      • Instruction Fuzzy Hash: 47421A62B0EF45C6FB01EBA5D4B01AD2772EB44B84F548832DA4D2779ADF3AE550C344
                      Function 00007FFDA33C35B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 92threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                        • Part of subcall function 00007FFDA33C3420: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33C345A
                        • Part of subcall function 00007FFDA33C3420: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33C3462
                        • Part of subcall function 00007FFDA33C3420: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33C346F
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33C368C
                        • Part of subcall function 00007FFDA33C32D0: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33C32DE
                      • CreateThread.KERNELBASE ref: 00007FFDA33C36F9
                      • GetLastError.KERNEL32 ref: 00007FFDA33C370C
                      • _dosmaperr.LIBCMTD ref: 00007FFDA33C3714
                        • Part of subcall function 00007FFDA33C32B0: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33C32BE
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_unique_heap_ptr$CreateErrorLastThread__crt_scoped_stack_ptr_dosmaperr
                      • String ID: %ls$_beginthreadex$minkernel\crts\ucrt\src\appcrt\startup\thread.cpp$procedure != nullptr
                      • API String ID: 3341185216-1137699628
                      • Opcode ID: a615adb89bc8ca2624a5102c567c9342bba5994f5b59c612fdd7d9d1a2629100
                      • Instruction ID: 6af1f210a29506549eef0dc4f62d70f75b5a24c2c44bcd6f49c1803e41834368
                      • Opcode Fuzzy Hash: a615adb89bc8ca2624a5102c567c9342bba5994f5b59c612fdd7d9d1a2629100
                      • Instruction Fuzzy Hash: 08413D71A1EA8186E750EB54E4603ABB362FB80354F500135F68D93BAADF7ED448CB48
                      Function 00007FFDA3396EC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132libraryfileloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFileFreeLoadProcWrite
                      • String ID: DwQfAx1bBmR6KyNd$ExMEGR1xXDox
                      • API String ID: 1006017492-2779242041
                      • Opcode ID: a23cb782ea82d02cd59d3b8e240767e7cbbe90256b1cda8abeff974ebf30d37f
                      • Instruction ID: 79d29d5ebc9c7dcdb1c77da59f11e5f14598878c4cb327d0bdce627137cf05fa
                      • Opcode Fuzzy Hash: a23cb782ea82d02cd59d3b8e240767e7cbbe90256b1cda8abeff974ebf30d37f
                      • Instruction Fuzzy Hash: 7C51D532B0DE4586EB00EB61E4602AE2362FB84398F505531DE4D67B96DF7DD485C704
                      Function 00007FFDA33968D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressExecuteFreeLoadProcShell
                      • String ID: FwkIARQEB3gwIyM=$FwkIARRyTTM3OjtUGA==
                      • API String ID: 821778944-1131513299
                      • Opcode ID: b7ce8d0c1e2270aae44b96ed8a30b41d8a8b8db9517d756c7c17c564c6464c12
                      • Instruction ID: c4450baff3a17ea394c7689c950a43cc57fa9aa94f404b61b24995f49b2c85c6
                      • Opcode Fuzzy Hash: b7ce8d0c1e2270aae44b96ed8a30b41d8a8b8db9517d756c7c17c564c6464c12
                      • Instruction Fuzzy Hash: 08416132B1AE4596EB10EFB1E4602ED2362FB84788F405431DE4D67B5ADF39D559C308
                      Function 00007FFDA3396730 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressComputerFreeLoadNameProc
                      • String ID: AwQZLhdaRSMgKj1/OCkELA==$DwQfAx1bBmR6KyNd
                      • API String ID: 1401992861-1489189946
                      • Opcode ID: 71bd9d6f1b17938a1014e4d20f567b890cb2a8ed53e2726dd1338bef443f29f8
                      • Instruction ID: c90932cb6a6e8609efc77385c25da33095fb186650e1be9e1eacb254b6f4b3a8
                      • Opcode Fuzzy Hash: 71bd9d6f1b17938a1014e4d20f567b890cb2a8ed53e2726dd1338bef443f29f8
                      • Instruction Fuzzy Hash: 94418D32B0AB46DAE710DFB0D8602AC3376FB84748B501536EA4D63B9ADF39D55AC344
                      Function 00007FFDA3396BE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101libraryfileloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressCreateFileFreeLoadProc
                      • String ID: BxMIDAxScz84Kg4=$DwQfAx1bBmR6KyNd
                      • API String ID: 2544391141-1208362912
                      • Opcode ID: 7b0f71839718eae04086c3fcf85b0fe16894cd0f6d1cd6eb71dae25a2edcbdfa
                      • Instruction ID: c901552d797e06c4f4d7fde6ad8a24b065a87f219bcf5e751de3e9d6e55dc454
                      • Opcode Fuzzy Hash: 7b0f71839718eae04086c3fcf85b0fe16894cd0f6d1cd6eb71dae25a2edcbdfa
                      • Instruction Fuzzy Hash: 6E419032B1DA419AEB10DBA5E4203AD7372FB88788F500035DE4D67B5ADF79D94AC704
                      Function 00007FFDA33A8460 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLockitstd::_$AddressFreeLoadLockit::_Lockit::~_ProcSleep
                      • String ID: DwQfAx1bBmR6KyNd$Fw0ICAg=
                      • API String ID: 3982633724-414132534
                      • Opcode ID: de4fc43e99e9e7c0af0bf0fce5830cfad39dc41231ea65c7594fb86eb72c2d08
                      • Instruction ID: 0e6da3964b0ec1eeb17e8acac9b69f273b5b78402c64921f321c05056535410e
                      • Opcode Fuzzy Hash: de4fc43e99e9e7c0af0bf0fce5830cfad39dc41231ea65c7594fb86eb72c2d08
                      • Instruction Fuzzy Hash: 51414F22B0AF418AEB00EF70D4A02EC2372FB54748F445535EE4D66B9ADF79E999C344
                      Function 00007FFDA3396D70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressCloseFreeHandleLoadProc
                      • String ID: Bw0CHh1/VDgwIyo=$DwQfAx1bBmR6KyNd
                      • API String ID: 2288892001-2576090626
                      • Opcode ID: 910200e48634ab3b1bd3eab20b8aa8ee7b70678dac3517e494b3e41778f1f92b
                      • Instruction ID: 2ac9450e4139c0c723700257f6df8fb613c54e61f2a8db8b06c2fca263768b85
                      • Opcode Fuzzy Hash: 910200e48634ab3b1bd3eab20b8aa8ee7b70678dac3517e494b3e41778f1f92b
                      • Instruction Fuzzy Hash: CA311022B0AB45DAEB00DFB5D4B02AC2372EB84748B405435EE0D76B5ADF79D95AC344
                      Function 00007FFDA33C3360 Relevance: 7.5, APIs: 5, Instructions: 44threadCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ExitThread
                      • String ID:
                      • API String ID: 2158977761-0
                      • Opcode ID: 8101a0b18b5eb364cf3aaf8539c8463c6dc6e4b1accce32b33160986dba8e330
                      • Instruction ID: 2fb6e1a6cc7592e34217ef62ec8e0a7299d529dbf6098c18cb1f35e5a0b433a3
                      • Opcode Fuzzy Hash: 8101a0b18b5eb364cf3aaf8539c8463c6dc6e4b1accce32b33160986dba8e330
                      • Instruction Fuzzy Hash: 46213A22A0DE4582D6249B09E49432AB772FB84B78F140374EAAD537F5CF3DD988CB04
                      Function 00007FFDA33C31E0 Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ErrorExitLastThread__vcrt_getptd
                      • String ID:
                      • API String ID: 3472536532-0
                      • Opcode ID: ae65c4b108437b18f9447a7cf66b6c54e4fc141a52f64a42ce5cff3d01d1a7b6
                      • Instruction ID: d5572568ff4d6f821df35ea2621ff121aa203cd24c11aeb9e236c04355418b93
                      • Opcode Fuzzy Hash: ae65c4b108437b18f9447a7cf66b6c54e4fc141a52f64a42ce5cff3d01d1a7b6
                      • Instruction Fuzzy Hash: 74115136A0EF4582DB60AB55E45422EB7E2EB88BA4F100175FA8D5376ACF7DD4848B04
                      Function 00007FFDA33F0680 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ErrorFreeHeapLast
                      • String ID:
                      • API String ID: 485612231-0
                      • Opcode ID: 4d1b353a2808a69fbd6edc9b770dca3f3372ae65f088b68fd2a4fc34bce4dba4
                      • Instruction ID: ff835b80e6e21e04383cb65a6e9f4cb70a54f2261490ecfd15b8bde9af1b851d
                      • Opcode Fuzzy Hash: 4d1b353a2808a69fbd6edc9b770dca3f3372ae65f088b68fd2a4fc34bce4dba4
                      • Instruction Fuzzy Hash: 75F01221F0FE4283EB10BB65982536AA3A2FFC4740F504135E68D577A6DF3EDC448A04
                      Function 00007FFDA338AFE6 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _heap_alloc
                      • String ID:
                      • API String ID: 4215648709-0
                      • Opcode ID: b1302872106d03c07b3fe7daeb3ffdebd23b6afb3708c52b96e12e31bc6b3b6a
                      • Instruction ID: 71dd529d0373da16a047ab0844a25658da77ae6754279baedc345601eb56dee8
                      • Opcode Fuzzy Hash: b1302872106d03c07b3fe7daeb3ffdebd23b6afb3708c52b96e12e31bc6b3b6a
                      • Instruction Fuzzy Hash: 2511A03270EB819AFA51AF41E9603AA7295FB44780F404135DB8E1BB93DF3DE4A18308
                      Function 00007FFDA33C4C20 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _get_purecall_handler
                      • String ID:
                      • API String ID: 2826984366-0
                      • Opcode ID: 779906507ca047d8b8a55366660f0e697db4450dc4def332a04c0feb35e3d7d6
                      • Instruction ID: 434933f4a5cb9dc6f7858dae9d4caf23862d41d1d26615224506ab067812efce
                      • Opcode Fuzzy Hash: 779906507ca047d8b8a55366660f0e697db4450dc4def332a04c0feb35e3d7d6
                      • Instruction Fuzzy Hash: A5116632A0DB81A5E321AB59E05136EBBD1F794394F044135EACD52BA6DF3DD5448F08
                      Function 00007FFDA33C661C Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock
                      • String ID:
                      • API String ID: 3805268497-0
                      • Opcode ID: 5be0986b486dc28d81bf4e1d048dd45c1c840b29c6054eadc5294c72bb23c486
                      • Instruction ID: 2b97a4ee198b639fbdc36a55deb199fe0c5aa8ca060a2eb62fac3b5c5906a611
                      • Opcode Fuzzy Hash: 5be0986b486dc28d81bf4e1d048dd45c1c840b29c6054eadc5294c72bb23c486
                      • Instruction Fuzzy Hash: 40E01576A0D5418BD360EB19E06162AB7B1F7C8348F100235E78D93B9ACF3EE9048E08
                      Function 00007FFDA33A7740 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00007FFDA33AF240: _Lock_at_thread_exit_mutex.LIBCPMTD ref: 00007FFDA33AF259
                        • Part of subcall function 00007FFDA33AF240: _Mtx_unlock.LIBCPMTD ref: 00007FFDA33AF313
                        • Part of subcall function 00007FFDA33AF240: _Lock_at_thread_exit_mutex.LIBCPMTD ref: 00007FFDA33AF37A
                      • delete.LIBCMTD ref: 00007FFDA33A7758
                        • Part of subcall function 00007FFDA33B5950: overwrite_buffer.LIBCPMTD ref: 00007FFDA33B5963
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lock_at_thread_exit_mutex$Mtx_unlockdeleteoverwrite_buffer
                      • String ID:
                      • API String ID: 1080468243-0
                      • Opcode ID: 10edd29801e6084cf934cab7d1785b60e8c9ef29ec4e8824cff83548e6a6bb79
                      • Instruction ID: 5bbf6b88bf09d23297cb419ab14085cbec8dc47e6d4ace6e1f46a417838a23a0
                      • Opcode Fuzzy Hash: 10edd29801e6084cf934cab7d1785b60e8c9ef29ec4e8824cff83548e6a6bb79
                      • Instruction Fuzzy Hash: CDC08C12F2AA0342FA143BB268121AE02414F59B11F585030C90D19783CD2F94EA0304

                      Non-executed Functions

                      Function 00007FFDA33AAB40 Relevance: 90.1, APIs: 36, Strings: 15, Instructions: 809libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFreeProc$Load$Xinvalid_argumentstd::_$_mbsset_s
                      • String ID: 264$@$AwQZIBdTQDoxCSZdPAoAAAg5$AwQZORBFUDcwDCBfLSEZGQ==$BxMIDAxSZSQ7LCpCKgU=$DwQfAx1bBmR6KyNd$EggfGQ1WWRc4IyBS$EggfGQ1WWRc4IyBSHDw=$ExMEGR1nRzk3KjxCFCEMAh8B$FgQMCShFWjUxPDx8PCkOHxQ=$FgQeGBVSYT4mKi5V$FwQZORBFUDcwDCBfLSEZGQ==$fA==$invalid stoi argument$stoi argument out of range
                      • API String ID: 2986512560-1186390409
                      • Opcode ID: 80c84159f3ff63d0ba76d465f86829e4a442e5f0fa8f2bff77102374688daa24
                      • Instruction ID: 2b907efbbb1af0cfcec818c16d05bbbef017c34d3606214ff2f343e46559680a
                      • Opcode Fuzzy Hash: 80c84159f3ff63d0ba76d465f86829e4a442e5f0fa8f2bff77102374688daa24
                      • Instruction Fuzzy Hash: 78826232B09E869AEB10EF74D8A02EC2762FF84348F505531DA4D67BAADF79D585C304
                      Function 00007FFDA33A91F0 Relevance: 46.0, APIs: 20, Strings: 6, Instructions: 497libraryloadermemoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Library$AddressFreeGdipLoadProc$Gdiplus$AllocBitmapBitsCreateFileFromImageSaveShutdownStartup
                      • String ID: AwUEXkoZUTo4$BxMIDAxSdjk5Py5FMCYNCCk7$ERIIH0sFGzI4Iw==$FgQBCBlEUBIX$FwQZORBFUDcwCz9YGDMAHwgWUkYlFyAhRTw8FQ==$LQwMCh0YXyYxKA==
                      • API String ID: 1861212159-1522810330
                      • Opcode ID: d9a181360dc4424c95909b9a70038c17137961322e443e8a9bed48744771517a
                      • Instruction ID: 4167e3424bb5df9b120c7f9dadf6ae6774783e8219e56f6f99f1a21553f5f506
                      • Opcode Fuzzy Hash: d9a181360dc4424c95909b9a70038c17137961322e443e8a9bed48744771517a
                      • Instruction Fuzzy Hash: 22326E32B09BC689EB20EF70D8603ED2362FB84748F505535DA4D6AB9ADF7AD584C344
                      Function 00007FFDA3399AD0 Relevance: 40.9, APIs: 8, Strings: 15, Instructions: 630COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "ITERATOR LIST CORRUPTED!"$"null pointer cannot point to a block of non-zero size"$"vector subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$ITERATOR LIST CORRUPTED!$fg==$gfffffff$gfffffff$gfffffff$gfffffff$null pointer cannot point to a block of non-zero size$vector subscript out of range
                      • API String ID: 593203224-3242299792
                      • Opcode ID: 4fd427f96b3a964ffe0257fc7a91fcd14ebab0614468070aadeec063daa749a5
                      • Instruction ID: d4804a43a5b9e46c32a2383c7956f4b08d1a656b4608b9220d4439ac127ea8ab
                      • Opcode Fuzzy Hash: 4fd427f96b3a964ffe0257fc7a91fcd14ebab0614468070aadeec063daa749a5
                      • Instruction Fuzzy Hash: F262BE21B0EA8685FB14EF65E8602E92362FB44788F444132DA4D67B9BDF7EE544C348
                      Function 00007FFDA33FB2B0 Relevance: 39.2, APIs: 11, Strings: 11, Instructions: 728COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$(result_buffer_size % 2) == 0$_osfile(fh) & FOPEN$_read_nolock$fh >= 0 && (unsigned)fh < (unsigned)_nhandle$m$minkernel\crts\ucrt\src\appcrt\lowio\read.cpp$minkernel\crts\ucrt\src\appcrt\lowio\read.cpp$result_buffer != nullptr$result_buffer_size % 2 == 0$result_buffer_size <= INT_MAX
                      • API String ID: 0-3351087447
                      • Opcode ID: 967aedcaa284e06e90e19a9a18ef9ae9686e9e58e47679602e8eaa673c6e019f
                      • Instruction ID: 652a5318ae4e89c326389c81609142b72a3be7bbf028d75f4d4fc38cab8359f3
                      • Opcode Fuzzy Hash: 967aedcaa284e06e90e19a9a18ef9ae9686e9e58e47679602e8eaa673c6e019f
                      • Instruction Fuzzy Hash: 9082A67270EA818AE760DB18E4613AAB7A2FB84740F404131E69D977AADF7ED445CF04
                      Function 00007FFDA339A890 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 332COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$DestroyExceptionMtx_unlockmtx_do_lock
                      • String ID: "ITERATOR LIST CORRUPTED!"$"vector erase iterator outside range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$ITERATOR LIST CORRUPTED!$vector erase iterator outside range
                      • API String ID: 3910284475-2305553127
                      • Opcode ID: 27a4a888bd3efa606d307b4258283595a74c3b69efbe6ea924acf8a111bce43d
                      • Instruction ID: bc0916e8473be46082e0906988c9eeb7e3ecbf12381948c8ffaeb707c6f03104
                      • Opcode Fuzzy Hash: 27a4a888bd3efa606d307b4258283595a74c3b69efbe6ea924acf8a111bce43d
                      • Instruction Fuzzy Hash: BAF16032B0EF4685FB50AB64E4A02ED33A6EB44788F444536DA4C67B9ADF3ED514C348
                      Function 00007FFDA3399360 Relevance: 37.2, APIs: 8, Strings: 13, Instructions: 438COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "ITERATOR LIST CORRUPTED!"$"vector subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$ITERATOR LIST CORRUPTED!$gfffffff$gfffffff$gfffffff$gfffffff$gfffffff$vector subscript out of range
                      • API String ID: 593203224-3419520062
                      • Opcode ID: 2edb0c8b8617f27001b2ef5d30172529be2029fb134a064c0949ea5624b9b7b0
                      • Instruction ID: 791615b22bc991efe7accf79bc9ce050eed4dc5890eaba6a1cfa4e28bc238961
                      • Opcode Fuzzy Hash: 2edb0c8b8617f27001b2ef5d30172529be2029fb134a064c0949ea5624b9b7b0
                      • Instruction Fuzzy Hash: 4912BE72B0EE4695FA04EB15F8A05E92362FB44784F844432DA4DA7B6ADF7FE145C308
                      Function 00007FFDA33C54E0 Relevance: 26.7, APIs: 2, Strings: 13, Instructions: 461COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: new[]
                      • String ID: %ls$Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtIsValidHeapPointer(block)$__acrt_first_block == old_head$__acrt_last_block == old_head$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$old_head->_line_number == line_number_for_ignore_blocks && old_head->_request_number == request_number_for_ignore_blocks$reallocation_is_allowed || (!reallocation_is_allowed && new_head == old_head)
                      • API String ID: 4059295235-458177602
                      • Opcode ID: be4a40c1282368c1f8bf70b68c0281de0133b0d443c76e2a4f3d0c7ffaac13d4
                      • Instruction ID: c223f3e7ff97bce982c9946f8d61fc3c4f5113057d4a7ae5534a12089cba11ba
                      • Opcode Fuzzy Hash: be4a40c1282368c1f8bf70b68c0281de0133b0d443c76e2a4f3d0c7ffaac13d4
                      • Instruction Fuzzy Hash: 93328332B0EF8585E7609B1AF4A036A77A2FB85790F504135DA8D93BA6DF3ED444CB04
                      Function 00007FFDA33AA550 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 285COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ByteCharMultiWide$Concurrency::cancel_current_task
                      • String ID: "null pointer cannot point to a block of non-zero size"$"string subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$null pointer cannot point to a block of non-zero size$string subscript out of range
                      • API String ID: 2514540991-1204798847
                      • Opcode ID: dafaebf94989ccfdea97e7884e51e97eeb7137dc722a787e4b1aa6d3542ce8ff
                      • Instruction ID: 49a25f7408659ef13b07ef649d4a126ea3f633670a15c62dea28f3e7c1e5177e
                      • Opcode Fuzzy Hash: dafaebf94989ccfdea97e7884e51e97eeb7137dc722a787e4b1aa6d3542ce8ff
                      • Instruction Fuzzy Hash: 4BD1D532B0EB8686E720EF50E4602AD73A6FB44398F404635DA9D63B96DF3ED554C308
                      Function 00007FFDA33D5090 Relevance: 21.5, APIs: 4, Strings: 8, Instructions: 502COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_scoped_stack_ptr$Concurrency::details::_SchedulerScheduler::_$memcpy_s
                      • String ID: %ls$("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0)$("buffer too small", 0)$_fread_nolock_s$buffer != nullptr$element_count <= (SIZE_MAX / element_size)$minkernel\crts\ucrt\src\appcrt\stdio\fread.cpp$stream.valid()
                      • API String ID: 2985791244-3722996134
                      • Opcode ID: 3eaac30f6a66c28d6516ed4ecbf1977d24b17e75162b73ee9360675458e125b0
                      • Instruction ID: fc39bf3874eb520300d4e286538f0074de8057453f154dfd2ecefa02394c5291
                      • Opcode Fuzzy Hash: 3eaac30f6a66c28d6516ed4ecbf1977d24b17e75162b73ee9360675458e125b0
                      • Instruction Fuzzy Hash: E2425032B0EE8286E760DB54E4603AAB3A2FB84790F504535E69D93B96DF7ED444CB04
                      Function 00007FFDA3400230 Relevance: 18.2, APIs: 12, Instructions: 212fileCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Container_base12Container_base12::~_std::_$FileFind$Concurrency::details::_FirstNextSchedulerScheduler::_type_info::_name_internal_method
                      • String ID:
                      • API String ID: 2266973947-0
                      • Opcode ID: 763907a2065d0c20e2257b94f8dfce9a5e9cf712878a553b4c65a90c1a9ae0bf
                      • Instruction ID: 5c0846a3a3573a0f370285575ee948ffa693df726256d8668676f61650bf578f
                      • Opcode Fuzzy Hash: 763907a2065d0c20e2257b94f8dfce9a5e9cf712878a553b4c65a90c1a9ae0bf
                      • Instruction Fuzzy Hash: 6BB1542271DA8181DA60DB25E4603AEF765FBC5780F504132E68ED3BAADF7ED544CB04
                      Function 00007FFDA33D6840 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 430COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D6885
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33D688F
                        • Part of subcall function 00007FFDA33D4860: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D4878
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr
                      • String ID: %ls$("Flush between consecutive read and write.", !stream.has_any_of(_IOREAD))$("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0)$_fwrite_nolock_internal$buffer != nullptr$element_count <= (SIZE_MAX / element_size)$minkernel\crts\ucrt\src\appcrt\stdio\fwrite.cpp$stream.valid()
                      • API String ID: 4164245112-1255503402
                      • Opcode ID: 5a4ed242e5140eff0095387b187a23656be279b21e3956aa2eaac2cb4b259390
                      • Instruction ID: a106f5f99fbea931a610ffb134d2adc4acb19144c190f59c0f15fb6adc12ea9d
                      • Opcode Fuzzy Hash: 5a4ed242e5140eff0095387b187a23656be279b21e3956aa2eaac2cb4b259390
                      • Instruction Fuzzy Hash: 6B224F72B1EF8585EB60DB15E4603AAB3A2FB84780F500535E68D93B9ADF7ED444CB04
                      Function 00007FFDA33C4010 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 264COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: PointerValidswprintf
                      • String ID: #File Error#(%d) : $%hs(%d) : $Dumping objects ->$client block at 0x%p, subtype %x, %Iu bytes long.$crt block at 0x%p, subtype %x, %Iu bytes long.$normal block at 0x%p, %Iu bytes long.${%ld}
                      • API String ID: 2867872725-2254558347
                      • Opcode ID: 8c108b207fe95b04f2e3d263a1bfbd08dce0fa9a3e856ecb3bec1d78e76b1b23
                      • Instruction ID: bd842dd3c8745b04a6cee4a915511e83c49a98de94e1fcaf08b6cd8450f130bb
                      • Opcode Fuzzy Hash: 8c108b207fe95b04f2e3d263a1bfbd08dce0fa9a3e856ecb3bec1d78e76b1b23
                      • Instruction Fuzzy Hash: 41C13D36B1DF8586EB60DB19E49136AB3A1FB85790F104131EB8D93B6ADF3ED4148B04
                      Function 00007FFDA33C60A0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 145COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C614E
                        • Part of subcall function 00007FFDA33D1950: EnterCriticalSection.KERNEL32(?,?,?,?,00007FFDA33C2645,?,?,?,?,00007FFDA33C2352), ref: 00007FFDA33D1971
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: CriticalEnterSection__vcrt_lock
                      • String ID: %ls$Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$state != nullptr
                      • API String ID: 1786109592-3601319530
                      • Opcode ID: c89c6d677f79ce23c805c37f0a4df84efe34a4f3f5d37b7b1736c587d3b9cf68
                      • Instruction ID: 299efea49cd9b574ce9957537e9dabb032a4cacc8a26061e7107828d7ea6c0b0
                      • Opcode Fuzzy Hash: c89c6d677f79ce23c805c37f0a4df84efe34a4f3f5d37b7b1736c587d3b9cf68
                      • Instruction Fuzzy Hash: 48714F36A1DF4186EB50DB59E49033AB3A1FB89780F200535EA8D93B56CF7ED4558B04
                      Function 00007FFDA33A8760 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 322COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_taskLockitstd::_$Lockit::_Lockit::~__heap_alloc
                      • String ID: "null pointer cannot point to a block of non-zero size"$($C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$null pointer cannot point to a block of non-zero size
                      • API String ID: 337915517-3682680053
                      • Opcode ID: 2d73b78f0284d8131b17dfe79a102a06e91fc37dc207cd492999914e2bf98585
                      • Instruction ID: 6e7bb317079e6395be9f0f65dafacd4e5d96e8389b5abd0701b0b347cdf2a0f4
                      • Opcode Fuzzy Hash: 2d73b78f0284d8131b17dfe79a102a06e91fc37dc207cd492999914e2bf98585
                      • Instruction Fuzzy Hash: 58E19F62F0EB8686F710EBA0E4602AD2362FB44788F404635DE5D37B9ADF7ED1558348
                      Function 00007FFDA34093E0 Relevance: 12.2, APIs: 8, Instructions: 203COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: CodeDefaultLocalePageValid__vcrt_getptd$FromInfoLcidProcessUser
                      • String ID:
                      • API String ID: 1212397710-0
                      • Opcode ID: 087b6355ec0db2bff351d2e8b5cd0229ade01129d74a59948aa1cd57e18ce193
                      • Instruction ID: 40f893fabf040c43baec6dafa97a5a59aca3fbb152eaba00ac7c7812085fbd90
                      • Opcode Fuzzy Hash: 087b6355ec0db2bff351d2e8b5cd0229ade01129d74a59948aa1cd57e18ce193
                      • Instruction Fuzzy Hash: DCA15032B0DA4581EB608B16E46037A77A1FBC9B84F444035EA8D97BB6DF7ED940CB04
                      Function 00007FFDA33C3A30 Relevance: 11.5, Strings: 9, Instructions: 289COMMON
                      Download Yara Rule
                      Strings
                      • HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 00007FFDA33C3B46
                      • HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 00007FFDA33C3E25
                      • HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 00007FFDA33C3C98
                      • HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 00007FFDA33C3DEE
                      • DAMAGED, xrefs: 00007FFDA33C3A85
                      • HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 00007FFDA33C3D00
                      • HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 00007FFDA33C3BAE
                      • %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 00007FFDA33C3EF2
                      • %hs located at 0x%p is %Iu bytes long., xrefs: 00007FFDA33C3F64
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %hs located at 0x%p is %Iu bytes long.$%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
                      • API String ID: 0-1381456093
                      • Opcode ID: f9693b008d1da0e0933a8fa2edaab1ecdf8084473e9b094d873dc908dfae3a84
                      • Instruction ID: e1899648724befd8f6d7ff3ba8c70c4a93672d9796a21603607e5f9207a22fc3
                      • Opcode Fuzzy Hash: f9693b008d1da0e0933a8fa2edaab1ecdf8084473e9b094d873dc908dfae3a84
                      • Instruction Fuzzy Hash: F9E15336A0DB8586D774DB29F0913ABB7A1F788790F000526EB8D83B6ADF3DD4548B04
                      Function 00007FFDA338ED60 Relevance: 11.4, Strings: 9, Instructions: 143COMMON
                      Download Yara Rule
                      Strings
                      • JXF0BtjSmJWseR98ckWirk5V4MBfL6lZoYzbU3Lrljoy4sD002N8jP0AurvqfcU4lUs2qe0B4hrQFyNnpsU0AuuQ1GN5bRq9GnFGDQSOJGtFLGbmTqOyAA4w4fUS5, xrefs: 00007FFDA338EF0C
                      • UMPozNOu1ASURArj4YtgiOJxvJb2tOXick3KopBYbeRtjUM8cKqBcFaEXbiJIbgZGeBGLcXbHRb3kSWcyBcVEckm3ethPWyrOhRXHUC0uU833tmv4ruJHBpZTCduUWuJl2aDWcF16QJd3Acifqt2E1, xrefs: 00007FFDA338EEE1
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338EE4C
                      • J1MHMIGmbQpzUwZva1Vm13EC4uNauRGmlLUSExGIvl, xrefs: 00007FFDA338EF37
                      • ggxIOsgy2i, xrefs: 00007FFDA338EDA9
                      • xq9y3NwK3Pcx8u81wazUwsWySJLzsMTSAatsRy3XrCQI9aGddlVpFGOc7rMb8, xrefs: 00007FFDA338EDDA
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338EE6C
                      • "null pointer cannot point to a block of non-zero size", xrefs: 00007FFDA338EE7A
                      • null pointer cannot point to a block of non-zero size, xrefs: 00007FFDA338EE2B
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "null pointer cannot point to a block of non-zero size"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$J1MHMIGmbQpzUwZva1Vm13EC4uNauRGmlLUSExGIvl$JXF0BtjSmJWseR98ckWirk5V4MBfL6lZoYzbU3Lrljoy4sD002N8jP0AurvqfcU4lUs2qe0B4hrQFyNnpsU0AuuQ1GN5bRq9GnFGDQSOJGtFLGbmTqOyAA4w4fUS5$UMPozNOu1ASURArj4YtgiOJxvJb2tOXick3KopBYbeRtjUM8cKqBcFaEXbiJIbgZGeBGLcXbHRb3kSWcyBcVEckm3ethPWyrOhRXHUC0uU833tmv4ruJHBpZTCduUWuJl2aDWcF16QJd3Acifqt2E1$ggxIOsgy2i$null pointer cannot point to a block of non-zero size$xq9y3NwK3Pcx8u81wazUwsWySJLzsMTSAatsRy3XrCQI9aGddlVpFGOc7rMb8
                      • API String ID: 593203224-265283495
                      • Opcode ID: c00af6313d8d6ead4e79973c9ae602aa9cf2f820aabab7788c3788cb42799b39
                      • Instruction ID: 4def5345207149fd270545e4b380545de2bbd6632f0348ae5dd84b46ee7cd23a
                      • Opcode Fuzzy Hash: c00af6313d8d6ead4e79973c9ae602aa9cf2f820aabab7788c3788cb42799b39
                      • Instruction Fuzzy Hash: 4F615B32B19B4686E700DBB0E4A02AD3376EB94388F505135EA8D77B6ADF3DE155C348
                      Function 00007FFDA33B6770 Relevance: 10.6, APIs: 7, Instructions: 81COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                      • String ID:
                      • API String ID: 3140674995-0
                      • Opcode ID: 32c2da5f42e3eb73417ee61f1645a8cb19d859571f5abe2d3f9b349f0bbccd13
                      • Instruction ID: af6afdba460add17acf98ff46a13693a3c0037c7f882504b29a5c1c927b9dd8e
                      • Opcode Fuzzy Hash: 32c2da5f42e3eb73417ee61f1645a8cb19d859571f5abe2d3f9b349f0bbccd13
                      • Instruction Fuzzy Hash: 7441173260DBC586E7609B15F4503AAB7A5F788341F500136EB8D82BAAEF7EC584CF00
                      Function 00007FFDA338F590 Relevance: 10.2, Strings: 8, Instructions: 163COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "null pointer cannot point to a block of non-zero size"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$IGJVYcKTZHxxs5L34V2$NZACK5Pyqy35WxdB6boraQBiX4JqqbnAvyUjR5gPf4OUQ8dxA9u8TkObMvX4NYmjXlhhWHlVgbE5glDsDv$NiyLzYfZ8o1$esoUz70xANRL7TAjeK9fBh0Ud$null pointer cannot point to a block of non-zero size
                      • API String ID: 593203224-1670365084
                      • Opcode ID: 6fd7b0e81aaf715e871ecc8c7cf30a9c3ff6407d106cdbf885511b4542e14fd4
                      • Instruction ID: 8bd0c275c076026b0648b81553898b8d815e44e71fb8c28dd4da4ca59c3feec6
                      • Opcode Fuzzy Hash: 6fd7b0e81aaf715e871ecc8c7cf30a9c3ff6407d106cdbf885511b4542e14fd4
                      • Instruction Fuzzy Hash: 38718E22F1DB4686F710EBB0E8606AD6322EB44788F504231EE4D73B5AEF3DD5558348
                      Function 00007FFDA3408AF0 Relevance: 9.3, APIs: 6, Instructions: 254COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: InfoLocale$__vcrt_getptd
                      • String ID:
                      • API String ID: 3040307077-0
                      • Opcode ID: 6ce47cfd9584ded78dadc079e62166acb7d9364f38a9548c3c7b5dde80697a89
                      • Instruction ID: 07dbe1d414adf651b86ce3a2af3b949115a8a7e78a89cb064bafccd65a16b5a4
                      • Opcode Fuzzy Hash: 6ce47cfd9584ded78dadc079e62166acb7d9364f38a9548c3c7b5dde80697a89
                      • Instruction Fuzzy Hash: 11D1483671EA8586E760CF05E19022EB7A1F7C8B88F404125EA8D97BA9CF7DD940CF04
                      Function 00007FFDA3398D60 Relevance: 7.9, Strings: 6, Instructions: 368COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: delete
                      • String ID: "vector subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$fg==$gfffffff$vector subscript out of range
                      • API String ID: 974290055-949609207
                      • Opcode ID: 4b54d5031e298015494f29fbe257c69ef599eff698a2d1ccffb5cf6c9e8ab770
                      • Instruction ID: e321fd7fce70f362376e237c1b4143b48025abe636f15d1bf40f898412ac8be5
                      • Opcode Fuzzy Hash: 4b54d5031e298015494f29fbe257c69ef599eff698a2d1ccffb5cf6c9e8ab770
                      • Instruction Fuzzy Hash: 6CF1C172F0AE4682EB04EB14E8605E93722FB45788F404536DA4D67BA6DF7EE144C748
                      Function 00007FFDA33C5DFE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: HeapValidate__vcrt_lock
                      • String ID: Cycle in block list detected while processing block located at 0x%p.$Heap validation failed.
                      • API String ID: 504802999-1543450014
                      • Opcode ID: e1759a972f0423d1620a7dcdb7490a29bf44627638ba83c01ca7a4dea2f3309d
                      • Instruction ID: 6685044a03db4a902259f90e72f0e788a5a779990d99623a67e58a75a61a2ae2
                      • Opcode Fuzzy Hash: e1759a972f0423d1620a7dcdb7490a29bf44627638ba83c01ca7a4dea2f3309d
                      • Instruction Fuzzy Hash: FF317332B1EF4586F7609B29E09076AB7A1FB85780F500035E78E93B66DF7ED4448B08
                      Function 00007FFDA3408690 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$CountryDefaultInfoLocaleTest
                      • String ID:
                      • API String ID: 2340197513-0
                      • Opcode ID: bbf94e64012ac9197d2afa43f445ec93a938a902c026a779e909219d44f3ad87
                      • Instruction ID: 321351989d35416186ed212b38f71f555ab2133a9ce01e5b0a90c2f9f2210a93
                      • Opcode Fuzzy Hash: bbf94e64012ac9197d2afa43f445ec93a938a902c026a779e909219d44f3ad87
                      • Instruction Fuzzy Hash: AB315B3671D64186E760CB15E4A036E77A1FB89794F004035EA8D97B6ACF7DE440CF04
                      Function 00007FFDA33C1DC0 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ExceptionFilterUnhandled$CaptureContextCurrentDebuggerPresent__crt
                      • String ID:
                      • API String ID: 3997116924-0
                      • Opcode ID: 9f508516905dc1543cf661ab46609df7e70b3fdc094ed01cfd3640a0055007be
                      • Instruction ID: d82108ca9688a36db2f18930ff3855dc78911ce685b657850711a8e197c35401
                      • Opcode Fuzzy Hash: 9f508516905dc1543cf661ab46609df7e70b3fdc094ed01cfd3640a0055007be
                      • Instruction Fuzzy Hash: F531D532A0DBC18AE7709B14E8553ABB3A1F784355F400636D68D92BA9EF3DD5548F04
                      Function 00007FFDA338A3B0 Relevance: 5.2, Strings: 4, Instructions: 220COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: "string subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$string subscript out of range
                      • API String ID: 0-2856042161
                      • Opcode ID: a76b10a0276c341aa42e8bf2599fc8907ea0903cb988234a821c4a4cebc752eb
                      • Instruction ID: 577fb032e6271cd5f74cdf8c920fd8bb78ed50053c89bc79d5f1b626a06008a1
                      • Opcode Fuzzy Hash: a76b10a0276c341aa42e8bf2599fc8907ea0903cb988234a821c4a4cebc752eb
                      • Instruction Fuzzy Hash: 5BA1E561B0EA4B85FB50AB64E5B02B96763FB01384F901032E58D6379BDF7EE159C308
                      Function 00007FFDA3408F00 Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$InfoLocale
                      • String ID:
                      • API String ID: 1730546149-0
                      • Opcode ID: 1d3e58ad611905909c965917a287a2620454dd039d55f84fcbbf5699ae1345e2
                      • Instruction ID: bd4ecd8f4944e76ecb62ba2a08509eedb7d5f68630de5c9d8e6aebe59d6ee715
                      • Opcode Fuzzy Hash: 1d3e58ad611905909c965917a287a2620454dd039d55f84fcbbf5699ae1345e2
                      • Instruction Fuzzy Hash: 79515C3271DA4186E760CB15E09036A77A1FBC8B98F404135EA8D977AACF7ED940CF04
                      Function 00007FFDA33CD7F0 Relevance: 4.3, Strings: 3, Instructions: 551COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$("Division by zero", false)$minkernel\crts\ucrt\inc\corecrt_internal_big_integer.h
                      • API String ID: 0-226933
                      • Opcode ID: ae8400183eb91e19e87a2cd72df41b430580eedb820de126e2d9b1249cf3c0c1
                      • Instruction ID: 1a6ffae7e781b7b02da17d3d15465b2a27e82a78d1a33f12e43991e448bc9b4a
                      • Opcode Fuzzy Hash: ae8400183eb91e19e87a2cd72df41b430580eedb820de126e2d9b1249cf3c0c1
                      • Instruction Fuzzy Hash: 5152C27660DA808BD7A4DB1DE49076AB7A2F7C8744F108125E68EC3B59DB3EE854CF04
                      Function 00007FFDA33EA170 Relevance: 3.1, APIs: 2, Instructions: 78COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • IsDebuggerPresent.KERNEL32(?,?,?,00007FFDA33EA347), ref: 00007FFDA33EA183
                      • Concurrency::details::UMSBackgroundPoller::~UMSBackgroundPoller.LIBCMTD ref: 00007FFDA33EA1B8
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Background$Concurrency::details::DebuggerPollerPoller::~Present
                      • String ID:
                      • API String ID: 4075439979-0
                      • Opcode ID: 4f542e26e731fd00f31c42eae512c2e8627068d099c39842e28a5aa6637ad39c
                      • Instruction ID: 7ad5175a0a1612eb17e5d7f0aaf3fa935b325634a4906e1081641dcb65aa2b9b
                      • Opcode Fuzzy Hash: 4f542e26e731fd00f31c42eae512c2e8627068d099c39842e28a5aa6637ad39c
                      • Instruction Fuzzy Hash: 5031A321A0DAC285E731A660A41037FBBD2EB95308F600135F2CC5578BCF6ED644CF18
                      Function 00007FFDA3408890 Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EnumLocalesSystem__vcrt_getptd
                      • String ID:
                      • API String ID: 2567233846-0
                      • Opcode ID: 7b2d004eacf02d25b92e14ee8f2f37d71ea357ee9417f9a6a6da57917b359887
                      • Instruction ID: fa08d172efb68f2c9d295f693ea57d5ebaaeb694bd628d8d6e180f9fcfc01a9f
                      • Opcode Fuzzy Hash: 7b2d004eacf02d25b92e14ee8f2f37d71ea357ee9417f9a6a6da57917b359887
                      • Instruction Fuzzy Hash: 42312876B1DB45C6EB609F05E19032AB7A1F788B44F404025EA8D97BAACFBDD444CF09
                      Function 00007FFDA3409280 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: InfoLocale__vcrt_getptd
                      • String ID:
                      • API String ID: 1029264659-0
                      • Opcode ID: d1d3a85237711d64952f98bf0e9845070d6dd9a18eff46cb6e869a70e11511de
                      • Instruction ID: fc2ff742fbbf274afab1bc35f7fa3815198e8dfb3be06a7d3a023e764aea8919
                      • Opcode Fuzzy Hash: d1d3a85237711d64952f98bf0e9845070d6dd9a18eff46cb6e869a70e11511de
                      • Instruction Fuzzy Hash: 7E114C72B1D64186E7609B21E09133EB3A2EBC8744F500535E68ED3BAADBBDD9418F04
                      Function 00007FFDA34089A0 Relevance: 3.0, APIs: 2, Instructions: 40COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EnumLocalesSystem__vcrt_getptd
                      • String ID:
                      • API String ID: 2567233846-0
                      • Opcode ID: c055a89d8a2898f3bb5920c1aae21bc9380ef3765413dc8376197615c10f9c0d
                      • Instruction ID: f3edc5dca27d1d75e98c6c487cbf29728123ecb3ee4fce767c7ef62ad5e7141b
                      • Opcode Fuzzy Hash: c055a89d8a2898f3bb5920c1aae21bc9380ef3765413dc8376197615c10f9c0d
                      • Instruction Fuzzy Hash: CA111936B0DA0586EB209F15E15032A77A1F7C9B58F500125EA8D93BAACF7DD980CF08
                      Function 00007FFDA34087C0 Relevance: 3.0, APIs: 2, Instructions: 28COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EnumLocalesSystem__vcrt_getptd
                      • String ID:
                      • API String ID: 2567233846-0
                      • Opcode ID: 12e759eca6b0cfd629ea6a96c9cd563e1f1b3dad6c557c75f2d021fa3014a688
                      • Instruction ID: 8f78e0b71903330184545d72a4e175535b0a2bc47c7738345373943616c9e951
                      • Opcode Fuzzy Hash: 12e759eca6b0cfd629ea6a96c9cd563e1f1b3dad6c557c75f2d021fa3014a688
                      • Instruction Fuzzy Hash: F6016D36B0DA4582EB20DF15E85032977A1F789748F504031DA8C93BA6CF7DD540CF08
                      Function 00007FFDA33EF170 Relevance: 3.0, APIs: 2, Instructions: 27COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_fast_encode_pointer$EnumLocalesSystem
                      • String ID:
                      • API String ID: 662996568-0
                      • Opcode ID: 8500853760b204b4756391cb09f5e59036db37f39508a77aa2ffd65fadc136ee
                      • Instruction ID: c868af279bb3ba641bf4833af52348cfa9dae3330d434f1d4b052ebb0fc3c515
                      • Opcode Fuzzy Hash: 8500853760b204b4756391cb09f5e59036db37f39508a77aa2ffd65fadc136ee
                      • Instruction Fuzzy Hash: 30F0C232B0EA4186EB20FB24F42116E63A2EBC4740F514135E68D9376BDD3ED554CB04
                      Function 00007FFDA33C5110 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: InfoSystem
                      • String ID:
                      • API String ID: 31276548-0
                      • Opcode ID: d1689f122893116965ef1724d719bf8066e6c641df62639e2a32a82f2996dad8
                      • Instruction ID: 447cb427616f027bc8db69abb6f14932c59e5b2bf15d3a8e37d2eb37c1f06b4d
                      • Opcode Fuzzy Hash: d1689f122893116965ef1724d719bf8066e6c641df62639e2a32a82f2996dad8
                      • Instruction Fuzzy Hash: 5B31082661EE848ADAB0DB19E49032AB7E1F788785F104135EACE83B59DF3DD5548F04
                      Function 00007FFDA33EFDA0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: InfoLocaletry_get_function
                      • String ID:
                      • API String ID: 2200034068-0
                      • Opcode ID: 5db1a002286ca6792d96cd845c33021881b4f720f0a83afb2070f303a5c7db0e
                      • Instruction ID: 383e07835159b41d55aed13fe9ed62da666e2fab8beed859e4db0063cadb72a6
                      • Opcode Fuzzy Hash: 5db1a002286ca6792d96cd845c33021881b4f720f0a83afb2070f303a5c7db0e
                      • Instruction Fuzzy Hash: 0401F336A1DB8083D640AB55F49061EB7A2F7C4780F204125EA8E53B69CF3CE4508F40
                      Function 00007FFDA33F09F0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: HeapProcess
                      • String ID:
                      • API String ID: 54951025-0
                      • Opcode ID: b2a667e28e87832ec66f5266ccc4fd43e079061d5881dc1b3653628be99bfe92
                      • Instruction ID: 711a967a965f86cbba032661cbe979ff511643858c389e90f818843ef960fc82
                      • Opcode Fuzzy Hash: b2a667e28e87832ec66f5266ccc4fd43e079061d5881dc1b3653628be99bfe92
                      • Instruction Fuzzy Hash: EED01265F0FE0A85FA017B28ADAA33113926F55300F931030C01D36353AE6F29D96A18
                      Function 00007FFDA33B6350 Relevance: .2, Instructions: 212COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6b63dc51a47b69cfddc3f97b3f5d6c1b1056115d90e1b9738a793a8673927561
                      • Instruction ID: cfb607ea738e9e4571f26741de2e0cd512c62d2448d003c7ac6e712ff3ee1f46
                      • Opcode Fuzzy Hash: 6b63dc51a47b69cfddc3f97b3f5d6c1b1056115d90e1b9738a793a8673927561
                      • Instruction Fuzzy Hash: 86A121B270A6418BE755CF1DE56232AB6E1F788304F44413AD69DDA799DB3EE804CF08
                      Function 00007FFDA34105D0 Relevance: .0, Instructions: 42COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 2728c3164c45c51d6692b81b631d2a991d702de87bf579fa2b8dab9705ce9728
                      • Instruction ID: 136bcaf4c0d2720b01291ac49c23bfc391976d7906a88c2ab853652802f4b96d
                      • Opcode Fuzzy Hash: 2728c3164c45c51d6692b81b631d2a991d702de87bf579fa2b8dab9705ce9728
                      • Instruction Fuzzy Hash: 96113CB271A7418BEB95CF18E466325B7A1F748784F40883ADA8C97769DA3EE040CB04
                      Function 00007FFDA33E848F Relevance: 70.4, APIs: 19, Strings: 21, Instructions: 417fileCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _invoke_watson_if_error$_aligned_msize$__vcrt_lock$FileWrite_wcsftime_l
                      • String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szOutMessage, 4096, szLineMessage)$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
                      • API String ID: 2594007075-2011695164
                      • Opcode ID: c271f64b48b8d6028f6e97b235f35820397d6ef7177391b8176f02683d63f804
                      • Instruction ID: 0f67b50c8cf7ce44a741c776a4078b7fddd3be5e3e519fda54e2e45c2d0e4f33
                      • Opcode Fuzzy Hash: c271f64b48b8d6028f6e97b235f35820397d6ef7177391b8176f02683d63f804
                      • Instruction Fuzzy Hash: CA428E31A0EF8685E720DB54E4603EAB3A2FB84744F500135D68C67BAADFBED544CB45
                      Function 00007FFDA33B4660 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 260memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ByteCharComputeMallocaMultiSchedulerScheduler::_SizeWide$AllocaMarkString__crt_scoped_stack_ptr_freea_crtnew[]
                      • String ID: D:\a\_work\1\s\src\vctools\crt\github\stl\src\StlLCMapStringA.cpp
                      • API String ID: 281087614-1965808974
                      • Opcode ID: d5e4fe1378a701d200afebc894e96e297c2e5246de5f1556090ba9d79a503733
                      • Instruction ID: 46931239f34ba1c900420498ac1b428edd1dd7b678f514d96d970ebe6b5a54a1
                      • Opcode Fuzzy Hash: d5e4fe1378a701d200afebc894e96e297c2e5246de5f1556090ba9d79a503733
                      • Instruction Fuzzy Hash: D9E11832A0DA8196E760EF14F4617AAB7A1FB84744F004135E6CD93B9ADF7DD844CB48
                      Function 00007FFDA33BB780 Relevance: 52.9, APIs: 27, Strings: 3, Instructions: 365COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Frame__vcrt_getptd$Handler3::$BlockState$HandlerUnwind$Affinity::operator!=BaseConcurrency::details::ControlEstablisherExceptionFac_nodeFac_node::_FeatureFileFromHandler4::HardwareHeaderImageIs_bad_exception_allowedMap::endMap::iterator::operator++PresentProcessorRaiseSearchThrow_aligned_msizestd::_std::bad_alloc::bad_allocweak_ptr
                      • String ID: csm$csm$csm
                      • API String ID: 1809479727-393685449
                      • Opcode ID: bf09e0a0b19e1228f311d368da1003ed58b21fdace539fb0a8770dfe275d912a
                      • Instruction ID: dddafdaea4c3a9a624b37b1b8ab14e4dd90f83e3e6fdba0b18cff07ccdf68efd
                      • Opcode Fuzzy Hash: bf09e0a0b19e1228f311d368da1003ed58b21fdace539fb0a8770dfe275d912a
                      • Instruction Fuzzy Hash: BA12FA32A0EAC596EA70AF15E0603EEB762FB85780F404136DACD57B9ADF2DD544CB04
                      Function 00007FFDA33F54E0 Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 289memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ComputeMallocaSchedulerScheduler::_Size$AllocaByteCharMarkMultiWide__crt_scoped_stack_ptr_freea_crtnew[]
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\lcmapstringa.cpp
                      • API String ID: 2182855091-1038314930
                      • Opcode ID: 9314e0ad4790d2362bdb13c931a1b863512f53b4882c53aacd6c0a23d7032de3
                      • Instruction ID: 28c89b3889e7411c51a9fe34d91f1108ed71abd4df5a0beeb2a846dcebfcae14
                      • Opcode Fuzzy Hash: 9314e0ad4790d2362bdb13c931a1b863512f53b4882c53aacd6c0a23d7032de3
                      • Instruction Fuzzy Hash: FBF10732A0EA8186E720EB14F0617ABB7A1FB84750F400535E68D97B9ADF7DD845CF48
                      Function 00007FFDA340D0E0 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 183COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _aligned_msize_invoke_watson_if_error$_controlfp_sfegetenv
                      • String ID: $1#IND$1#INF$1#QNAN$1#SNAN$__acrt_fltout$minkernel\crts\ucrt\src\appcrt\convert\cfout.cpp$strcpy_s(result, result_count, "0")$strcpy_s(result, result_count, "1#IND" )$strcpy_s(result, result_count, "1#INF" )$strcpy_s(result, result_count, "1#QNAN")$strcpy_s(result, result_count, "1#SNAN")
                      • API String ID: 436164602-1152488507
                      • Opcode ID: 9b9d06ee7e729aaba72ca9a994346d9ff580f042a12030f9f201cc4911a6fc33
                      • Instruction ID: 182cc6c7a60e7a9da9868f223e35893817b5c6f9160b5a993857988ecaed1927
                      • Opcode Fuzzy Hash: 9b9d06ee7e729aaba72ca9a994346d9ff580f042a12030f9f201cc4911a6fc33
                      • Instruction Fuzzy Hash: 09A1813270EB8185EB60DB14E4603EAB762FB85744F504131E68D977AACF7ED548CB44
                      Function 00007FFDA33C0CF0 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_CriticalHandleLock::_ModuleReentrantScoped_lockScoped_lock::~__invoke_watson_if_error
                      • String ID: File: $Line: $Module: $(*_errno())$...$@$@$Expression: $Microsoft Visual C++ Runtime Library$_CrtDbgReport: String too long or IO Error$common_message_window$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character()))$wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error")
                      • API String ID: 2724354428-1800103407
                      • Opcode ID: 10e474b22dab34d55a2a65b82702c6f16af6fdab5d385a83624ae216738bf468
                      • Instruction ID: be14170d5d3ffb6ba3bcf72e95478e94b8187d26aadbd4a942f898cf3e426a3e
                      • Opcode Fuzzy Hash: 10e474b22dab34d55a2a65b82702c6f16af6fdab5d385a83624ae216738bf468
                      • Instruction Fuzzy Hash: F402D432A0EFC685E7709B54E4543EAB3A6F788344F500135D68D62B9AEF7ED588CB04
                      Function 00007FFDA33C0610 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 296COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_CriticalHandleLock::_ModuleReentrantScoped_lockScoped_lock::~__invoke_watson_if_error
                      • String ID: File: $Line: $Module: $(*_errno())$...$@$@$Expression: $Microsoft Visual C++ Runtime Library$_CrtDbgReport: String too long or IO Error$common_message_window$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character()))$wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error")
                      • API String ID: 2724354428-1800103407
                      • Opcode ID: ec85101ae0b82a8c0260718b9dca904d5525853c0eaf98112ce584647ef15a5a
                      • Instruction ID: ca24b7012160259d417c2688a3a100fb78173584e1bf8cc5dd25e56b25c32067
                      • Opcode Fuzzy Hash: ec85101ae0b82a8c0260718b9dca904d5525853c0eaf98112ce584647ef15a5a
                      • Instruction Fuzzy Hash: 5802063660EFC694E7709B58E4943EAB3A5F788340F504135C68D62BAADF7ED188CB04
                      Function 00007FFDA3408270 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 227COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Name$FromLocale$FrameHandler2_invoke_watson_if_error$CountryDintLangLanguageTranslate$CodeDefaultPageValid__vcrt_getptd
                      • String ID: __acrt_get_qualified_locale$minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp$utf8$wcsncpy_s(lpOutStr->szCodePage, (sizeof(*__countof_helper(lpOutStr->szCodePage)) + 0), L"utf8", 5)$wcsncpy_s(lpOutStr->szLocaleName, (sizeof(*__countof_helper(lpOutStr->szLocaleName)) + 0), _psetloc_data->_cacheLocaleName, wcslen
                      • API String ID: 3507049149-3002009667
                      • Opcode ID: 866301094b8bb1080e8a0453475e6613bfc52b814bf7f7847756db4fccd5e0d5
                      • Instruction ID: 9d5f33723eeb24957c616c390c8dd44402182873fe23386bf2507653405c5328
                      • Opcode Fuzzy Hash: 866301094b8bb1080e8a0453475e6613bfc52b814bf7f7847756db4fccd5e0d5
                      • Instruction Fuzzy Hash: C8B16431B1EB4581EB909B15E46037E67A1FBC5B84F004035EA8ED7BA6DF7ED4418B48
                      Function 00007FFDA33F1DC0 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 123COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $__acrt_report_runtime_error$minkernel\crts\ucrt\src\appcrt\internal\report_runtime_error.cpp$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"\n\n")$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), message)$wcscpy_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)
                      • API String ID: 0-4242594854
                      • Opcode ID: b72e0e5072f2f58cc13357e6830d88b576d2ab8e5d7225c056aceaecdb236142
                      • Instruction ID: a602b89ffe8185567102462660c87a1e4cdebab0a9eb1e18e50e00ac34037168
                      • Opcode Fuzzy Hash: b72e0e5072f2f58cc13357e6830d88b576d2ab8e5d7225c056aceaecdb236142
                      • Instruction Fuzzy Hash: A451A461B1EA4781EA00DB94E4703BA6362FF84784F801036E58DB77A6DF7ED508C748
                      Function 00007FFDA33BBF50 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 320COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$Frame$BlockHandler4::$Affinity::operator!=BaseConcurrency::details::ControlExceptionFeatureFileFromHandler3::HardwareHeaderImageIs_bad_exception_allowedMap::endMap::iterator::operator++PresentProcessorRaiseReadStateThrowUnsigned_aligned_msizestd::bad_alloc::bad_allocweak_ptr
                      • String ID: csm$csm$csm
                      • API String ID: 355487763-393685449
                      • Opcode ID: 0998baa1da9862e498e580302e8692c3a05fd5b3a7b5eb081f9ac8f3de89bf79
                      • Instruction ID: 38f8a7f264e1aa33592af55c40aa259ae69f8b478cd052c6fb38234ab48553ef
                      • Opcode Fuzzy Hash: 0998baa1da9862e498e580302e8692c3a05fd5b3a7b5eb081f9ac8f3de89bf79
                      • Instruction Fuzzy Hash: 4B02D872A0DBC685EA70AF15E4A03EE7766FB84780F400132DA8E57B9ADF6DD540CB44
                      Function 00007FFDA33EC210 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 311COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _aligned_msize_invoke_watson_if_error
                      • String ID: _expandlocale$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscpy_s(output, sizeInChars, L"C")$wcscpy_s(output, sizeInChars, cacheout)$wcsncpy_s(cachein, cacheinLen, expr, charactersInExpression + 1)$wcsncpy_s(cacheout, cacheoutLen, expr, charactersInExpression + 1)
                      • API String ID: 1871870440-3176433880
                      • Opcode ID: cd7bdb26e0607fde83d9e3e4851e908c7887389ba976404d9a022d59015ee09a
                      • Instruction ID: 9b91659d161a4339ee5ec13bc934ffd18d05385bf08ce86b09b7eaf53928b4c7
                      • Opcode Fuzzy Hash: cd7bdb26e0607fde83d9e3e4851e908c7887389ba976404d9a022d59015ee09a
                      • Instruction Fuzzy Hash: F5F1522170EB8685EB60AB55E4A03BEB3A1FBC4784F500032EA8D9779ADF3DD445CB44
                      Function 00007FFDA3407890 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 295COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error$DefaultTest$CountryLanguage__vcrt_getptd
                      • String ID: LangCountryEnumProcEx$minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp$wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), lpLocaleString, wcsle
                      • API String ID: 1590502640-1260670789
                      • Opcode ID: ee538b87de4460d39f367fc7d112bda04ff2f871a9f5773a073f9512fd9bc784
                      • Instruction ID: 00b2f6593bedff539f5a058db3b152569f4150e409ed0ec43e8432ba580e6541
                      • Opcode Fuzzy Hash: ee538b87de4460d39f367fc7d112bda04ff2f871a9f5773a073f9512fd9bc784
                      • Instruction Fuzzy Hash: 52E15F3271EB8682EB50DB15E4607AAB7A1FBC5B44F400032EA4EA7796DFBDD404CB45
                      Function 00007FFDA33EBEF0 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 153COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: @$_.,$__lc_wcstolc$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(names->szCodePage, (sizeof(*__countof_helper(names->szCodePage)) + 0), &wlocale[1], 16-1)$wcsncpy_s(names->szCodePage, (sizeof(*__countof_helper(names->szCodePage)) + 0), wlocale, len)$wcsncpy_s(names->szCountry, (sizeof(*__countof_helper(names->szCountry)) + 0), wlocale, len)$wcsncpy_s(names->szLanguage, (sizeof(*__countof_helper(names->szLanguage)) + 0), wlocale, len)
                      • API String ID: 3803822016-3419562524
                      • Opcode ID: a9fe592d84a112007c8cf7c0aa99f37d9428e9899d7d2b5aad56d1e2b44bc18a
                      • Instruction ID: 5504f99e60654eec561c6f28214f22973feeeafd3b5cc831ceea19d13f8cfa8b
                      • Opcode Fuzzy Hash: a9fe592d84a112007c8cf7c0aa99f37d9428e9899d7d2b5aad56d1e2b44bc18a
                      • Instruction Fuzzy Hash: 9C71E921B1EB4281EB509B95E46037EB792FB84794F100036FA8EA3796DF7DD484CB48
                      Function 00007FFDA33F4E20 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 210COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_unique_heap_ptr$Concurrency::details::_ErrorFrameHandler2LastSchedulerScheduler::__invoke_watson_if_error
                      • String ID: __acrt_GetLocaleInfoA$minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp$minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp$p$strncpy_s(*char_result, local_length, local_buffer, local_length - 1)
                      • API String ID: 3110704897-488823214
                      • Opcode ID: 55e9933a8d58cb8aec62eeba6b0138c9e013a6959cd77db9a5623af543bdf76c
                      • Instruction ID: 3919a4bd1f36665b43513eedeb43e49670fd23342e0a50c600b6e272c89517c0
                      • Opcode Fuzzy Hash: 55e9933a8d58cb8aec62eeba6b0138c9e013a6959cd77db9a5623af543bdf76c
                      • Instruction Fuzzy Hash: 29B17F3270EA8196E660EF55E4653AAB3A1FBC5750F900231E69D57BAACF3ED404CF04
                      Function 00007FFDA33E7290 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 163COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_fast_decode_pointer$Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr
                      • String ID: $minkernel\crts\ucrt\src\appcrt\startup\onexit.cpp$w
                      • API String ID: 199476976-1128704900
                      • Opcode ID: f4b3b9bb29889614743dc1214dfee08ca93f4830b3ad66e5362a21e5b39f7846
                      • Instruction ID: a405c908b5eae6a5c5366c3928815d200dc5be953f4650901b9110f14f02058a
                      • Opcode Fuzzy Hash: f4b3b9bb29889614743dc1214dfee08ca93f4830b3ad66e5362a21e5b39f7846
                      • Instruction Fuzzy Hash: FA91F63660EF8881DA60AB09F49036EB7A1F7C4B80F504126EACE57B6ADF7DD444CB44
                      Function 00007FFDA33BE4E0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 147COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$CreateDestroyedExceptionFeatureFrameInfoObjectPresentProcessor__except_validate_context_record_guard_icall_checks_enforced
                      • String ID: csm
                      • API String ID: 3184727546-1018135373
                      • Opcode ID: 139f7a1e12bc6556fc06f1036e3123e7929c0da28db55a71e5398668c79a93c9
                      • Instruction ID: d873fd4fd4a71a24a58f946f31f89e553761cb5b7232e4402146108507fd1800
                      • Opcode Fuzzy Hash: 139f7a1e12bc6556fc06f1036e3123e7929c0da28db55a71e5398668c79a93c9
                      • Instruction Fuzzy Hash: 73810876709F8482EA60EF19E09136AA7A5F7C8B84F100136EACE577A6DF7DD440CB04
                      Function 00007FFDA3404BD0 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 488COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr$ErrorFrameHandler2Last__free_lconv_mon_invoke_watson_if_errorfix_grouping
                      • String ID: %ls$b$minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp$minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp$ploci->lconv_mon_refcount > 0
                      • API String ID: 2442329127-3874830589
                      • Opcode ID: d0a2d60585901f321412af2fe9470b61405d8d48020609ba67ed245679d3a961
                      • Instruction ID: 73c05a9eb6dc5017e10d03fca856fe343cd3cae72f3ba5a83a882270dd8040a6
                      • Opcode Fuzzy Hash: d0a2d60585901f321412af2fe9470b61405d8d48020609ba67ed245679d3a961
                      • Instruction Fuzzy Hash: 4B32383271DA8086E750DB19F4617AAA7A1F7C8784F404136FA8E97BAADF7DC440CB44
                      Function 00007FFDA3405660 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 274COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_unique_heap_ptr$new[]$ErrorFrameHandler2Last__free_lconv_num_invoke_watson_if_errorfix_grouping
                      • String ID: %ls$`$minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp$minkernel\crts\ucrt\src\appcrt\locale\initnum.cpp$ploci->lconv_num_refcount > 0
                      • API String ID: 1614803766-677296962
                      • Opcode ID: 066859eba395312e9b06a34750c8e8fa3d99ba5d53dc21b8268d2c76eff4fcab
                      • Instruction ID: 29c368cb93cccb459d705b1db975acb953400c124b6c71dde54f64c2d972a37d
                      • Opcode Fuzzy Hash: 066859eba395312e9b06a34750c8e8fa3d99ba5d53dc21b8268d2c76eff4fcab
                      • Instruction Fuzzy Hash: CDE13D3270DB8585E750DB19E46036AB7A2F7C5790F104035EA8E97BAACF7ED444CB44
                      Function 00007FFDA33AC080 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 182COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
                      • String ID: "string iterator range transposed"$"string iterators in range are from different containers"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$string iterator range transposed$string iterators in range are from different containers
                      • API String ID: 3053331623-2392782883
                      • Opcode ID: 26f7ce7555c5a796e48c2d23b8dec561da8d3d0c66c1ca46d4a24f71e7ba5a38
                      • Instruction ID: 6069b4f3257ad81bd8271f22ce5a07e0fec6501cd2be7eee2e2dbd10397b2eb2
                      • Opcode Fuzzy Hash: 26f7ce7555c5a796e48c2d23b8dec561da8d3d0c66c1ca46d4a24f71e7ba5a38
                      • Instruction Fuzzy Hash: 9D61C232F0EF8685EA10FB50E8602A973A5FB49B94F404631DA5C577A6DF7EE451C308
                      Function 00007FFDA33FFC50 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 202COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA33FFE71
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FFEA7
                        • Part of subcall function 00007FFDA3400690: type_info::_name_internal_method.LIBCMTD ref: 00007FFDA34006B4
                        • Part of subcall function 00007FFDA3400080: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA34000A0
                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA33FFF77
                        • Part of subcall function 00007FFDA3400640: __CxxFrameHandler2.LIBCMTD ref: 00007FFDA3400678
                      • _invoke_watson_if_error.LIBCMTD ref: 00007FFDA33FFFF4
                      • __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA340003F
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$FrameHandler2SchedulerScheduler::___crt_unique_heap_ptr_invoke_watson_if_errortype_info::_name_internal_method
                      • String ID: %ls$*$?$common_expand_argv_wildcards$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp$result != nullptr$traits::tcsncpy_s( character_it, character_count - (character_it - character_first), *it, count)
                      • API String ID: 1749167088-976376051
                      • Opcode ID: e860be28f1fe20ce608543e461c161294c316ea13270940263990b1780f67073
                      • Instruction ID: 3f3fef86bdb3326ed93c1c94075cdf5d1e751acd0e83e1201492a115e48d2779
                      • Opcode Fuzzy Hash: e860be28f1fe20ce608543e461c161294c316ea13270940263990b1780f67073
                      • Instruction Fuzzy Hash: 4AB12C3270EA8185E760EB14F4603AEB7A2FB84744F504036E68E97BAADF7DD444CB44
                      Function 00007FFDA33E5FB0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 177COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$C:\Windows\system32\rundll32.exe$common_configure_argv$minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp$mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments
                      • API String ID: 0-3640153138
                      • Opcode ID: d09149e625bf81b5a31bc15359cef03db56dd8d0f7ea69d2475e42afe684bbf7
                      • Instruction ID: 90d8dd5d466bf98156bbe6a27493c62c34b1d71886c25909d67944d6b0a22d48
                      • Opcode Fuzzy Hash: d09149e625bf81b5a31bc15359cef03db56dd8d0f7ea69d2475e42afe684bbf7
                      • Instruction Fuzzy Hash: 8E911232B1EA8196E760EB15E4613AFB3A2FBC0340F504135E68D56BAADF7ED444CB44
                      Function 00007FFDA33E6C40 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00007FFDA33E6BC0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA33E6C07
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33E6C90
                        • Part of subcall function 00007FFDA33B4EB0: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33B4EBE
                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FFDA33E6CF4
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33E6D3E
                      • __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33E6D59
                        • Part of subcall function 00007FFDA33B4E90: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33B4E9E
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$CriticalLock::_ReentrantSchedulerScheduler::_Scoped_lockScoped_lock::~___crt_unique_heap_ptr$__crt_scoped_stack_ptr
                      • String ID: create_environment$minkernel\crts\ucrt\src\desktopcrt\env\environment_initialization.cpp$minkernel\crts\ucrt\src\desktopcrt\env\environment_initialization.cpp$s$traits::tcscpy_s(variable.get(), required_count, source_it)
                      • API String ID: 2249381636-3310917920
                      • Opcode ID: 68e46192bb86b92a7a7cfda4c216aeb9a57ba3da9f5a3f6408c81fe81acd271a
                      • Instruction ID: 2b515da02e773c8648c12363f61895da2c0329d72ef377573917d6ef387c4b6a
                      • Opcode Fuzzy Hash: 68e46192bb86b92a7a7cfda4c216aeb9a57ba3da9f5a3f6408c81fe81acd271a
                      • Instruction Fuzzy Hash: DD51FE3161EE8191E640EB55E4613AEA7A2FBC0784F900032F68E57BABDF7ED504CB44
                      Function 00007FFDA33F5280 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 125memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\getstringtypea.cpp, xrefs: 00007FFDA33F5384
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ComputeMallocaSchedulerScheduler::_Size$AllocaByteCharMarkMultiStringTypeWide_freea_crtnew[]
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\getstringtypea.cpp
                      • API String ID: 3292198129-24854585
                      • Opcode ID: bce047b63fa49beee3826ef959600ed0ab43e950747522ea379c54cd66c73046
                      • Instruction ID: 9ca83e80f96959defb40f6e7e27accf29d845e38c59c0a8261b7b2bded834305
                      • Opcode Fuzzy Hash: bce047b63fa49beee3826ef959600ed0ab43e950747522ea379c54cd66c73046
                      • Instruction Fuzzy Hash: 63513F32A1EA8186E650EB14F0613AEB7A1EBC4780F504036F68D57BAADF7DD445CF44
                      Function 00007FFDA33EE1C0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 81COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$parse_bcp47_region$wcsncat_s(names->szLocaleName, (sizeof(*__countof_helper(names->szLocaleName)) + 0), L"-", 1)$wcsncat_s(names->szLocaleName, (sizeof(*__countof_helper(names->szLocaleName)) + 0), section.ptr, section.length)$wcsncpy_s(names->szCountry, (sizeof(*__countof_helper(names->szCountry)) + 0), section.ptr, section.length)
                      • API String ID: 0-2181462380
                      • Opcode ID: 47453c7cc1b63eebcb5cfa0032895cc021fcb9a56d70373c1bf3985d244e0112
                      • Instruction ID: 65e34b330037928ea163e58825d5f4729e43bccab4714fd21fa572ce4a783650
                      • Opcode Fuzzy Hash: 47453c7cc1b63eebcb5cfa0032895cc021fcb9a56d70373c1bf3985d244e0112
                      • Instruction Fuzzy Hash: 40419335B0DF0681EB00DF95E0643AA67A2FB85784F604036EA8C677AACF7ED545CB44
                      Function 00007FFDA33B78E0 Relevance: 18.1, APIs: 12, Instructions: 88COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • weak_ptr.LIBCPMTD ref: 00007FFDA33B791C
                        • Part of subcall function 00007FFDA33B7EA0: Mailbox.LIBCMTD ref: 00007FFDA33B7EBB
                      • weak_ptr.LIBCPMTD ref: 00007FFDA33B792E
                      • __FrameHandler4::TryBlockMap::setBuffer.LIBVCRUNTIMED ref: 00007FFDA33B7957
                        • Part of subcall function 00007FFDA33B7F40: __FrameHandler4::TryBlockMap::DecompTryBlock.LIBVCRUNTIMED ref: 00007FFDA33B7F65
                        • Part of subcall function 00007FFDA33B7F40: weak_ptr.LIBCPMTD ref: 00007FFDA33B7F74
                        • Part of subcall function 00007FFDA33B7F40: __FrameHandler4::TryBlockMap::iterator::operator++.LIBVCRUNTIMED ref: 00007FFDA33B7F80
                        • Part of subcall function 00007FFDA33B7F40: __FrameHandler4::TryBlockMap::iterator::operator!=.LIBVCRUNTIMED ref: 00007FFDA33B7F8F
                        • Part of subcall function 00007FFDA33B7F40: __FrameHandler4::TryBlockMap::DecompTryBlock.LIBVCRUNTIMED ref: 00007FFDA33B7FA0
                      • weak_ptr.LIBCPMTD ref: 00007FFDA33B7969
                      • __FrameHandler4::TryBlockMap::iterator::operator++.LIBVCRUNTIMED ref: 00007FFDA33B7975
                      • __FrameHandler4::TryBlockMap::end.LIBVCRUNTIMED ref: 00007FFDA33B7987
                        • Part of subcall function 00007FFDA33B7ED0: Mailbox.LIBCMTD ref: 00007FFDA33B7EF0
                      • __FrameHandler4::TryBlockMap::iterator::operator!=.LIBVCRUNTIMED ref: 00007FFDA33B7994
                      • weak_ptr.LIBCPMTD ref: 00007FFDA33B79E2
                      • __FrameHandler4::TryBlockMap::iterator::operator!=.LIBVCRUNTIMED ref: 00007FFDA33B79EF
                      • __FrameHandler4::TryBlockMap::iterator::operator=.LIBVCRUNTIMED ref: 00007FFDA33B7A05
                      • __FrameHandler4::TryBlockMap::iterator::operator=.LIBVCRUNTIMED ref: 00007FFDA33B7A14
                      • __FrameHandler4::TryBlockMap::setBuffer.LIBVCRUNTIMED ref: 00007FFDA33B7A4C
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Block$FrameHandler4::$weak_ptr$Map::iterator::operator!=$BufferDecompMailboxMap::Map::iterator::operator++Map::iterator::operator=Map::set$Map::end
                      • String ID:
                      • API String ID: 1199089005-0
                      • Opcode ID: ad7073c6521db1bca736442fe445ea7c7db349a4124ef125c6fd5e4a6fc681f9
                      • Instruction ID: d8be231acdc61e63f9f06d10af95b7a54da783a408478a941018c1de420fad6d
                      • Opcode Fuzzy Hash: ad7073c6521db1bca736442fe445ea7c7db349a4124ef125c6fd5e4a6fc681f9
                      • Instruction Fuzzy Hash: E9410C2271DAC691DA60EB11E4613FAA362FFC4380F805132EA8D57B9AEF6DD505CB44
                      Function 00007FFDA340D7F0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 389COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: swap_c
                      • String ID: %ls$base != nullptr || num == 0$comp != nullptr$minkernel\crts\ucrt\src\appcrt\stdlib\qsort.cpp$qsort$width > 0
                      • API String ID: 1232431964-1732429825
                      • Opcode ID: 85df122f781590d8806161d7e43b5edbfb39b2f7021cb754e2a1f4a2915b9811
                      • Instruction ID: 223340e24bc2c6892e2198614ea244ba131c0c80de792800768b4e2c7c21ddbe
                      • Opcode Fuzzy Hash: 85df122f781590d8806161d7e43b5edbfb39b2f7021cb754e2a1f4a2915b9811
                      • Instruction Fuzzy Hash: 2F22FB3670EF8585D7608B15F8903AAB7A1F789790F100436EA8D93B69DFBDD4848B44
                      Function 00007FFDA33ED420 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 336COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: %ls$U$_wsetlocale_set_cat$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscpy_s(pch_cat_locale, cch, lctemp)
                      • API String ID: 2516003560-3082946356
                      • Opcode ID: c8eb01b02451b089905ea562218274eb643adae8c75f2630f504723c01ec1cc6
                      • Instruction ID: 96e7a442b8e7a2a6d98c2c297c27f59181fdff1b263cc4adf304b933ac659943
                      • Opcode Fuzzy Hash: c8eb01b02451b089905ea562218274eb643adae8c75f2630f504723c01ec1cc6
                      • Instruction Fuzzy Hash: D912393670DB818AEB60DB09E09036AB3A5FBC9B94F204126DACD43B69DF3DD541CB00
                      Function 00007FFDA33D1B80 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 225COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: %ls$(ptloci->lc_category[_category].locale != nullptr && ptloci->lc_category[_category].refcount != nullptr) || (ptloci->lc_category[_$I$_wcstombs_s_l(&size, nullptr, 0, outwlocale, 0, &locale)$_wcstombs_s_l(nullptr, outlocale, size, outwlocale, ((size_t)-1), &locale)$minkernel\crts\ucrt\src\appcrt\locale\setlocale.cpp$minkernel\crts\ucrt\src\appcrt\locale\setlocale.cpp$setlocale::<lambda_6c38046ca23c7d1145c0d04476183d70>::operator ()
                      • API String ID: 2516003560-1001218507
                      • Opcode ID: e38feaada14e3a39c8f79b712342996a16b31c30e8de5f4dae98994e6534a8a6
                      • Instruction ID: 45ef03df73fd03e80234bc4f3913376b77cc448fc7e3a21286545f646a32aa30
                      • Opcode Fuzzy Hash: e38feaada14e3a39c8f79b712342996a16b31c30e8de5f4dae98994e6534a8a6
                      • Instruction Fuzzy Hash: 69C13B36709F4486DB60DB5AE09136AB3A5F7C8B84F504126EB8E577AADF3ED440CB04
                      Function 00007FFDA33BD0D0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 208COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Frame$State$Handler3::Handler3::is__vcrt_getptd$EmptyExceptFac_nodeFac_node::_FromHandlerHandler3::getSearchTypesUnwind__except_validate_context_record_guard_icall_checks_enforcedstd::_
                      • String ID: csm$csm
                      • API String ID: 4290830098-3733052814
                      • Opcode ID: a0f1b5ceeae9bf4af84d608ade5b49ede70a3c6a16260c9f149f50f14dfcc554
                      • Instruction ID: 8579722b340ba881f3da5d66d85191711f1537eee8c32778a826df8d9a49e99a
                      • Opcode Fuzzy Hash: a0f1b5ceeae9bf4af84d608ade5b49ede70a3c6a16260c9f149f50f14dfcc554
                      • Instruction Fuzzy Hash: 4FB1E83660DBC581EA70AF55E4603AEB762FBC4790F404136DA8DABB9ACF7DD4418B04
                      Function 00007FFDA33AA000 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 187libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Library$AddressFreeLoadProc_heap_alloc
                      • String ID: AwUEHT9SQR85LihUHCoCAgkdRUYFPTUq$IwUEHRRCRngwIyM=
                      • API String ID: 1286152467-2862589538
                      • Opcode ID: 2bf246147e06804cbdb28bf9ee9fab566995ff85717be2503f230630d808e0f9
                      • Instruction ID: 2ab13604e4ed03703a2eda547841d2da46673c8e0aed2665eb5777c90f570f48
                      • Opcode Fuzzy Hash: 2bf246147e06804cbdb28bf9ee9fab566995ff85717be2503f230630d808e0f9
                      • Instruction Fuzzy Hash: AE916133B0AF8196EB10EF64D4602AC3362FB54B48B409531DA4D67B5ADF3AE9A5C344
                      Function 00007FFDA3396490 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 159libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • DwQfAx1bBmR6KyNd, xrefs: 00007FFDA339651F
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA3396698
                      • AwQZOR1aRQY1Oydw, xrefs: 00007FFDA3396578
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA33966B8
                      • "null pointer cannot point to a block of non-zero size", xrefs: 00007FFDA33966C6
                      • null pointer cannot point to a block of non-zero size, xrefs: 00007FFDA3396677
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFreeLoadProc_heap_alloc
                      • String ID: "null pointer cannot point to a block of non-zero size"$AwQZOR1aRQY1Oydw$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$DwQfAx1bBmR6KyNd$null pointer cannot point to a block of non-zero size
                      • API String ID: 720222215-3131198168
                      • Opcode ID: a4656470fb2fd0a68c6f52c3a50c2879d3924379ce31f04f8cfdb3b9eed31199
                      • Instruction ID: 06ff19a160c8c182e75ba38f329ef21ae098dce5bcf4d6845e599e55b8d0f793
                      • Opcode Fuzzy Hash: a4656470fb2fd0a68c6f52c3a50c2879d3924379ce31f04f8cfdb3b9eed31199
                      • Instruction Fuzzy Hash: 79716F32B19B8286FB00DBA0E8A02AD3776FB84358F500135DA4C67BAADF7DD595C304
                      Function 00007FFDA33A7CA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 143COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • bad locale name, xrefs: 00007FFDA33A7E80
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA33A7CD9
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: std::_$Locinfo::_Lockit$Concurrency::cancel_current_taskGetwctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Xinvalid_argumentnew[]
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale$bad locale name
                      • API String ID: 290572327-1330633677
                      • Opcode ID: d4e0934d1e8b0b957b432f17b2fc36bdb302e2c337fa3a76a90f88e69099a8e0
                      • Instruction ID: 7dafec978a34ce2dc52c6384f3d99f849264a3c0af07d022cb3a8296c672c6f0
                      • Opcode Fuzzy Hash: d4e0934d1e8b0b957b432f17b2fc36bdb302e2c337fa3a76a90f88e69099a8e0
                      • Instruction Fuzzy Hash: 03513C22F0AB8186FB14EBA0D4A02BD3366EF54744F044935DE4D37B96DF3AA5668348
                      Function 00007FFDA33F4C00 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109memoryCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp, xrefs: 00007FFDA33F4CAC
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_$ComputeMallocaSchedulerScheduler::_Size$AllocaCriticalLock::_MarkReentrantScoped_lockScoped_lock::~_new[]
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\getlocaleinfoa.cpp
                      • API String ID: 1097406-2239458481
                      • Opcode ID: 84aca0c0a445223c097501b35c0fd7d6506c7ce4ea80886fabbd887a3224c963
                      • Instruction ID: a244ac9404a952c9c0d0f9e117bf3ad59ba8a1ac5c28370c7652cdb8460671ed
                      • Opcode Fuzzy Hash: 84aca0c0a445223c097501b35c0fd7d6506c7ce4ea80886fabbd887a3224c963
                      • Instruction Fuzzy Hash: 5251FF32B0EE8192E610EB18F46176EB762EBD4780F504035E68D57BAADF3DD845CB44
                      Function 00007FFDA3400080 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 77COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::__invoke_watson_if_error$CriticalLock::_ReentrantSchedulerScheduler::_Scoped_lockScoped_lock::~___crt_unique_heap_ptr
                      • String ID: copy_and_add_argument_to_buffer$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp$traits::tcsncpy_s( argument_buffer.get() + directory_length, required_count - directory_length, file_name, file_name_count)$traits::tcsncpy_s(argument_buffer.get(), required_count, directory, directory_length)
                      • API String ID: 3160871131-1477255430
                      • Opcode ID: 371f814f37a1379d0a7d1c67e7830bcee6c84a779c8bd178b6b47ddd5e03bde4
                      • Instruction ID: 8ec1ca3640e66535198bf58062538e55fc2c96bef29fe2abafcc1f482504006f
                      • Opcode Fuzzy Hash: 371f814f37a1379d0a7d1c67e7830bcee6c84a779c8bd178b6b47ddd5e03bde4
                      • Instruction Fuzzy Hash: 3B415D32A1DA8691DB50DF54E4603EAB762FB80344F500132F68D93BAADF7ED549CB44
                      Function 00007FFDA33BE709 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$Exception$Rethrow$DestroyedObjectRaise
                      • String ID: csm
                      • API String ID: 1015495272-1018135373
                      • Opcode ID: 03e70bdf8d2808a217989a4d3bcd59bad887c0ba59b4aee368f07a0f934de048
                      • Instruction ID: b6274ef35c19e3335c298871ed097fe50ccb1090cff45c88a7faa1a43fd0284d
                      • Opcode Fuzzy Hash: 03e70bdf8d2808a217989a4d3bcd59bad887c0ba59b4aee368f07a0f934de048
                      • Instruction Fuzzy Hash: E021D836A0DA4587EA20EF15E06126E7762FBD4B44F500235FA8E177A6CF7ED940CB08
                      Function 00007FFDA33FD390 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 425stringCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: strrchr
                      • String ID: %ls$a$d$fp_format_a$minkernel\crts\ucrt\src\appcrt\convert\cvt.cpp$p$p$result_buffer_count > static_cast<size_t>(1 + 4 + precision + 6)
                      • API String ID: 3418686817-2728534095
                      • Opcode ID: 92bffb27499dee3a9e84b49fffc1dbb7d362d3f039b5dc6c8e0cf1e02f6d0b28
                      • Instruction ID: 06e50ae2b228d94b5431616c627934262ce771a2665244e8cb33599a0731c9bc
                      • Opcode Fuzzy Hash: 92bffb27499dee3a9e84b49fffc1dbb7d362d3f039b5dc6c8e0cf1e02f6d0b28
                      • Instruction Fuzzy Hash: 6322493260EBC585DBB19B59E4903AEB7A1E784B80F504026DBCD97BA9DF3DD484CB10
                      Function 00007FFDA33FDDC0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 238COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _aligned_msize_invoke_watson_if_error
                      • String ID: %ls$d$e+000$fp_format_e_internal$minkernel\crts\ucrt\src\appcrt\convert\cvt.cpp$result_buffer_count > static_cast<size_t>(3 + (precision > 0 ? precision : 0) + 5 + 1)$strcpy_s( p, result_buffer_count == (static_cast<size_t>(-1)) ? result_buffer_count : result_buffer_count - (p - result_buffer), "
                      • API String ID: 1871870440-2583523412
                      • Opcode ID: 5a6529aece6ef5b6f4db84fea4ad75a3b578d1967d1944f9da742378cfcd9621
                      • Instruction ID: b2c38fe862257463f5d84c8238aad8a8d9b4314d07758fd0cc2e6abc894c8b2e
                      • Opcode Fuzzy Hash: 5a6529aece6ef5b6f4db84fea4ad75a3b578d1967d1944f9da742378cfcd9621
                      • Instruction Fuzzy Hash: 18C15C3271EBC58AD7A0DB19E4A076AB7A1F785784F404125FA8E87B6ACF7DD440CB04
                      Function 00007FFDA33D7380 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 159COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_scoped_stack_ptr
                      • String ID: %ls$2 <= buffer_size_in_bytes && buffer_size_in_bytes <= INT_MAX$@$_setvbuf_internal$minkernel\crts\ucrt\src\appcrt\stdio\setvbuf.cpp$stream.valid()$type == _IONBF || type == _IOFBF || type == _IOLBF
                      • API String ID: 614740146-1022689813
                      • Opcode ID: f94959cb24dd733bb122deacce9b7755d0b21619e9d217c2ceef4018ea14ecee
                      • Instruction ID: a0423f0951044d667b5e14f055b69c0ba0fbaf4044b1ee4cff9ae99d7436719e
                      • Opcode Fuzzy Hash: f94959cb24dd733bb122deacce9b7755d0b21619e9d217c2ceef4018ea14ecee
                      • Instruction Fuzzy Hash: 5B815432B0EB4285E7609F54E4503BAB3A2FB84394F500535E68D63BA6DF7ED548CB05
                      Function 00007FFDA338BE80 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 134COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • bad locale name, xrefs: 00007FFDA338C038
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA338BEB9
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: std::_$Locinfo::_Lockit$Concurrency::cancel_current_taskLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Xinvalid_argumentnew[]
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale$bad locale name
                      • API String ID: 1858072621-1330633677
                      • Opcode ID: eff602550a4a311af9bcac866acda378e071866e33b7d87fcd703d7d21ad5966
                      • Instruction ID: 272e55336719d3d417df17457825629f472cf9c4c69f9c8f62fc6197fd7f35a7
                      • Opcode Fuzzy Hash: eff602550a4a311af9bcac866acda378e071866e33b7d87fcd703d7d21ad5966
                      • Instruction Fuzzy Hash: B0514B22B0EF428AFB14EFA1D4602BD2366AF44788F044435DA4D37B96DF3AE5169348
                      Function 00007FFDA33EBCD0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 45COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: type_info::_name_internal_method
                      • String ID: U$__acrt_copy_locale_name$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(localeNameCopy, cch+1, localeName, cch+1)
                      • API String ID: 3713626258-2007746988
                      • Opcode ID: 7bf6a7fb28342de44239dfdeca1ed818ec414c04707fbe9996b104df62ca845e
                      • Instruction ID: 2d35fcc8a714ba612f014d29c1b79ce163268b1dc578bbbeaeff404e87a7cedc
                      • Opcode Fuzzy Hash: 7bf6a7fb28342de44239dfdeca1ed818ec414c04707fbe9996b104df62ca845e
                      • Instruction Fuzzy Hash: 5B119621B2DE8681EB40AF90E45436BA7A2FB84394F101431F94EA7B56CF7DD004CB04
                      Function 00007FFDA33B7100 Relevance: 15.1, APIs: 10, Instructions: 124COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Read$Unsigned
                      • String ID:
                      • API String ID: 690901639-0
                      • Opcode ID: 209da1193eaf870f7941ce440254645b44e8113ba62e6ca8a84605d7162e9fa3
                      • Instruction ID: b9d2ddd83a13b545a13eaf4fed097681c1989435d02853f965adc20569f47c92
                      • Opcode Fuzzy Hash: 209da1193eaf870f7941ce440254645b44e8113ba62e6ca8a84605d7162e9fa3
                      • Instruction Fuzzy Hash: AD51293260DB4686DB50DF16E46017ABBA1FB85784F400132FACE96796DF2DE501CB44
                      Function 00007FFDA33EA5D0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 191COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$("Invalid signal or error", 0)$minkernel\crts\ucrt\src\appcrt\misc\signal.cpp$raise
                      • API String ID: 0-1223553036
                      • Opcode ID: 516bf2db6e82aa22be2dd32e745519e4b52e00d88e9ddf9e75d36256fb7c6821
                      • Instruction ID: 3d9b650e61fe5eed071a8f34cb4f450a8319e71e530fa104975819b231b0c6fc
                      • Opcode Fuzzy Hash: 516bf2db6e82aa22be2dd32e745519e4b52e00d88e9ddf9e75d36256fb7c6821
                      • Instruction Fuzzy Hash: 49A16F32B0EB8585E7609B55E46036AB7E2FB80784F104035E6CD53B9ADF7EE444CB14
                      Function 00007FFDA33D4BE0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D4BFE
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33D4C08
                        • Part of subcall function 00007FFDA33D25B0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D25C3
                        • Part of subcall function 00007FFDA33D25B0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00007FFDA33D2CC6), ref: 00007FFDA33D25D7
                      • _local_unwind.LIBVCRUNTIME ref: 00007FFDA33D4E57
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr$CriticalEnterSection_local_unwind
                      • String ID: %ls$( (_Stream.is_string_backed()) || (fn = _fileno(_Stream.public_stream()), ((_textmode_safe(fn) == __crt_lowio_text_mode::ansi) && $fgetc$minkernel\crts\ucrt\src\appcrt\stdio\fgetc.cpp$stream.valid()
                      • API String ID: 313521025-2920565024
                      • Opcode ID: 0762fa28031d53997bed490ad42b091f499ddf1ab58876784969df0bda062813
                      • Instruction ID: c1b31959b370fc719f6b8f3b27f86573d836cea7b94ea1e4d17c73f07c175ce1
                      • Opcode Fuzzy Hash: 0762fa28031d53997bed490ad42b091f499ddf1ab58876784969df0bda062813
                      • Instruction Fuzzy Hash: BC719272B1EA4296E650AB14F46137AB3A2FB84394F400531E68D937EADF7EE445CB04
                      Function 00007FFDA33F4900 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 133COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr$new[]
                      • String ID: %ls$minkernel\crts\ucrt\src\appcrt\stdio\_sftbuf.cpp$minkernel\crts\ucrt\src\appcrt\stdio\_sftbuf.cpp$public_stream != nullptr
                      • API String ID: 3113192119-3092436121
                      • Opcode ID: b10df22a2960d3120302fe765c6796b426386d989cdea6afcee9ddd6343ea3c3
                      • Instruction ID: 3ccb97f1b523c377cf288eda3f861f3d5b252ca43950b9710581f9d7b8eb42b5
                      • Opcode Fuzzy Hash: b10df22a2960d3120302fe765c6796b426386d989cdea6afcee9ddd6343ea3c3
                      • Instruction Fuzzy Hash: 50512126B1EE4591EA50EF10E4623BA73A1FF80780F804032E68E57797DF6ED944C758
                      Function 00007FFDA33A39A0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 129COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector, xrefs: 00007FFDA33A3A2E
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector, xrefs: 00007FFDA33A39FB
                      • vector erase iterator outside range, xrefs: 00007FFDA33A39EF
                      • "vector erase iterator outside range", xrefs: 00007FFDA33A3A3C
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "vector erase iterator outside range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$vector erase iterator outside range
                      • API String ID: 593203224-4261514091
                      • Opcode ID: 76189a009c904395e8b8e8e6d19e31612c3155e3afe09d658c4c2b5f16bb63e3
                      • Instruction ID: 7274636672b3be83f9a1669b73ab58c5a2b6f331248b0437212c911cf799a78b
                      • Opcode Fuzzy Hash: 76189a009c904395e8b8e8e6d19e31612c3155e3afe09d658c4c2b5f16bb63e3
                      • Instruction Fuzzy Hash: 9951D122F1EF8282EA10BB11E4615A96366FB44B94F044932EE4D27797DF3FE580C348
                      Function 00007FFDA33C6740 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 89COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C6802
                        • Part of subcall function 00007FFDA33D1950: EnterCriticalSection.KERNEL32(?,?,?,?,00007FFDA33C2645,?,?,?,?,00007FFDA33C2352), ref: 00007FFDA33D1971
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C68C2
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock$CriticalEnterSection
                      • String ID: %ls$_CrtIsValidHeapPointer(block)$_msize_dbg$block != nullptr$is_block_type_valid(header->_block_use)$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp
                      • API String ID: 3216741998-890774455
                      • Opcode ID: 750039d00281e49970b776c88c5e6a09b2a050d3f9995b84e6e326f53c9757f0
                      • Instruction ID: 3eeafe662c5fffcf79afaf697aec18a607bcc013ef38a86b2b733a3493dc2c65
                      • Opcode Fuzzy Hash: 750039d00281e49970b776c88c5e6a09b2a050d3f9995b84e6e326f53c9757f0
                      • Instruction Fuzzy Hash: AE418031B0EF4682F750AB95E46136A73A2FB84394F400535E68D63797DF7ED5488B08
                      Function 00007FFDA33EE0B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$parse_bcp47_language$wcsncpy_s(names->szLanguage, (sizeof(*__countof_helper(names->szLanguage)) + 0), section.ptr, section.length)$wcsncpy_s(names->szLocaleName, (sizeof(*__countof_helper(names->szLocaleName)) + 0), section.ptr, section.length)
                      • API String ID: 0-434028046
                      • Opcode ID: 086031c4aa7e0ec8b1207ce148651107e85bdf6a0b0bb85a76694889363fda4e
                      • Instruction ID: 27657e11a4b1827ffed67825ae27b164fd0945290d10a946bb7b1925a7df0ca9
                      • Opcode Fuzzy Hash: 086031c4aa7e0ec8b1207ce148651107e85bdf6a0b0bb85a76694889363fda4e
                      • Instruction Fuzzy Hash: BB218E35B0DF0681EB00DF95E0603AA67A2FB86784F604032EA8C63766CF3EC445C744
                      Function 00007FFDA33EE340 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$parse_bcp47_script$wcsncat_s(names->szLocaleName, (sizeof(*__countof_helper(names->szLocaleName)) + 0), L"-", 1)$wcsncat_s(names->szLocaleName, (sizeof(*__countof_helper(names->szLocaleName)) + 0), section.ptr, section.length)
                      • API String ID: 0-3653173357
                      • Opcode ID: 269b21cdc08f16a2c8b202b966e83e66d3df29fe05b96ed67baff638ae70a2e1
                      • Instruction ID: b4c36807dcb969427671791a01a01dcf5d82608ac076ed2811c9bd443c3da1d5
                      • Opcode Fuzzy Hash: 269b21cdc08f16a2c8b202b966e83e66d3df29fe05b96ed67baff638ae70a2e1
                      • Instruction Fuzzy Hash: F9219F72B0DB4681EB00DF55E4203AA67A2FB81784F600036DA4C677A6CF7ED145CB48
                      Function 00007FFDA33B4D70 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 28libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: AddressProc$HandleModule
                      • String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
                      • API String ID: 667068680-1247241052
                      • Opcode ID: a4e2da0c230d0ab59e6454ddce9225a1e4a2a95a77d198af233b9c855d1215dc
                      • Instruction ID: 59d116bc7a3fc662849ef80c833970551e1367ab713147ece109a4c1c09009ee
                      • Opcode Fuzzy Hash: a4e2da0c230d0ab59e6454ddce9225a1e4a2a95a77d198af233b9c855d1215dc
                      • Instruction Fuzzy Hash: A9011A76B0AF0291EB15CF54E8701697372FB84780F805232CA8E923B9DFAED659C344
                      Function 00007FFDA340C7A0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 358COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00007FFDA33CBEB0: memcpy_s.LIBCPMTD ref: 00007FFDA33CBF01
                      • Concurrency::details::BoostedObject::IsScheduleGroupSegment.LIBCMTD ref: 00007FFDA340CC69
                      • Concurrency::details::BoostedObject::IsScheduleGroupSegment.LIBCMTD ref: 00007FFDA340CDE4
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: BoostedConcurrency::details::GroupObject::ScheduleSegment$memcpy_s
                      • String ID: %ls$("unexpected input value; log10 failed", 0)$mantissa_buffer_count > 0$minkernel\crts\ucrt\src\appcrt\convert\cfout.cpp$quotient < digits_per_iteration_multiplier
                      • API String ID: 3679209886-1168176157
                      • Opcode ID: c6d220ca1f08300313741bf1151735944456535133c540663f8b9e40caee18c0
                      • Instruction ID: bd9d87f614581be4e1fff4502e3c47fd82e25fa8844ed839f6d135085c027876
                      • Opcode Fuzzy Hash: c6d220ca1f08300313741bf1151735944456535133c540663f8b9e40caee18c0
                      • Instruction Fuzzy Hash: 4E024D3271EA81C6E760DB14E4603AAB7A2FB85740F504136E68DD7B9ADF7ED844CB04
                      Function 00007FFDA33D8680 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 333COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: allocator
                      • String ID: %ls$("Buffer too small", 0)$buffer != nullptr && buffer_count > 0$common_vsnprintf_s$format != nullptr$minkernel\crts\ucrt\src\appcrt\stdio\output.cpp
                      • API String ID: 3447690668-215146566
                      • Opcode ID: e906ac9136e8708702907f70be4dd6a138f8707cc05c3de4a6125306c83af40e
                      • Instruction ID: a69a72de4dab613eba3798f99a742942289779f463c904403379a7676f3f01a0
                      • Opcode Fuzzy Hash: e906ac9136e8708702907f70be4dd6a138f8707cc05c3de4a6125306c83af40e
                      • Instruction Fuzzy Hash: 5502543260EF8285E670EB14E4503AAB3A1F794394F100635E6DD97BDADF7EE4448B44
                      Function 00007FFDA33D7FA0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 331COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: allocator
                      • String ID: %ls$("Buffer too small", 0)$buffer != nullptr && buffer_count > 0$common_vsnprintf_s$format != nullptr$minkernel\crts\ucrt\src\appcrt\stdio\output.cpp
                      • API String ID: 3447690668-215146566
                      • Opcode ID: 778a4bb778b038b28f34dc97b8a25e2231894d58eec8006b92167009fba175a1
                      • Instruction ID: 21fca862d2c70058fcbe0fe5c42307498efa9131ffd289fffafda9a654e24a07
                      • Opcode Fuzzy Hash: 778a4bb778b038b28f34dc97b8a25e2231894d58eec8006b92167009fba175a1
                      • Instruction Fuzzy Hash: 2202313260EFC685E670AB15E4503AAB3A1F7843A4F100635E69D57BDADFBEE4448B04
                      Function 00007FFDA33ECAB0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 271COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _invoke_watson_if_errornew[]
                      • String ID: %ls$_wsetlocale_get_all$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscat_s(pch, cch, L";")
                      • API String ID: 1153070942-4005553098
                      • Opcode ID: dfcc5b51e793630b79af4006db15681db5a16f31b512e495a05cea28834e3b46
                      • Instruction ID: 043509eb7342386550cc35df266f9ba4888626a84cade322df455df28202a164
                      • Opcode Fuzzy Hash: dfcc5b51e793630b79af4006db15681db5a16f31b512e495a05cea28834e3b46
                      • Instruction Fuzzy Hash: A2D17131719F4182EB509B2DE0A436AA7E5F7C4784F201136EA8E977A6DF7ED801CB44
                      Function 00007FFDA33ECFA0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 239COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2__vcrt_getptd_invoke_watson_if_errorwcsncmp
                      • String ID: U$_wsetlocale_nolock$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(lctemp, (sizeof(*__countof_helper(lctemp)) + 0), s, len)
                      • API String ID: 1612499364-2683293910
                      • Opcode ID: 7397175c8a3325ebf6316fdef89d3600f5da24dc91a0b3f82ca763110b2264b9
                      • Instruction ID: dc10e1b90b3acd48815b282163d554467a7684b077ec69e8c23dbd18813805cc
                      • Opcode Fuzzy Hash: 7397175c8a3325ebf6316fdef89d3600f5da24dc91a0b3f82ca763110b2264b9
                      • Instruction Fuzzy Hash: 61C11E3261EF8185EAA09B15E09436EB3E1F7C4B44F201136EA8E57BAADF7DD445CB04
                      Function 00007FFDA33D2CF0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 198COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D2EAF
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr
                      • String ID: %ls$( (_Stream.is_string_backed()) || (fn = _fileno(_Stream.public_stream()), ((_textmode_safe(fn) == __crt_lowio_text_mode::ansi) && $_fputs_internal$minkernel\crts\ucrt\src\appcrt\stdio\fputs.cpp$stream != nullptr$string != nullptr
                      • API String ID: 4164245112-2828079209
                      • Opcode ID: 409574ce8b0703e44f11fa63af3bc4aa38b36d1a29927708b99184bd77aadd06
                      • Instruction ID: 9f108a33dd02f1a42b24fcb60e965c5e958803b813b25be762919682081876b9
                      • Opcode Fuzzy Hash: 409574ce8b0703e44f11fa63af3bc4aa38b36d1a29927708b99184bd77aadd06
                      • Instruction Fuzzy Hash: 9EA19232B0EE4685E7609B14F4513AAB3A2FB84394F004631E68D97BAADF7ED444CB04
                      Function 00007FFDA33BC600 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 166COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: MOC$RCC
                      • API String ID: 2516003560-2084237596
                      • Opcode ID: 12a86d3a138b4f29be788ea48578b449f2fe373d5dd5958e84f32a5192be72ee
                      • Instruction ID: 20a05cc10b80a0cd041566d6b5e5add2b0a92643c4d62067ea8f7e987b81d299
                      • Opcode Fuzzy Hash: 12a86d3a138b4f29be788ea48578b449f2fe373d5dd5958e84f32a5192be72ee
                      • Instruction Fuzzy Hash: 9E91E832A0DBC585E670AF15E4613EAB7A5FB88780F404036EA8D97B9ADF3DD444CB04
                      Function 00007FFDA33D2630 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 158COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00007FFDA33D25B0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D25C3
                        • Part of subcall function 00007FFDA33D25B0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00007FFDA33D2CC6), ref: 00007FFDA33D25D7
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D273B
                      • _local_unwind.LIBVCRUNTIME ref: 00007FFDA33D28E1
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$CriticalEnterSection__crt_scoped_stack_ptr_local_unwind
                      • String ID: %ls$( (_Stream.is_string_backed()) || (fn = _fileno(_Stream.public_stream()), ((_textmode_safe(fn) == __crt_lowio_text_mode::ansi) && $_fputc_internal$minkernel\crts\ucrt\src\appcrt\stdio\fputc.cpp$stream != nullptr
                      • API String ID: 4285291202-2701169811
                      • Opcode ID: eca598c7920edd7bdfb5225e08fcc31fb1bd94ca84df8c0db593462577966e6d
                      • Instruction ID: a3d057105b832eaf7250fd6153296d9c52f4924ef3009623ad8620f4908dc7e6
                      • Opcode Fuzzy Hash: eca598c7920edd7bdfb5225e08fcc31fb1bd94ca84df8c0db593462577966e6d
                      • Instruction Fuzzy Hash: 3C818172B1EB4186E660DB14F46036AB3A2FB84394F505131E68D93BAADF7ED444CF04
                      Function 00007FFDA33A8C70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 130libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$FreeLockitstd::_$AddressLoadLockit::_Lockit::~_Proc
                      • String ID: $AwUEXkoZUTo4$BggZLxRD
                      • API String ID: 2340135649-2507185874
                      • Opcode ID: c388f024239e8c67bb62e528bb34d861bef7605933812308f426aaee1ef4fd7d
                      • Instruction ID: 691e15291963e0dd99feb512d606b362ed7276fbcb1072b0411f99b56d576cfc
                      • Opcode Fuzzy Hash: c388f024239e8c67bb62e528bb34d861bef7605933812308f426aaee1ef4fd7d
                      • Instruction Fuzzy Hash: 9551BD22F1DA818AEB00EFA0E8603AC7772FB44788F440031DE4D66B5ADF79E584C700
                      Function 00007FFDA33C52B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 110COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: swprintf
                      • String ID: $ Data: <%s> %s$%.2X $(*_errno())$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$print_block_data
                      • API String ID: 233258989-578187083
                      • Opcode ID: 2a212a93e4be7943b14a9e27bb6c9c07007684d8760cf4f78970e9aa09300921
                      • Instruction ID: 8347a407502f21dc0b7bfaed34f6835e5fdb9feca4e6d7e3bf0f4f67951e0eda
                      • Opcode Fuzzy Hash: 2a212a93e4be7943b14a9e27bb6c9c07007684d8760cf4f78970e9aa09300921
                      • Instruction Fuzzy Hash: 4E515032A0EB8185E710AB59F4613ABB7A1FB85780F504136EACD53B5ADF7ED048CB44
                      Function 00007FFDA34009B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 103COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr
                      • String ID: W$g$minkernel\crts\ucrt\src\appcrt\startup\argv_wildcards.cpp
                      • API String ID: 4142048518-2829134390
                      • Opcode ID: 6a1a72684fd94be05e8e08e5e76bedbb4c20035cbf3bb34a9e5da8d47bc2f7b4
                      • Instruction ID: d6ee99258e154e9e195ab6d11eabec74ae893685ab8419dc98dfd1ca51ae82a9
                      • Opcode Fuzzy Hash: 6a1a72684fd94be05e8e08e5e76bedbb4c20035cbf3bb34a9e5da8d47bc2f7b4
                      • Instruction Fuzzy Hash: 21512B36B1DB81C2DA50DB19E4A026EB7A1F7C4B84F604122EB8E977A5DF7DD441CB04
                      Function 00007FFDA33EA649 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 90COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$local_action != nullptr$minkernel\crts\ucrt\src\appcrt\misc\signal.cpp$raise
                      • API String ID: 0-2615017910
                      • Opcode ID: d487d00664e6e1e2a4b204392f626a7e74e29f58742b3c7fd4ba6cb7f52d2111
                      • Instruction ID: 0d0231f74b73d26ace0cc894ee3edee25fb1d36f4d52128a6d0b2dded963926f
                      • Opcode Fuzzy Hash: d487d00664e6e1e2a4b204392f626a7e74e29f58742b3c7fd4ba6cb7f52d2111
                      • Instruction Fuzzy Hash: E8416D32B0EA8286F750AB50E02037AB7E2EB81394F200135E6CD667D6CF7ED444DB14
                      Function 00007FFDA33F0800 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 86memoryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Heap$AllocSize
                      • String ID: %ls$_expand_base$block != nullptr$minkernel\crts\ucrt\src\appcrt\heap\expand.cpp
                      • API String ID: 3906553864-3244948836
                      • Opcode ID: eb75800b87e469904dae9152517342110a56d651340b8bf006679c8dfa0c4e68
                      • Instruction ID: 2cba7bcd487455580d3ce3cc68a63e85179fa70ec8bde9c9dfdc1706a240924e
                      • Opcode Fuzzy Hash: eb75800b87e469904dae9152517342110a56d651340b8bf006679c8dfa0c4e68
                      • Instruction Fuzzy Hash: 2A416331B0EF4286F710AB58E46436AB7A2FB84350F500135E68D677A6DFBED8448B44
                      Function 00007FFDA33A15B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 86libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFreeHandleLoadModuleProc
                      • String ID: AwQZIBdTQDoxCSZdPAoAAAg5$C:\Users\user\Desktop\dat5E54.dll.dll$DwQfAx1bBmR6KyNd
                      • API String ID: 1437655972-2725122165
                      • Opcode ID: 3686c2bb677811747f0f813c2f3303421eb20808d00e55171101e6a5b2e3171c
                      • Instruction ID: 079ea294d376a530fb70b9ec71e1df4465c2cfa646addbcd522f676667b54a4a
                      • Opcode Fuzzy Hash: 3686c2bb677811747f0f813c2f3303421eb20808d00e55171101e6a5b2e3171c
                      • Instruction Fuzzy Hash: 2F416032F0AF429AEB10EFA0D4601EC6372FB84348B440931DE0D62B9ADF7AD959C344
                      Function 00007FFDA33FC6F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 79COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_unique_heap_ptr
                      • String ID: %ls$minkernel\crts\ucrt\src\appcrt\stdio\_getbuf.cpp$minkernel\crts\ucrt\src\appcrt\stdio\_getbuf.cpp$public_stream != nullptr
                      • API String ID: 2978586664-187094882
                      • Opcode ID: 7c9e3dd857b4cdbd0bdad8c7624ef70df36ca4b01fcf2c25c1d17cc36627c8ed
                      • Instruction ID: 83f04cf2cb49b17a6b126bf01119223d1f98146f8a4d755b5592389cc28242f8
                      • Opcode Fuzzy Hash: 7c9e3dd857b4cdbd0bdad8c7624ef70df36ca4b01fcf2c25c1d17cc36627c8ed
                      • Instruction Fuzzy Hash: A0413F66B2EE8192E640EB10E4627AA7761FF80740F900036F68D97797DF7ED944CB48
                      Function 00007FFDA33C6380 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77COMMON
                      Download Yara Rule
                      APIs
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C646D
                        • Part of subcall function 00007FFDA33D1950: EnterCriticalSection.KERNEL32(?,?,?,?,00007FFDA33C2645,?,?,?,?,00007FFDA33C2352), ref: 00007FFDA33D1971
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C64C5
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock$CriticalEnterSection
                      • String ID: %ls$7$_CrtSetDbgFlag$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$new_bits == _CRTDBG_REPORT_FLAG || new_bits_have_only_valid_flags
                      • API String ID: 3216741998-3531600671
                      • Opcode ID: da60697fd3d3e501c0ddbb24dc1105485118ed9f70b53d0dd0c6e6d2456ddd37
                      • Instruction ID: c517716e430adc6fa7d1d84513bd3c5fe714b76ec335102b6955fcb9b1f051b0
                      • Opcode Fuzzy Hash: da60697fd3d3e501c0ddbb24dc1105485118ed9f70b53d0dd0c6e6d2456ddd37
                      • Instruction Fuzzy Hash: CA418371B1EA428BF390AF19E46176A77A2EB41344F041135F28DA67D6CB7EE448CF04
                      Function 00007FFDA33B83B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_unique_heap_ptr$Concurrency::details::_SchedulerScheduler::__aligned_msize_heap_alloc
                      • String ID: %ls$D:\a\_work\1\s\src\vctools\crt\vcruntime\src\eh\std_exception.cpp$to->_What == nullptr && to->_DoFree == false
                      • API String ID: 4274524987-3183830673
                      • Opcode ID: b3529cade8b3f14b8563d213555e40ed89f53ba896409604aa1b3acbbf5e5dd3
                      • Instruction ID: d5ae9b1c5885ce62235bafac70b571547abcfdd28b835136221e1454e6ce27b6
                      • Opcode Fuzzy Hash: b3529cade8b3f14b8563d213555e40ed89f53ba896409604aa1b3acbbf5e5dd3
                      • Instruction Fuzzy Hash: FB310E36B1DF8581DA40EF15E4A026A77A1FBC5B80F544032EA8D977A6DF7DD440C714
                      Function 00007FFDA33BE3E1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Exception$__vcrt_getptd$Rethrow$DestroyedObjectRaise
                      • String ID: csm
                      • API String ID: 188392589-1018135373
                      • Opcode ID: 33087d1b6a9ea62231c4dc20293058f6ff88950fc551cbfb49707e6a1ac69a22
                      • Instruction ID: 5c81494b657ccf2bd64da5e869979ca7ea1fa469ba6a3bcbae9c616d38c3bb6e
                      • Opcode Fuzzy Hash: 33087d1b6a9ea62231c4dc20293058f6ff88950fc551cbfb49707e6a1ac69a22
                      • Instruction Fuzzy Hash: 9421103660DE4586DA30AF15E06026E7B71FBC4B94F400231EA8E177A6CF7ED540CB08
                      Function 00007FFDA33C3420 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_unique_heap_ptr$Concurrency::details::_SchedulerScheduler::_$HandleModule__crt_scoped_stack_ptr
                      • String ID: minkernel\crts\ucrt\src\appcrt\startup\thread.cpp${
                      • API String ID: 4069886586-837585784
                      • Opcode ID: 613ac1a307638d0ec90815bd48e70975d05f2d376940470afc93537598528d8b
                      • Instruction ID: e3a05d83d90c1b60b514d0a5c1a9a39cd6da6659e679ceb44752903d4151d690
                      • Opcode Fuzzy Hash: 613ac1a307638d0ec90815bd48e70975d05f2d376940470afc93537598528d8b
                      • Instruction Fuzzy Hash: 0621EA21B2DE8591DA41FB55E4612ABA262FFD0B80F804036F68E56797DF2ED508C748
                      Function 00007FFDA33D3120 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: new[]
                      • String ID: :$_wcsdup_dbg$minkernel\crts\ucrt\src\appcrt\string\wcsdup.cpp$wcscpy_s(memory, size_in_elements, string)
                      • API String ID: 4059295235-1572295273
                      • Opcode ID: de448e89422117e99f14ce0a0b504220bd668326820cae029afe3ab45c2c7947
                      • Instruction ID: c0b5068452031de7d98365a45de741a39ff91ccfdf04f27b3192a0c5221609b5
                      • Opcode Fuzzy Hash: de448e89422117e99f14ce0a0b504220bd668326820cae029afe3ab45c2c7947
                      • Instruction Fuzzy Hash: 7C119D36A1DB8686DB50EB51F45135AB7A2F7843D4F001435FA8E53B5ACF7DD0048B44
                      Function 00007FFDA33F31B0 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 373COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$_wcstombs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\wcstombs.cpp$pwcs != nullptr
                      • API String ID: 0-287901994
                      • Opcode ID: 78aacd2c90ee3ffbb54cddeed0dd8fa61c144f971633c1f475120c77e5d36fdc
                      • Instruction ID: edd3ae86f3043f40d97b43ef068c7dd7a93a0bb54d54b551d4b631fe77b92722
                      • Opcode Fuzzy Hash: 78aacd2c90ee3ffbb54cddeed0dd8fa61c144f971633c1f475120c77e5d36fdc
                      • Instruction Fuzzy Hash: 85123B3260EF8585D6B49B05E4603AAB3A1F7847A0F504236EADD57BAADF3ED4448B04
                      Function 00007FFDA33F0F70 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 260COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$("Buffer too small", 0)$_wctomb_internal$destination_count <= INT_MAX$destination_count > 0$minkernel\crts\ucrt\src\appcrt\convert\wctomb.cpp
                      • API String ID: 0-3614322479
                      • Opcode ID: 10e44f6909b0f723068b2aea578288762463d6d5647e9be3a9e553e8bc1aadfe
                      • Instruction ID: 277194159120ed98f66ee4212d38b02d9e724909331be538ac5e0deaa2748615
                      • Opcode Fuzzy Hash: 10e44f6909b0f723068b2aea578288762463d6d5647e9be3a9e553e8bc1aadfe
                      • Instruction Fuzzy Hash: 07E15332A0EE8185E770AB55F4643AAB3A2FBC4754F404136D68D97B9ACF7DD484CB04
                      Function 00007FFDA33DC400 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 239COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<wchar_t,class __crt_stdio_output::string_output_adapter<wchar_t>,class __crt_stdio_output::fo$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-3177598755
                      • Opcode ID: a2738b702e262ae420ab0d663849c5babbe2bdd07e158ae42672cd9d7420ad3c
                      • Instruction ID: 63398aad92b76ec71458c826f7232804dd8dae0abf41441422906743190cff89
                      • Opcode Fuzzy Hash: a2738b702e262ae420ab0d663849c5babbe2bdd07e158ae42672cd9d7420ad3c
                      • Instruction Fuzzy Hash: 1EC1446372EAC185E660AB25E46037AA762FBC0780F101432E68E57B9BCF6FD444CB54
                      Function 00007FFDA33DB200 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 239COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<wchar_t,class __crt_stdio_output::string_output_adapter<wchar_t>,class __crt_stdio_output::fo$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-3177598755
                      • Opcode ID: b6ff0c0b63b2bbd9903b1e5e5c6059bb7a8a37b5c12f77bdcc348a59f591feea
                      • Instruction ID: d06f728838c1ba3b6372f5bd0a0c35685ca4fe863f0e48967c70bf39a4cb480e
                      • Opcode Fuzzy Hash: b6ff0c0b63b2bbd9903b1e5e5c6059bb7a8a37b5c12f77bdcc348a59f591feea
                      • Instruction Fuzzy Hash: D6C1302371EAC186E760AB25E46137EA762FBC0780F101436EA8D57B9BCF6FD4448B54
                      Function 00007FFDA33DBB00 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 239COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<wchar_t,class __crt_stdio_output::string_output_adapter<wchar_t>,class __crt_stdio_output::fo$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-3177598755
                      • Opcode ID: 701519ab8882166d0256acd5e4da1f7a0130b4b008d7ccf66649b03ace8bc402
                      • Instruction ID: 68d5c2be397b4fa787f376da56ca3bc601d8df0edd4bcec1e629f0d3880cea83
                      • Opcode Fuzzy Hash: 701519ab8882166d0256acd5e4da1f7a0130b4b008d7ccf66649b03ace8bc402
                      • Instruction Fuzzy Hash: 10C1312371EAC186E660AB25E46137AB762FBC0780F501431EA8D57BABCF6FD444CB54
                      Function 00007FFDA33DAD80 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<char,class __crt_stdio_output::string_output_adapter<char>,class __crt_stdio_output::format_v$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-1003573884
                      • Opcode ID: babcf4a2cad3bfa2a6597142acdb186fd8bde707856950793dfccc622e7a4516
                      • Instruction ID: b6006d87560bf236e991f8e04babf36acb19486224b00195a77bf0342e578db7
                      • Opcode Fuzzy Hash: babcf4a2cad3bfa2a6597142acdb186fd8bde707856950793dfccc622e7a4516
                      • Instruction Fuzzy Hash: 8FC11F2371EAC185E760AB25E46037AA762FBC1780F501432EA8E57B9BCF6FD444CB54
                      Function 00007FFDA33DB680 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<char,class __crt_stdio_output::string_output_adapter<char>,class __crt_stdio_output::format_v$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-1003573884
                      • Opcode ID: cafa24cb0ff2cf622ac8bef4c5cb5a20c9be6c09fa7e33b56d1bdc9baadebe50
                      • Instruction ID: 5012d285f26389568fe607eac7fff2b2a93727dcccc7d42c1ff1453492eb4eb0
                      • Opcode Fuzzy Hash: cafa24cb0ff2cf622ac8bef4c5cb5a20c9be6c09fa7e33b56d1bdc9baadebe50
                      • Instruction Fuzzy Hash: E0C1312371EAC186E660AB25E46037BA762FBC0780F500432E68E57B9BCF6FD444CB54
                      Function 00007FFDA33DBF80 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: DestroyException
                      • String ID: %ls$("Invalid integer length modifier", 0)$__crt_stdio_output::output_processor<char,class __crt_stdio_output::string_output_adapter<char>,class __crt_stdio_output::format_v$minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 2436776299-1003573884
                      • Opcode ID: 453d12740f8f1a10542da47d5e5abe116b087f86d4654d153ce4984943b7e685
                      • Instruction ID: a6bef989072b1aad0d439e145e019e938b54df7e1edcf8725dcc96e17b0cb54d
                      • Opcode Fuzzy Hash: 453d12740f8f1a10542da47d5e5abe116b087f86d4654d153ce4984943b7e685
                      • Instruction Fuzzy Hash: 80C1202372EAC185E660AB65E4A037EA762FBC5780F100432E68D57B9BCF6FD444CB54
                      Function 00007FFDA33D8D70 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 233COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: %ls$buffer_count == 0 || buffer != nullptr$common_vsprintf$format != nullptr$minkernel\crts\ucrt\src\appcrt\stdio\output.cpp
                      • API String ID: 2780765137-3439959449
                      • Opcode ID: 263d903be823a55f5035dc6b72e230dba969fba2cf6bc4de48e2486e70cf7815
                      • Instruction ID: d3a86df09b12613511bd8391cb58cbd02d8c248a720a54f9e0d25445f5d0d74e
                      • Opcode Fuzzy Hash: 263d903be823a55f5035dc6b72e230dba969fba2cf6bc4de48e2486e70cf7815
                      • Instruction Fuzzy Hash: CAC13E32A1EF8585E6609B14F4603ABB3A1FB84384F500535E68E97B9ADF7EE544CF04
                      Function 00007FFDA33D9230 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 229COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: %ls$buffer_count == 0 || buffer != nullptr$common_vsprintf$format != nullptr$minkernel\crts\ucrt\src\appcrt\stdio\output.cpp
                      • API String ID: 2780765137-3439959449
                      • Opcode ID: 4c0a0ffa658c15d264fa0c1cc7fc7bf8f85ecf0d468e8df4d6abdb88523d9df6
                      • Instruction ID: 0cb69d9d3e8213fb045ad605e7c1af4f9c7e7b813ca83aae69ec6f70f39c59aa
                      • Opcode Fuzzy Hash: 4c0a0ffa658c15d264fa0c1cc7fc7bf8f85ecf0d468e8df4d6abdb88523d9df6
                      • Instruction Fuzzy Hash: 36C12E32A1EF8185E6709B14E4603ABB3A1FB84394F501535E68E93B9AEF7ED544CF04
                      Function 00007FFDA33AF6D0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: !"Bad number of encoding units for this code page"$%ls$Bad number of encoding units for this code page$D:\a\_work\1\s\src\vctools\crt\github\stl\src\xmbtowc.cpp$ploc->_Page == CP_UTF8
                      • API String ID: 0-3707552663
                      • Opcode ID: c4f8c56dafbf28c7c86bce47fbbbbeb77fc20453c02507c46f90f56a1953fea4
                      • Instruction ID: 8e5aab89afc6c82daf497fe49fff6dd1ea3d729b12ed2fdaaad7a154e1934c06
                      • Opcode Fuzzy Hash: c4f8c56dafbf28c7c86bce47fbbbbeb77fc20453c02507c46f90f56a1953fea4
                      • Instruction Fuzzy Hash: 3C915E32A0EB8286E760AB14E86036E77A2EB85754F104536E68D937E6CF7FD444CB04
                      Function 00007FFDA33BC960 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: MOC$RCC
                      • API String ID: 2516003560-2084237596
                      • Opcode ID: 809f6a05a3e45f8fda36744841b5f35fc9132322bd8fd73b6ec4ee6ad24817b5
                      • Instruction ID: dd2a4060d72ccb9bf609970121f63f15643783cc98f41d8ccbf63cb3cb663cc8
                      • Opcode Fuzzy Hash: 809f6a05a3e45f8fda36744841b5f35fc9132322bd8fd73b6ec4ee6ad24817b5
                      • Instruction Fuzzy Hash: 2391E63260DBC585E670EF15E4603AAB3A6FB84784F404036EA8D97B9ADF3DD545CB04
                      Function 00007FFDA33BEE30 Relevance: 10.7, APIs: 7, Instructions: 157COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$Map::begin$BaseControlFac_nodeFac_node::_FrameFromHandler3::ImageReadStateUnsignedstd::_
                      • String ID:
                      • API String ID: 2479526129-0
                      • Opcode ID: e8c5ae579c82730ebc3b39433f2244d39b61834af795020b9cb8cc9ddee00039
                      • Instruction ID: fbb4b895653f89c7a0dad00616f59f8251a1a3f74d51c5f56cb872bfc88cdb9c
                      • Opcode Fuzzy Hash: e8c5ae579c82730ebc3b39433f2244d39b61834af795020b9cb8cc9ddee00039
                      • Instruction Fuzzy Hash: 0C814B7260EA8586EA60EF15E4517AEB3A1FBC4780F405032EA8D93B6ADF3DD445CB44
                      Function 00007FFDA338A300 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 143COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _heap_alloc
                      • String ID: "string subscript out of range"$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xstring$string subscript out of range
                      • API String ID: 4215648709-940759593
                      • Opcode ID: b622626bf8c65a5b301a95b7163fb5f6da8bdc8783b4a2b4fdbe5e2fa881adc9
                      • Instruction ID: a278efd4fa5d8ad572040bcd46d56090c96abe0a900e6933372957f117a7be38
                      • Opcode Fuzzy Hash: b622626bf8c65a5b301a95b7163fb5f6da8bdc8783b4a2b4fdbe5e2fa881adc9
                      • Instruction Fuzzy Hash: 77511022B0EA8B86E7419F60A4603BA7B62FB51744F445031FA8D63797CF7EE455C308
                      Function 00007FFDA33F5E30 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 138COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close_internal$minkernel\crts\ucrt\src\appcrt\lowio\close.cpp
                      • API String ID: 0-4089689869
                      • Opcode ID: c5a65b156d13825a2eb80b6c21fd06f576eecb0992dad33fd780923db1f762c1
                      • Instruction ID: 8cd0e62f92c123f12a36527d73eda673563b4234b71f4953590562ac9835f72b
                      • Opcode Fuzzy Hash: c5a65b156d13825a2eb80b6c21fd06f576eecb0992dad33fd780923db1f762c1
                      • Instruction Fuzzy Hash: 15719371B0EF8185E760AB14E4603AAB3A2FB85354F504135F69D57BAACF7DD444CB04
                      Function 00007FFDA33BEBE0 Relevance: 10.6, APIs: 7, Instructions: 123COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: State__vcrt_getptd$FrameHandler3::$BaseControlCurrentFromImage
                      • String ID:
                      • API String ID: 4172172795-0
                      • Opcode ID: 477d4d7d7c8564c2ce8aa00faf0407ad5f568ee5bba57ab1f8587352b5acaa83
                      • Instruction ID: edb796639d322942dbc80c7212f76436d72b2d926193875bd422e23bdb7f8c60
                      • Opcode Fuzzy Hash: 477d4d7d7c8564c2ce8aa00faf0407ad5f568ee5bba57ab1f8587352b5acaa83
                      • Instruction Fuzzy Hash: F4511C32A1DE85C6DA70EF19E4A136AB3A1FBC4789F100135E68D87B9ACF7DD4418B44
                      Function 00007FFDA33A6350 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 119COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA33A644C
                      • gfffffff, xrefs: 00007FFDA33A638B
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA33A647E
                      • "null pointer cannot point to a block of non-zero size", xrefs: 00007FFDA33A648C
                      • null pointer cannot point to a block of non-zero size, xrefs: 00007FFDA33A643D
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_task
                      • String ID: "null pointer cannot point to a block of non-zero size"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$gfffffff$null pointer cannot point to a block of non-zero size
                      • API String ID: 118556049-44366061
                      • Opcode ID: 05d1cb163e3b23028d1b507ba34a2dd79562003582e5572f865552ccca517de0
                      • Instruction ID: 91fc7e7e06ac34327c5a444b26eed8aff249f8f8aa5247417556d193346e2539
                      • Opcode Fuzzy Hash: 05d1cb163e3b23028d1b507ba34a2dd79562003582e5572f865552ccca517de0
                      • Instruction Fuzzy Hash: ED41FC22B0EF8A87EA44AF17F4601A963A5FB44B80F580431DE4CA7B56DF3EE152C305
                      Function 00007FFDA33C8E50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 111COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Adl_verify_rangetype_info::_name_internal_method
                      • String ID: %ls$buffer != nullptr$common_vsscanf$format != nullptr$minkernel\crts\ucrt\src\appcrt\stdio\input.cpp
                      • API String ID: 2441275986-1462490510
                      • Opcode ID: 068b16bbdfdd616931fdec77c347585bf1cad5de96a549066832246befc25ce3
                      • Instruction ID: 77423753d4d08ad7415a55d6cbc2166de600f80927f19ceb90814c1b6b505515
                      • Opcode Fuzzy Hash: 068b16bbdfdd616931fdec77c347585bf1cad5de96a549066832246befc25ce3
                      • Instruction Fuzzy Hash: CC517371A0DF8685E760EB54F4603AAB3A2FB84344F400135E68D677AADF7ED548CB04
                      Function 00007FFDA33D5E40 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 111COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_scoped_stack_ptr
                      • String ID: %ls$common_fseek$minkernel\crts\ucrt\src\appcrt\stdio\fseek.cpp$stream.valid()$whence == SEEK_SET || whence == SEEK_CUR || whence == SEEK_END
                      • API String ID: 1704660383-350959948
                      • Opcode ID: f2d0fa175e43114aa762836f73439a70507c942478ada796da90ac800f0391e6
                      • Instruction ID: 2dc3a4b1007fc2fd7823dde89f9eeccfb25b0bcea99a3bc7b3c10be71f034c7e
                      • Opcode Fuzzy Hash: f2d0fa175e43114aa762836f73439a70507c942478ada796da90ac800f0391e6
                      • Instruction Fuzzy Hash: 5B518632B0EA4186E760EB54F46136AB3A1FB80394F500535E68D97BA6DF7ED448CF08
                      Function 00007FFDA33A8E80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$FreeLockitstd::_$AddressLoadLockit::_Lockit::~_Proc
                      • String ID: AAQBCAxSejQ+KixF$AwUEXkoZUTo4
                      • API String ID: 2340135649-2472641609
                      • Opcode ID: 4695bbdc9e70de5ed79b4e52f69c64412232314123aedfdf920304fc27dd3620
                      • Instruction ID: 0e3580aef93b6de5bfcfeb5f24eb6048c6cd1cfdf97eab18ee5dec991e8e3cef
                      • Opcode Fuzzy Hash: 4695bbdc9e70de5ed79b4e52f69c64412232314123aedfdf920304fc27dd3620
                      • Instruction Fuzzy Hash: 88516122F0EE468AEB00EF70D4A02EC2362EB44748F441531EE4D66B9ADF79E995C344
                      Function 00007FFDA33A9040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$FreeLockitstd::_$AddressLoadLockit::_Lockit::~_Proc
                      • String ID: AwQZPgFEQTM5AipFKy0CHg==$ERIIH0sFGzI4Iw==
                      • API String ID: 2340135649-3631341891
                      • Opcode ID: 8dc82ec05e1b6c5aee33fa4bfc43d6ac1beb81e580261cf12c42f1619667bd21
                      • Instruction ID: a609aed27c41975faad598d3586a2a680c163f558e32cb06cd311be4eb3cb0f0
                      • Opcode Fuzzy Hash: 8dc82ec05e1b6c5aee33fa4bfc43d6ac1beb81e580261cf12c42f1619667bd21
                      • Instruction Fuzzy Hash: 83515122B0DF468AEB10EF70D8A02EC2372EB54748F441535EA0D76B9ADF79E995C344
                      Function 00007FFDA33A5090 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 107COMMON
                      Download Yara Rule
                      APIs
                      • new[].LIBCMTD ref: 00007FFDA33A50F4
                      • Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFDA33A5203
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33AE068
                        • Part of subcall function 00007FFDA33AE050: std::locale::_Setgloballocale.LIBCPMTD ref: 00007FFDA33AE095
                        • Part of subcall function 00007FFDA33AE050: Concurrency::details::EventWaitNode::EventWaitNode.LIBCMTD ref: 00007FFDA33AE0FF
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33AE158
                        • Part of subcall function 00007FFDA33A5410: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33A543B
                        • Part of subcall function 00007FFDA33A5410: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33A5460
                        • Part of subcall function 00007FFDA33A5410: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33A548A
                        • Part of subcall function 00007FFDA33A5410: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33A551B
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$EventWait$Concurrency::cancel_current_taskConcurrency::details::NodeNode::Setgloballocalenew[]std::locale::_
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                      • API String ID: 1624564662-595303736
                      • Opcode ID: ffa9dd69885e63bc34f3f23d57751acf330e088bf75e7b3b1ad3c0dd93b7e869
                      • Instruction ID: bac02b4c8547d4ee4beba87d0d0e3e0b57512e6291be6ef7a5623ac58a7b253e
                      • Opcode Fuzzy Hash: ffa9dd69885e63bc34f3f23d57751acf330e088bf75e7b3b1ad3c0dd93b7e869
                      • Instruction Fuzzy Hash: 4441F232A0AF8686EB14EF11E4A02AD33A6FB44B88F544435DA8C63766DF3FD551C344
                      Function 00007FFDA34021C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp, xrefs: 00007FFDA34022B4
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_EnvironmentSchedulerScheduler::_Strings
                      • String ID: minkernel\crts\ucrt\src\desktopcrt\env\get_environment_from_os.cpp
                      • API String ID: 3101938-170101930
                      • Opcode ID: 6b2890220ab89f0530663f047ea5133ed756b86bbf49069d4e1da75da8291718
                      • Instruction ID: 8fa5b77b655928dbeb54953a409c9c5675d7766783613351df810d7aeaa4c320
                      • Opcode Fuzzy Hash: 6b2890220ab89f0530663f047ea5133ed756b86bbf49069d4e1da75da8291718
                      • Instruction Fuzzy Hash: C351C82271DA8591E660EB21F4613AFB7A2FB91340F900035E78D96BEADF7ED444CB44
                      Function 00007FFDA33F63A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 102COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_commit$minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp
                      • API String ID: 0-1026578051
                      • Opcode ID: ad17fb8375a547c48ca9170b4ce91735d83692cba4fb159213f7b716470c9816
                      • Instruction ID: bbfd38649d9204a01a221f6a61e56bd56bf1ec0992d820f4dc67f75a3300184f
                      • Opcode Fuzzy Hash: ad17fb8375a547c48ca9170b4ce91735d83692cba4fb159213f7b716470c9816
                      • Instruction Fuzzy Hash: 2751BF71B0EF4286E750AB54E46136A72A2FB80354F900235F29DA77EADF7ED444CB44
                      Function 00007FFDA33D21E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr
                      • String ID: S$minkernel\crts\ucrt\src\appcrt\stdio\_file.cpp
                      • API String ID: 4142048518-4206356308
                      • Opcode ID: 590d5421512187e2efae776bb943360566223e21ddae882a10d0d7bc1e76331f
                      • Instruction ID: 867206f8948b746178e39f0f82fbb23a7a90e7e372c287e2e6bd183a42cd32c6
                      • Opcode Fuzzy Hash: 590d5421512187e2efae776bb943360566223e21ddae882a10d0d7bc1e76331f
                      • Instruction Fuzzy Hash: E151B062B1FA4284EB91EB04F4A237973A2EB81750F404635E59E567EBCF3FE4408B04
                      Function 00007FFDA33D3EF0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 93COMMON
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D3F08
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33D3F12
                        • Part of subcall function 00007FFDA33D4860: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D4878
                        • Part of subcall function 00007FFDA33F3C10: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F3C65
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr
                      • String ID: %ls$_fclose_nolock_internal$minkernel\crts\ucrt\src\appcrt\stdio\fclose.cpp$stream.valid()
                      • API String ID: 4164245112-3166852756
                      • Opcode ID: 8aab5265c1ac94045a751590d4ddb6101ee4717201e5dcf7c3f5274a3c9ad59d
                      • Instruction ID: 1df13771bd7b0e2e7eb1667cbc624b87d987ea6c1dfddaa9bf444768f536c30b
                      • Opcode Fuzzy Hash: 8aab5265c1ac94045a751590d4ddb6101ee4717201e5dcf7c3f5274a3c9ad59d
                      • Instruction Fuzzy Hash: 78413D72B1EE4691E610FB10F4613AAA262FB81794F900132F68D97797DF3ED844CB48
                      Function 00007FFDA33FE820 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 86COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _aligned_msize_invoke_watson_if_error
                      • String ID: ]$fp_format_nan_or_infinity$minkernel\crts\ucrt\src\appcrt\convert\cvt.cpp$strcpy_s( result_buffer, result_buffer_count, strings[row][column + !long_string_will_fit])
                      • API String ID: 1871870440-1759674166
                      • Opcode ID: 3e66bead7d4b94c0b341f8a7aa57caf3887d98fec2272482db24c9155843b08b
                      • Instruction ID: d673891dc602e558f620eeba26da8d1bfe0fe98a6cdf2696fc2af3486a5f4739
                      • Opcode Fuzzy Hash: 3e66bead7d4b94c0b341f8a7aa57caf3887d98fec2272482db24c9155843b08b
                      • Instruction Fuzzy Hash: DA416F22A1EB818AE750DB2DE49032ABBE1F785740F500136F6DD97BAADB7DD4408F44
                      Function 00007FFDA33D1FE0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: call_wsetlocale$mbstowcs_s(&size, nullptr, 0, narrow_locale, 2147483647)$mbstowcs_s(nullptr, wide_locale.get(), size, narrow_locale, ((size_t)-1))$minkernel\crts\ucrt\src\appcrt\locale\setlocale.cpp$minkernel\crts\ucrt\src\appcrt\locale\setlocale.cpp
                      • API String ID: 2780765137-3376849281
                      • Opcode ID: 2f80679d9a9eda1adbf999bc7b63696d036e938ea170e16a94c88be2039e56bd
                      • Instruction ID: fde50e1e4bbf7053ab971098dec0faa5bbc78c74debf7b1f4bd1a7fc31dbcfdd
                      • Opcode Fuzzy Hash: 2f80679d9a9eda1adbf999bc7b63696d036e938ea170e16a94c88be2039e56bd
                      • Instruction Fuzzy Hash: 99414C3271DA8191E710EB51F4613AAB362FB84390F904236E69D97BDADF7ED504CB08
                      Function 00007FFDA33D4A60 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D4A73
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33D4A7D
                        • Part of subcall function 00007FFDA33F9250: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F9263
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr
                      • String ID: %ls$_fgetc_nolock$minkernel\crts\ucrt\src\appcrt\stdio\fgetc.cpp$stream.valid()
                      • API String ID: 4164245112-910274733
                      • Opcode ID: cee77bc501c159c3062a03ecc3c13d13224b75dc12f1b6aed748efa899e887f4
                      • Instruction ID: 964e78b8bccb6353be01bf01d88a1a5053c7bcfdd43e32cb72f41063f3542ec2
                      • Opcode Fuzzy Hash: cee77bc501c159c3062a03ecc3c13d13224b75dc12f1b6aed748efa899e887f4
                      • Instruction Fuzzy Hash: C4316232B1EE4695E700AB14E46237AB7A1FB84790F900432E68D93797DF7ED504CB08
                      Function 00007FFDA33D3D90 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_scoped_stack_ptr
                      • String ID: %ls$_fclose_internal$minkernel\crts\ucrt\src\appcrt\stdio\fclose.cpp$stream.valid()
                      • API String ID: 614740146-2931739134
                      • Opcode ID: 97967ae0e6455c157ee54cdc31b98acaea760aa6c96044d493f472580c07bfe4
                      • Instruction ID: eadbbbfd7a457c8a26748f395b5f92f1cff81ceb16db5ea0564abc7cdb7d7ed4
                      • Opcode Fuzzy Hash: 97967ae0e6455c157ee54cdc31b98acaea760aa6c96044d493f472580c07bfe4
                      • Instruction Fuzzy Hash: 2E314F32B1EA4291E650EB15E46126AB362FB81394F500531F68DA77E7DF3EE804CB48
                      Function 00007FFDA340AF80 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA340B03F
                        • Part of subcall function 00007FFDA33D1950: EnterCriticalSection.KERNEL32(?,?,?,?,00007FFDA33C2645,?,?,?,?,00007FFDA33C2352), ref: 00007FFDA33D1971
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA340B0C6
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock$CriticalEnterSection
                      • String ID: %ls$__acrt_lowio_ensure_fh_exists$minkernel\crts\ucrt\src\appcrt\lowio\osfinfo.cpp$static_cast<unsigned>(fh) < _NHANDLE_
                      • API String ID: 3216741998-2342959244
                      • Opcode ID: ee03bc92984f3539addc01a19b6d166d04c4f55c89c33e21af4ecd9bf526272e
                      • Instruction ID: 313b9ba0ef2812001c83a3aee7ee7a5f8367f87c9fcc8e4eab27ba7d5d6ee27c
                      • Opcode Fuzzy Hash: ee03bc92984f3539addc01a19b6d166d04c4f55c89c33e21af4ecd9bf526272e
                      • Instruction Fuzzy Hash: D4315272B1EA468AF7109B04E46076A7362FB81344F501135E69EA779ADFBFE444CB08
                      Function 00007FFDA33EC950 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___vcrt_getptd
                      • String ID: %ls$LC_MIN <= _category && _category <= LC_MAX$_wsetlocale$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
                      • API String ID: 520741673-2399076032
                      • Opcode ID: 8efadf5c48fa468b517a96ab0d641e11842f0ec7eb53fa527467428f59e9883e
                      • Instruction ID: 12bfe0a2c4cba41ff24a66718697d938d92e15805b0d6614d46fc38372e3ec82
                      • Opcode Fuzzy Hash: 8efadf5c48fa468b517a96ab0d641e11842f0ec7eb53fa527467428f59e9883e
                      • Instruction Fuzzy Hash: 95317C32A1EB8285E710AB50E4603AFB3A1FB80344F501135F68D52BAADF7ED548CB48
                      Function 00007FFDA3407E50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 68COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp, xrefs: 00007FFDA3407F32
                      • wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), lpLocaleString, wcsle, xrefs: 00007FFDA3407F40
                      • LanguageEnumProcEx, xrefs: 00007FFDA3407F39
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2__vcrt_getptd_invoke_watson_if_error
                      • String ID: LanguageEnumProcEx$minkernel\crts\ucrt\src\appcrt\locale\get_qualified_locale.cpp$wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), lpLocaleString, wcsle
                      • API String ID: 799102036-3113451328
                      • Opcode ID: def8a32541e0f0022fbb121ca4c898b7e998343adc65f7668db2f67a56513d34
                      • Instruction ID: bae38674a7251a3932b2e300638d3249aba12c23713bd6e847ecdf16d8e6ef1b
                      • Opcode Fuzzy Hash: def8a32541e0f0022fbb121ca4c898b7e998343adc65f7668db2f67a56513d34
                      • Instruction Fuzzy Hash: B7316E3271EB8586E790DB15E4643AA77A1FB84744F500031FA8E9775ADF7DD404CB44
                      Function 00007FFDA3410F20 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _abstract_cw$_hw_cw
                      • String ID: %ls$(mask&~(_MCW_DN|_MCW_EM|_MCW_RC))==0$minkernel\crts\ucrt\src\appcrt\tran\amd64\ieee.c
                      • API String ID: 787819578-4254588316
                      • Opcode ID: d19e29ec81170dd3d5e5b88d0c3007d4ae00b94ca7a56300e0bae7c50344dd9f
                      • Instruction ID: 7cfe03a12889b347e5d91ece57cc9f07aca16f78007ec08d4dc8a28ff677d13d
                      • Opcode Fuzzy Hash: d19e29ec81170dd3d5e5b88d0c3007d4ae00b94ca7a56300e0bae7c50344dd9f
                      • Instruction Fuzzy Hash: 54310232B2D6418BE754DB14E56152ABBA2FB84340F101035F689D7B96DF6EE800CF48
                      Function 00007FFDA338B200 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 62COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338B242
                      • "invalid argument", xrefs: 00007FFDA338B286
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338B278
                      • invalid argument, xrefs: 00007FFDA338B233
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_task_heap_alloc
                      • String ID: "invalid argument"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$invalid argument
                      • API String ID: 3029011262-2296585039
                      • Opcode ID: 3611ecbaa252aa01164f940eef828553c718c1bf6e90f1389922b052ac928ed7
                      • Instruction ID: aa35c407bfaebbf4887db8a8d9c28ac062602f798f11d4d81205c68f32a9dd15
                      • Opcode Fuzzy Hash: 3611ecbaa252aa01164f940eef828553c718c1bf6e90f1389922b052ac928ed7
                      • Instruction Fuzzy Hash: 8311AC21B0FE0382EE54AB50E4A03A96362AF04364F800631DA9D1B7A3DF7ED5058708
                      Function 00007FFDA33F1550 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_scoped_stack_ptr
                      • String ID: %ls$_fileno$minkernel\crts\ucrt\src\appcrt\stdio\fileno.cpp$stream.valid()
                      • API String ID: 614740146-3741990651
                      • Opcode ID: cb3163f6de1d9ac66b346aaebcd56bcc1fc2a61c1719c05228d49acb49749de5
                      • Instruction ID: 77b312fdfa33b1a972cac4378016321e673c7001bf07293b9fa4381d1b387a05
                      • Opcode Fuzzy Hash: cb3163f6de1d9ac66b346aaebcd56bcc1fc2a61c1719c05228d49acb49749de5
                      • Instruction Fuzzy Hash: 03214F71F1EA4295E750AB50E4603BAB262FF80354F801131F68EA6796DFBED944CB44
                      Function 00007FFDA3401AA0 Relevance: 9.3, APIs: 6, Instructions: 300COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LocaleName
                      • String ID:
                      • API String ID: 1723996188-0
                      • Opcode ID: 3379589273fd3740d3dbe314f6f9241aab6cffcbfc7e5ecf298556e3f0fb3f78
                      • Instruction ID: 459b8a186c6ac56c2e6cf0b82616dcb5942acb18f3b1dada387f4a94f01a92be
                      • Opcode Fuzzy Hash: 3379589273fd3740d3dbe314f6f9241aab6cffcbfc7e5ecf298556e3f0fb3f78
                      • Instruction Fuzzy Hash: 73E1EE3670D641CBE764CB19E0A422AB7E1F789748F100236E68E977A9DB7DD541CF08
                      Function 00007FFDA339A5D0 Relevance: 9.2, APIs: 6, Instructions: 182COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_task$DestroyExceptionMtx_unlock_heap_allocmtx_do_lock
                      • String ID:
                      • API String ID: 3248877564-0
                      • Opcode ID: 0d410aafb834a03b1f40f47230720b08c3ba26d623adbff57ac9fa3db767f3b3
                      • Instruction ID: 3ad99498234222227c106691130835237cfd3809e19a75abdd720ce2388fe691
                      • Opcode Fuzzy Hash: 0d410aafb834a03b1f40f47230720b08c3ba26d623adbff57ac9fa3db767f3b3
                      • Instruction Fuzzy Hash: E281B532A0AF8186E310EF14E8656AA3376FB55788F529635EE8C13756DF3AD494C308
                      Function 00007FFDA33B1280 Relevance: 9.2, APIs: 6, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Fgetc
                      • String ID:
                      • API String ID: 1720979605-0
                      • Opcode ID: 15af6aacf90cc3a1d6021baa4e2145b019944f4c51bbd0e7aae02b850b9b3852
                      • Instruction ID: ddf2a1c6a115ccf117bbfd21ef471bf2b5a899b5c45a625c8da28eab52c121d1
                      • Opcode Fuzzy Hash: 15af6aacf90cc3a1d6021baa4e2145b019944f4c51bbd0e7aae02b850b9b3852
                      • Instruction Fuzzy Hash: 9891EC22B0EA8295D660EB15E4613BEB3A2FBC5740F504436E68E52B9BDF2ED444CB44
                      Function 00007FFDA33BD540 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Frame__vcrt_getptd$EmptyHandler4::StateUnwind__except_validate_context_record_guard_icall_checks_enforced
                      • String ID: csm$csm
                      • API String ID: 2017096522-3733052814
                      • Opcode ID: 345713996df66218453f417346ae3498eea27d25ffc91c38147a34d1b45ef41a
                      • Instruction ID: f1e3cc5c852cb29a85e893ffa9dd352374d8dbb28695cf1e9ba73899088bdb0f
                      • Opcode Fuzzy Hash: 345713996df66218453f417346ae3498eea27d25ffc91c38147a34d1b45ef41a
                      • Instruction Fuzzy Hash: 16C1DA3660DBC685EA70AF55E4503AEB761FBC4784F404036DA8DABB9ADF3DD4408B44
                      Function 00007FFDA3401210 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 210COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: String__crt$Info
                      • String ID: $z
                      • API String ID: 2508956065-2251613814
                      • Opcode ID: b16ca20eaa18f8749e067261d0e6795f5dfdb55d812ed8a5f5ede3c6e08ddd89
                      • Instruction ID: aa30eba724255655ea3fd706b99f5932eae32ca368e42076ba73dba27931e38b
                      • Opcode Fuzzy Hash: b16ca20eaa18f8749e067261d0e6795f5dfdb55d812ed8a5f5ede3c6e08ddd89
                      • Instruction Fuzzy Hash: F9B1383670D6C08AD764CB98E0903AEFBA1F7C9754F044525EACA87B99CBADE444CF44
                      Function 00007FFDA33D77B0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 209COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D77CD
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC745
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC784
                        • Part of subcall function 00007FFDA33FC6F0: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33FC78C
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr__crt_unique_heap_ptr
                      • String ID: %ls$( (_Stream.is_string_backed()) || (fn = _fileno(_Stream.public_stream()), ((_textmode_safe(fn) == __crt_lowio_text_mode::ansi) && $_ungetc_nolock$minkernel\crts\ucrt\src\appcrt\stdio\ungetc.cpp
                      • API String ID: 3935900057-4192884085
                      • Opcode ID: 9d0a4a666771c3a596299f98e246ef29c768a7e3ff2c4e47167865d3f4a3e4ee
                      • Instruction ID: 5922bfcb07fab2b51416d876c6ba4ef3ce785c9da3556784de11282a87f14be9
                      • Opcode Fuzzy Hash: 9d0a4a666771c3a596299f98e246ef29c768a7e3ff2c4e47167865d3f4a3e4ee
                      • Instruction Fuzzy Hash: 22A16F32B1EE8585E650AF14E46127AB362FB80790F504532E69E937EADF3ED444CB04
                      Function 00007FFDA33F8820 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 203COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F8834
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC745
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC784
                        • Part of subcall function 00007FFDA33FC6F0: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33FC78C
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr$__crt_unique_heap_ptr
                      • String ID: %ls$common_refill_and_read_nolock$minkernel\crts\ucrt\src\appcrt\stdio\_filbuf.cpp$stream.valid()
                      • API String ID: 3508884809-2419318608
                      • Opcode ID: b4a1f21dddcb32227e4e0dbe36f639fce6a0ab6a4aff7677f9cface3760f8c09
                      • Instruction ID: e84085a168cd3e6d9a84db1a03643b025175e223aa4fcfacbb2e51d2259f2789
                      • Opcode Fuzzy Hash: b4a1f21dddcb32227e4e0dbe36f639fce6a0ab6a4aff7677f9cface3760f8c09
                      • Instruction Fuzzy Hash: 47A12562B1EE8255E620FB21E4613BA7352FB80740F800132E59D9ABD7DF7ED904CB48
                      Function 00007FFDA33F8BF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 203COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F8C04
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC745
                        • Part of subcall function 00007FFDA33FC6F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33FC784
                        • Part of subcall function 00007FFDA33FC6F0: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33FC78C
                        • Part of subcall function 00007FFDA33F1550: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F1563
                        • Part of subcall function 00007FFDA33F1550: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F156D
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr$__crt_unique_heap_ptr
                      • String ID: %ls$common_refill_and_read_nolock$minkernel\crts\ucrt\src\appcrt\stdio\_filbuf.cpp$stream.valid()
                      • API String ID: 3508884809-2419318608
                      • Opcode ID: ab37c828ab1c217b5aaaf5ae6d07fab262915ec6cec112feb3e8b1f08631c33c
                      • Instruction ID: 7ab29738e44d08a4830409297c6cb65e1993744f15e834caa09e988d16da5718
                      • Opcode Fuzzy Hash: ab37c828ab1c217b5aaaf5ae6d07fab262915ec6cec112feb3e8b1f08631c33c
                      • Instruction Fuzzy Hash: 27A1F222B1FE9255E620FB21E4613BAA352FB90744F800132E58D9ABD7DF7ED405CB48
                      Function 00007FFDA34042CC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 171COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\locale_refcounting.cpp, xrefs: 00007FFDA3404590
                      • (ptloci->lc_category[category].locale != nullptr && ptloci->lc_category[category].refcount != nullptr) || (ptloci->lc_category[cat, xrefs: 00007FFDA340456F
                      • %ls, xrefs: 00007FFDA340457B
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __free_lconv_mon__free_lconv_num
                      • String ID: %ls$(ptloci->lc_category[category].locale != nullptr && ptloci->lc_category[category].refcount != nullptr) || (ptloci->lc_category[cat$minkernel\crts\ucrt\src\appcrt\locale\locale_refcounting.cpp
                      • API String ID: 2148069796-164516335
                      • Opcode ID: e99f12f75d6ef5565beccb4d23c75a975ce498134b2bf147ccd281d0c1b7e2e0
                      • Instruction ID: 5981eb3563b761c0ba345c775e97c8d6d531d2e15426cd664093ba97292cad7f
                      • Opcode Fuzzy Hash: e99f12f75d6ef5565beccb4d23c75a975ce498134b2bf147ccd281d0c1b7e2e0
                      • Instruction Fuzzy Hash: C8915022719A8181EB908B4AE0D537EA361F7C4B50F055436EA8E57BE6CFFDD485CB04
                      Function 00007FFDA33AA2D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: AddressLibraryLoadProc$_heap_alloc
                      • String ID: "vector subscript out of range"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\vector$vector subscript out of range
                      • API String ID: 899574348-3282467248
                      • Opcode ID: bb497a56088e1bab00f30d6512e71b7242263416396ec007f44aeed549c273f4
                      • Instruction ID: 0b4327c489d41840002ef8a47d9e2b7f95441fbbfe84cf7e949f3d189c6110d8
                      • Opcode Fuzzy Hash: bb497a56088e1bab00f30d6512e71b7242263416396ec007f44aeed549c273f4
                      • Instruction Fuzzy Hash: 4A61E572F1EB8682EA10AB14E4A05BA7362FB85BC0F545531EA4D23B57DF7FE5808704
                      Function 00007FFDA338B600 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 148COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338B7B5
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory, xrefs: 00007FFDA338B7D5
                      • "null pointer cannot point to a block of non-zero size", xrefs: 00007FFDA338B7E3
                      • null pointer cannot point to a block of non-zero size, xrefs: 00007FFDA338B794
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_
                      • String ID: "null pointer cannot point to a block of non-zero size"$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xmemory$null pointer cannot point to a block of non-zero size
                      • API String ID: 593203224-3161448174
                      • Opcode ID: a4c971214753fdc7a09cab76ba580cee49a3f0ce652d1063d471645c6a94573e
                      • Instruction ID: 39d364398764564136ede15c98eb4a1b73812638a8919fa073182e7196972de1
                      • Opcode Fuzzy Hash: a4c971214753fdc7a09cab76ba580cee49a3f0ce652d1063d471645c6a94573e
                      • Instruction Fuzzy Hash: C8618C22B0AF8686FB00EFA4D4612ED2362EB54748F409135DE4C27B5AEF3DE595C344
                      Function 00007FFDA33B2C00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Char_traits
                      • String ID:
                      • API String ID: 3280932887-3916222277
                      • Opcode ID: e971b5c71613ddd2e8ce21f43c695e40c9063f9c4d5f9b247e0732da2e01e1dd
                      • Instruction ID: f84fddf8afbf8b5731d7ebd42c31980041912fa2bd9945ed64f3253413e066c4
                      • Opcode Fuzzy Hash: e971b5c71613ddd2e8ce21f43c695e40c9063f9c4d5f9b247e0732da2e01e1dd
                      • Instruction Fuzzy Hash: 66710F22A0EAC184D660AF55F0603BEB3A5FBC4740F504536E68DA3BAADF3ED444CB55
                      Function 00007FFDA3401600 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_lock$Concurrency::details::_SchedulerScheduler::_new[]
                      • String ID: minkernel\crts\ucrt\src\appcrt\mbstring\mbctype.cpp
                      • API String ID: 2575413788-426720447
                      • Opcode ID: 51714f034b5633d74f83ec5249bccc63bd3b29038e5ea21b57d8fd9edb44526a
                      • Instruction ID: d3acc58ac134c013b03a7cfbc0eaf308811a55682cd5115a0f7fc7e8d89cba1f
                      • Opcode Fuzzy Hash: 51714f034b5633d74f83ec5249bccc63bd3b29038e5ea21b57d8fd9edb44526a
                      • Instruction Fuzzy Hash: B761733670EA8186E760EB15E4A42AE73A1FBC4790F404231E69D977EADF7DD900CB44
                      Function 00007FFDA33A9CB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLockitstd::_$AddressFreeLoadLockit::_Lockit::~_Proc
                      • String ID: AwUEXkoZUTo4$BxMIDAxSdjk5Py5FMCYNCC8RQ1g3JA==
                      • API String ID: 1024880911-466956567
                      • Opcode ID: 146c7e7e451e83627899685f14165a1dd99e6069d533268ebd647728b298599e
                      • Instruction ID: 1960f8bfc85e88fe9898cc5a105d79a1622de8ed240bbb4d89c0ca818bef1867
                      • Opcode Fuzzy Hash: 146c7e7e451e83627899685f14165a1dd99e6069d533268ebd647728b298599e
                      • Instruction Fuzzy Hash: 3A419022F09A859AEB10EBB1E4602ED6372FB4478CF444131DE4D27B5AEF39D999C344
                      Function 00007FFDA33A9E60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLockitstd::_$AddressFreeLoadLockit::_Lockit::~_Proc
                      • String ID: AwUEHT9SQR85LihUHCoCAgkdRUY=$IwUEHRRCRngwIyM=
                      • API String ID: 1024880911-1853959681
                      • Opcode ID: 45396fd290b5169a2dc1bca107c77efce3a05af5138d66bffad9d3c0e0f0cc59
                      • Instruction ID: ba49948ce60e48b315201384a8995b7edef26e1a9f04e38ec82171c615a54c46
                      • Opcode Fuzzy Hash: 45396fd290b5169a2dc1bca107c77efce3a05af5138d66bffad9d3c0e0f0cc59
                      • Instruction Fuzzy Hash: 98419E22F0DA469AEB10EFB0D4602EC6372EB94348F444531DE0D6675AEF79EA89C344
                      Function 00007FFDA33A9B00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLockitstd::_$AddressFreeLoadLockit::_Lockit::~_Proc
                      • String ID: AwUEXkoZUTo4$FwQBCBtDejQ+KixF
                      • API String ID: 1024880911-2612433379
                      • Opcode ID: 9040a89f88169efd4a41a4ced064b67880f6305324c0ff9c24784fe46918e95d
                      • Instruction ID: 63a28134773f3bd1492a82c4158f3766d0f82d7e66c03e72b3645aa2dfb2f721
                      • Opcode Fuzzy Hash: 9040a89f88169efd4a41a4ced064b67880f6305324c0ff9c24784fe46918e95d
                      • Instruction Fuzzy Hash: 81418F22B19E8599EB10EFB1D4602EC2372FB44788F548131DE4D67B5ADF79D989C308
                      Function 00007FFDA33AA9F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFreeLoadProc
                      • String ID: DwQfAx1bBmR6KyNd$EAQfABFZVCIxHz1eOiESHg==
                      • API String ID: 145871493-3991031038
                      • Opcode ID: 0c9927f82b7221fb17b113cc6a67044ad7fc402ad35eb6f19271f4f38526906e
                      • Instruction ID: 1bd739d3db95de5765e007236be7ad75d6548efd8701cb786bf7cfc2c0c3c41d
                      • Opcode Fuzzy Hash: 0c9927f82b7221fb17b113cc6a67044ad7fc402ad35eb6f19271f4f38526906e
                      • Instruction Fuzzy Hash: A2316F32B19A459AEB00EFB1D4602EC23B2FB88748F505435DE0D66B5ADF79D94AC314
                      Function 00007FFDA33D1750 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82timeCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Time$FileSystem
                      • String ID: %ls$common_timespec_get$minkernel\crts\ucrt\src\appcrt\time\time.cpp$ts != nullptr
                      • API String ID: 2086374402-55338918
                      • Opcode ID: 0c730edbd07d5b0400360a063bbf8bf7d4f580eff2b4933ce88d5d92c60d6904
                      • Instruction ID: f1c2a4c87b05c9d65930f3c812f11ab7d1dfd5919888a2c8c5c9e9788b06cac2
                      • Opcode Fuzzy Hash: 0c730edbd07d5b0400360a063bbf8bf7d4f580eff2b4933ce88d5d92c60d6904
                      • Instruction Fuzzy Hash: 72314B32B1EB458AE790DB54F46036AB6A1FB84780F100535E78E93BA9DF7ED444CB04
                      Function 00007FFDA33BFFB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$D:\a\_work\1\s\src\vctools\crt\vcruntime\src\internal\winapi_downlevel.cpp$cached_fp == invalid_function_sentinel()$cached_fp == new_fp
                      • API String ID: 0-3288861829
                      • Opcode ID: aa12944d1fbdb21d97269e5afe1576f2135c4217f720af235899d891d8824a39
                      • Instruction ID: 3585f1168c20e55822f4cca8e06c5803887e2b8488ed841bda9b49d96922785a
                      • Opcode Fuzzy Hash: aa12944d1fbdb21d97269e5afe1576f2135c4217f720af235899d891d8824a39
                      • Instruction Fuzzy Hash: 41419435B1EF8681EA50EB18E0A036AE7A6FB84384F501435E68D537A6DF3EE154CB04
                      Function 00007FFDA3395E30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Library$AddressFreeLoadProc
                      • String ID: AwQZLg1FRzM6Ox9DNicEHh4xUw==$DwQfAx1bBmR6KyNd
                      • API String ID: 145871493-647104935
                      • Opcode ID: 30ab4113cfe1fe6cc93129f7af2bfc5e65a042d73031ffcbfe8f818a26a2c862
                      • Instruction ID: d4c85f78d5752c284b341b3c8c71b486b33d0293afa916e8bd1390073c6bf8df
                      • Opcode Fuzzy Hash: 30ab4113cfe1fe6cc93129f7af2bfc5e65a042d73031ffcbfe8f818a26a2c862
                      • Instruction Fuzzy Hash: EF316D32B09A06DAEB10EFB0D4602EC33B6FB48348B411131DA0D66B5ADF7AD559C314
                      Function 00007FFDA33C52F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: swprintf
                      • String ID: %.2X $(*_errno())$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$print_block_data
                      • API String ID: 233258989-3778139020
                      • Opcode ID: f2fd4913f4b3a84c63d7878809e9cf9d978415eb52a770733dceac7889c124c3
                      • Instruction ID: 37a10c47019c24c8e8a38251176860fb04ece1ade856c7a657947aa9937051c7
                      • Opcode Fuzzy Hash: f2fd4913f4b3a84c63d7878809e9cf9d978415eb52a770733dceac7889c124c3
                      • Instruction Fuzzy Hash: 0631527260EB8185E710AB59E4602AEBBA1E7C5780F500136EACD53B9ADF7ED448CB04
                      Function 00007FFDA33D2480 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: %ls$_get_stream_buffer_pointers$minkernel\crts\ucrt\src\appcrt\stdio\_file.cpp$public_stream != nullptr
                      • API String ID: 2780765137-3312750997
                      • Opcode ID: 3c4ccb7dd40f4d53a856cb2445bcbc7483d3384d08cd6986bbc038e664079f6d
                      • Instruction ID: 5920a1de881c55aea70e718b115fccd2139cd8d2727583b5abff045aa02ab997
                      • Opcode Fuzzy Hash: 3c4ccb7dd40f4d53a856cb2445bcbc7483d3384d08cd6986bbc038e664079f6d
                      • Instruction Fuzzy Hash: 2F318D32A1EF8681E750EB50F46136AB7A2FB80384F404431F68D92796DF7ED485CB44
                      Function 00007FFDA33F92B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 63COMMON
                      Download Yara Rule
                      APIs
                      • __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33F92C3
                        • Part of subcall function 00007FFDA33D25B0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D25C3
                        • Part of subcall function 00007FFDA33D25B0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00007FFDA33D2CC6), ref: 00007FFDA33D25D7
                        • Part of subcall function 00007FFDA33D25F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D2603
                        • Part of subcall function 00007FFDA33D25F0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00007FFDA33D2CE6), ref: 00007FFDA33D2617
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_CriticalSchedulerScheduler::_Section$EnterLeave__crt_scoped_stack_ptr
                      • String ID: %ls$common_ftell$minkernel\crts\ucrt\src\appcrt\stdio\ftell.cpp$stream.valid()
                      • API String ID: 3703195185-1581668893
                      • Opcode ID: 369c9412252f1b220c49e5f14587e0d1bf1c798afb7cb3017b7b9b47ca4e1571
                      • Instruction ID: ca52ce62c111b7cb9b57cab4e5f0750361af7bac7abca965a16a415bc0ca4dc2
                      • Opcode Fuzzy Hash: 369c9412252f1b220c49e5f14587e0d1bf1c798afb7cb3017b7b9b47ca4e1571
                      • Instruction Fuzzy Hash: A2315E31A1EF4681E650AB51E46036AB3A2FB84794F400132F68E977D6DF7EE404CB48
                      Function 00007FFDA33F62D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: BuffersErrorFileFlushLast
                      • String ID: %ls$("Invalid file descriptor. File possibly closed by a different thread",0)$minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp
                      • API String ID: 1917127615-1268643607
                      • Opcode ID: c6faa57e4ffc3104495107354c5d4a3f59f0bf388a1a32667b13044016890bce
                      • Instruction ID: d9de931423be537c4dc5b1115d148093fb5d9168b3fabad03f4e07432a6d3d2e
                      • Opcode Fuzzy Hash: c6faa57e4ffc3104495107354c5d4a3f59f0bf388a1a32667b13044016890bce
                      • Instruction Fuzzy Hash: 8C21D876B0EF0686E7509B65E86112E73A3FB84780F404136D94D973A6DF7DE414C704
                      Function 00007FFDA338C5A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Xinvalid_argumentstd::_std::bad_exception::bad_exception$_mbsset_s
                      • String ID: invalid stoi argument$stoi argument out of range
                      • API String ID: 3515094522-1606216832
                      • Opcode ID: 01d46303d256c9938e083ff3fbf18d52c4177514b2066c12b36f5a0d0f0d94a0
                      • Instruction ID: 7b33e8e434de6fae26ff4094b1eef69f9cb08b7a4752050f2244db8aefc62934
                      • Opcode Fuzzy Hash: 01d46303d256c9938e083ff3fbf18d52c4177514b2066c12b36f5a0d0f0d94a0
                      • Instruction Fuzzy Hash: 15016122B0DB4581E760AF15E561169A362EB88784F844531EA8C2775ACF7EE541CB08
                      Function 00007FFDA3413D73 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$DestroyedExceptionObject
                      • String ID: csm
                      • API String ID: 1489075212-1018135373
                      • Opcode ID: 3426411829b87d5bf9c3320a271a591f3f1dbc733ecb4554bc21e9ee616dc920
                      • Instruction ID: 28ff814f467b2019ecc3d1fdd10c2d444a28a50851058c5647d06b8c8ecfcfb9
                      • Opcode Fuzzy Hash: 3426411829b87d5bf9c3320a271a591f3f1dbc733ecb4554bc21e9ee616dc920
                      • Instruction Fuzzy Hash: BE113332B06B45CAD760AF21C4A00A83B76FB59B58F421135FA4E577A6CF7AD840C308
                      Function 00007FFDA33EBE00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _invoke_watson_if_error$_aligned_msize
                      • String ID: __lc_lctowcs$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscpy_s(locale, numberOfElements, names->szLanguage)
                      • API String ID: 361012348-687637656
                      • Opcode ID: 19a25908107d79d48e6bd22c6421a2b89682eea09b6ab36f29ab4c23e9cdfbad
                      • Instruction ID: 1774842f7e0baee7d537e4de510ef846417a67ceaa0e738a32ac12691bc19095
                      • Opcode Fuzzy Hash: 19a25908107d79d48e6bd22c6421a2b89682eea09b6ab36f29ab4c23e9cdfbad
                      • Instruction Fuzzy Hash: 8D211A62B0DB4181EB00DB99E4513AAA7A1FBC5784F104036EECC97B6ADFBED514CB44
                      Function 00007FFDA33B87D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: csm
                      • API String ID: 2516003560-1018135373
                      • Opcode ID: a00a9c36c10f9d624778df7cce5f4de448e401a7b2ddc3dfab6ad5003472fdf6
                      • Instruction ID: 8e4dd14f39dada9f81ba0037f19a972b8a43959e8888bbccab7a1f1b4a6082ca
                      • Opcode Fuzzy Hash: a00a9c36c10f9d624778df7cce5f4de448e401a7b2ddc3dfab6ad5003472fdf6
                      • Instruction Fuzzy Hash: 92112B36A1DF89C6D760AF15E05002E77A1FBC8B95F044131EA8E93766CFBDD1408B05
                      Function 00007FFDA33EB790 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EB80E
                      • wcsncpy_s(localeNameOutput, localeNameSizeInChars, psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(psetloc_data->_cacheL, xrefs: 00007FFDA33EB81C
                      • _expandlocale_locale_name_cache::_expandlocale_locale_name_cache, xrefs: 00007FFDA33EB815
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: _expandlocale_locale_name_cache::_expandlocale_locale_name_cache$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(localeNameOutput, localeNameSizeInChars, psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(psetloc_data->_cacheL
                      • API String ID: 3803822016-2840062834
                      • Opcode ID: 07dbe4b6bf2369af5379228f5a46b863b2affe0b0edee25ffeb10103f8b31f2d
                      • Instruction ID: a17a0c496f1df7e6c00a03bf453abd73c0c6f6d0759d8ad8ec14799134189833
                      • Opcode Fuzzy Hash: 07dbe4b6bf2369af5379228f5a46b863b2affe0b0edee25ffeb10103f8b31f2d
                      • Instruction Fuzzy Hash: 54119076608B8582DB00DB99F49036ABB61F7C9B94F504026EF8C53B29CFBDC554CB44
                      Function 00007FFDA33C02D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28libraryCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: LibraryLoad$ErrorLastwcsncmp
                      • String ID: api-ms-
                      • API String ID: 3100911417-2084034818
                      • Opcode ID: 1143678abe46faee19fb9e3f8c887628b8ebbadb27c06695bee3fb95fe57019c
                      • Instruction ID: d45cea773f8aefc6c6ee8adfa1f44d819f2f1396ad9e205c6e56a7f3a482ba40
                      • Opcode Fuzzy Hash: 1143678abe46faee19fb9e3f8c887628b8ebbadb27c06695bee3fb95fe57019c
                      • Instruction Fuzzy Hash: B3F06D11F1DE91C3E750A765E86432E93A2FF81740F544030D98DA27A5DF6ED945CB04
                      Function 00007FFDA33EE030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 27COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EE087
                      • wcsncpy_s(names->szCodePage, (sizeof(*__countof_helper(names->szCodePage)) + 0), section.ptr, section.length), xrefs: 00007FFDA33EE095
                      • parse_bcp47_code_page, xrefs: 00007FFDA33EE08E
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$parse_bcp47_code_page$wcsncpy_s(names->szCodePage, (sizeof(*__countof_helper(names->szCodePage)) + 0), section.ptr, section.length)
                      • API String ID: 3803822016-3757940213
                      • Opcode ID: b54380edf0d019ddd7dd3122f965cfad0da489224b6266eca7142595298daf47
                      • Instruction ID: af64905b6a691f901dad95535bf95286b6e416263da5e29b77fcbd3c144092cf
                      • Opcode Fuzzy Hash: b54380edf0d019ddd7dd3122f965cfad0da489224b6266eca7142595298daf47
                      • Instruction Fuzzy Hash: F4F0A471B09B4581EB00DF55E0543AA6762FB85784F500035DE8C23765CF7EC549CB44
                      Function 00007FFDA33EB840 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EB894
                      • wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), _localeNameOutput, _l, xrefs: 00007FFDA33EB8A2
                      • _expandlocale_locale_name_cache::~_expandlocale_locale_name_cache, xrefs: 00007FFDA33EB89B
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: _expandlocale_locale_name_cache::~_expandlocale_locale_name_cache$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), _localeNameOutput, _l
                      • API String ID: 3803822016-3136420129
                      • Opcode ID: 23c8e644173c553e0ddd55f22d6243529a7f9e63f37cdedaeb7e52ddc73a67e8
                      • Instruction ID: 7a05163a3f736337a7b601dc87d0adcc8abdf6d6c709ec23ffb050de5b8d8700
                      • Opcode Fuzzy Hash: 23c8e644173c553e0ddd55f22d6243529a7f9e63f37cdedaeb7e52ddc73a67e8
                      • Instruction Fuzzy Hash: F9F04F65B09B8682EB00DFA5E46036A6761F785B89F500026EE8C63766CE7EC405CB48
                      Function 00007FFDA33EBBE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EBC2A
                      • _expandlocale_locale_name_cache::commit_locale_name, xrefs: 00007FFDA33EBC31
                      • wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), new_locale_name, new_, xrefs: 00007FFDA33EBC38
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: _expandlocale_locale_name_cache::commit_locale_name$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(_psetloc_data->_cacheLocaleName, (sizeof(*__countof_helper(_psetloc_data->_cacheLocaleName)) + 0), new_locale_name, new_
                      • API String ID: 3803822016-2934041511
                      • Opcode ID: 389d6f7dfd6584f1a42567dbc54835d95f624cdbcad8e592df18d8fe01dd53c1
                      • Instruction ID: b7dbcf1f0e00c62425c527e5193aa0a93c2f0711467566ef6d623eb7e0c7feef
                      • Opcode Fuzzy Hash: 389d6f7dfd6584f1a42567dbc54835d95f624cdbcad8e592df18d8fe01dd53c1
                      • Instruction Fuzzy Hash: B6F03C66A0DB8682DB00DF95F45439AA771FBC5784F500026EE8C6376ACFBEC114CB44
                      Function 00007FFDA33EBC60 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 22COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • wcsncpy_s(_localeNameOutput, _localeNameSizeInChars, new_locale_name, new_locale_name_length), xrefs: 00007FFDA33EBCB2
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EBCA4
                      • _expandlocale_locale_name_cache::commit_locale_name_cache_already_updated, xrefs: 00007FFDA33EBCAB
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: FrameHandler2_invoke_watson_if_error
                      • String ID: _expandlocale_locale_name_cache::commit_locale_name_cache_already_updated$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcsncpy_s(_localeNameOutput, _localeNameSizeInChars, new_locale_name, new_locale_name_length)
                      • API String ID: 3803822016-2267742848
                      • Opcode ID: b05f50ee9f2592d6d11bd3255f3d63d69e5c68892a57a11e92324e7917289633
                      • Instruction ID: 7e923a047425c305012e4d6cf75cc845c3841e74b6792351e58684f28be7d789
                      • Opcode Fuzzy Hash: b05f50ee9f2592d6d11bd3255f3d63d69e5c68892a57a11e92324e7917289633
                      • Instruction Fuzzy Hash: AEF01D76A08B8581DB00DF95E05029ABB71F785784F504026EFCC63729CFBEC558CB85
                      Function 00007FFDA33F2630 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 264COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: %ls$_mbstowcs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\mbstowcs.cpp$s != nullptr
                      • API String ID: 0-454128329
                      • Opcode ID: fbf55e7b02a20501e9ee9246dfcbf4a1de6a4994a07008bc2f16ee95ec9a65e6
                      • Instruction ID: c99d196ae140e0ac37fc50815fd30bb97707c1cf607566eac4f0de3193da0e6a
                      • Opcode Fuzzy Hash: fbf55e7b02a20501e9ee9246dfcbf4a1de6a4994a07008bc2f16ee95ec9a65e6
                      • Instruction Fuzzy Hash: 53D12C3660EF85C5E7A09B19F46036AB3A1FB847A0F504235EA9D97BE9CF3DD4448B04
                      Function 00007FFDA33B3530 Relevance: 7.7, APIs: 5, Instructions: 168COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Fgetc
                      • String ID:
                      • API String ID: 1720979605-0
                      • Opcode ID: 059be990d2c755b8ffe8fc41f9baeb42876874c63cf05f8b8d94185a4f81d4ee
                      • Instruction ID: e632fbd31358090a068c13d278d5fc3fab73edabea0659da4ba2dbd07f0d3782
                      • Opcode Fuzzy Hash: 059be990d2c755b8ffe8fc41f9baeb42876874c63cf05f8b8d94185a4f81d4ee
                      • Instruction Fuzzy Hash: FF912D22B0EED285DA60AB55E4613BEB362FBC1750F404036E68D92B9BDF2DD448CB45
                      Function 00007FFDA33AC4E0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
                      • String ID:
                      • API String ID: 3053331623-0
                      • Opcode ID: d4d15f3e09b51425b14e6d290369b526ee8ff949026c59a65b2fc210932a2022
                      • Instruction ID: 91fa32aabd5f016c0a2eefe1e7b5d153d128a74d94f1b2110b8fd3605c1fe348
                      • Opcode Fuzzy Hash: d4d15f3e09b51425b14e6d290369b526ee8ff949026c59a65b2fc210932a2022
                      • Instruction Fuzzy Hash: 0741A322B0EF8185EA11FB15E4641A97362FB45B90F485932EA4E677AADF3FE401C704
                      Function 00007FFDA33A5410 Relevance: 7.6, APIs: 5, Instructions: 90COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
                      • String ID:
                      • API String ID: 3053331623-0
                      • Opcode ID: 926ec95ec33d4d831f69484029ebd82855dd050cc01182b90e0e5340dc553b07
                      • Instruction ID: becaa86eb9da707f029a698e328c3b1bebc7d1a45ac32b7c72e47c26da998e5c
                      • Opcode Fuzzy Hash: 926ec95ec33d4d831f69484029ebd82855dd050cc01182b90e0e5340dc553b07
                      • Instruction Fuzzy Hash: 51318662B0EE4185FA21BF15E4601B56362FB54794F480531EA8D277ABDE3FE541C704
                      Function 00007FFDA3389120 Relevance: 7.6, APIs: 5, Instructions: 72COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_task$_heap_alloc
                      • String ID:
                      • API String ID: 3657483247-0
                      • Opcode ID: 7b03d0c2fe064c143e1ec26882eb7b462d7dacee058c6afe50d80a43b9288060
                      • Instruction ID: 4674597142ff7fb9e186cd6899bec084bf01a33573f96b366d3acd574a38cca1
                      • Opcode Fuzzy Hash: 7b03d0c2fe064c143e1ec26882eb7b462d7dacee058c6afe50d80a43b9288060
                      • Instruction Fuzzy Hash: 8D310732515B50C6E349DF25E85025977F8F748B84B54812AE78887B95DF38E9B1CB80
                      Function 00007FFDA33B6CA0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID:
                      • API String ID: 2516003560-0
                      • Opcode ID: f8dc7c45536f9087a08dea110d85e2463c1ea9c559584f172bde4df3d9140b41
                      • Instruction ID: 376c8672365d7ccdb8f29d1673539d13d877835ecf454556fc79ccf427f9effb
                      • Opcode Fuzzy Hash: f8dc7c45536f9087a08dea110d85e2463c1ea9c559584f172bde4df3d9140b41
                      • Instruction Fuzzy Hash: DE219F36608F89C2D610EF19E09035EBBA5F7D9B84F104125EACE47B6ACF7AD054CB44
                      Function 00007FFDA33BF1F0 Relevance: 7.5, APIs: 5, Instructions: 32COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$ControlFrameFromHandler3::State
                      • String ID:
                      • API String ID: 497750862-0
                      • Opcode ID: 8eda8ed0718ac14f5e94eb3765541656d47748580e4c72de673a29340fb62298
                      • Instruction ID: ffa2653fc985216fea2decaf35b7a5b41ac476e5da9714cf3ae27e1c2ed6a198
                      • Opcode Fuzzy Hash: 8eda8ed0718ac14f5e94eb3765541656d47748580e4c72de673a29340fb62298
                      • Instruction Fuzzy Hash: 9F010976E0DE46DAE620FF28E05112E7AA1FB85750F100235EADD577AACB7ED441CB04
                      Function 00007FFDA33B9DC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __except_validate_context_record.LIBVCRUNTIMED ref: 00007FFDA33B9DE3
                        • Part of subcall function 00007FFDA33BFDD0: _guard_icall_checks_enforced.LIBCMTD ref: 00007FFDA33BFDD9
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __except_validate_context_record_guard_icall_checks_enforced
                      • String ID: csm
                      • API String ID: 95139742-1018135373
                      • Opcode ID: 9eeab1e8e9612b0d48273e19414be7011a564cc05d7be0a580005b6738cbb75f
                      • Instruction ID: cb141d1165bceeed21c48eb580347ac787541c9f1dc9e22bbb64c8ab137c9f16
                      • Opcode Fuzzy Hash: 9eeab1e8e9612b0d48273e19414be7011a564cc05d7be0a580005b6738cbb75f
                      • Instruction Fuzzy Hash: 1AC1FA3671EF8086DB90DF09E49062AB7A1F7D8790F105126EA8E87BA9DF3DD451CB04
                      Function 00007FFDA33F7AA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154fileCOMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ErrorLast$FileWrite
                      • String ID: U
                      • API String ID: 603252729-4171548499
                      • Opcode ID: a4534f39252f13d329062389f695fd392a400e8072bc9f2d3ae7d6b057e89345
                      • Instruction ID: ba72f96ddf9a50c3328c88e4324280e8048ede36fdd5c916806766a1f2e7b266
                      • Opcode Fuzzy Hash: a4534f39252f13d329062389f695fd392a400e8072bc9f2d3ae7d6b057e89345
                      • Instruction Fuzzy Hash: 5C71E93660EB858ADB60DB59E4503AAB7A1F7887C4F900136EB8D87B69DF7DD440CB04
                      Function 00007FFDA33B0AB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID: 0-3916222277
                      • Opcode ID: 081d049e3a1af955a9c010c93714bcce616d6405ef4572914c769ea9d68eeec2
                      • Instruction ID: c0cad49fda17b4570bd15181d6018878d6b2e5cb98fe9b81a0b26aba9d2b5424
                      • Opcode Fuzzy Hash: 081d049e3a1af955a9c010c93714bcce616d6405ef4572914c769ea9d68eeec2
                      • Instruction Fuzzy Hash: DF713E22A0EAC185D660FF55E4603BEB7A2FB81740F504436E68D63B9ADF3EE444CB54
                      Function 00007FFDA33F3F50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_scoped_stack_ptr
                      • String ID: %ls$minkernel\crts\ucrt\src\appcrt\stdio\_flsbuf.cpp$stream.valid()
                      • API String ID: 1704660383-221745940
                      • Opcode ID: d8ea6f5e810f9f5c04fbda28abd9813933fb830938613eaa32b16f9c372cbf60
                      • Instruction ID: 909ae98ad66c517a63e2b09e5662259c5f82c514bb16a60d565087036c169d9f
                      • Opcode Fuzzy Hash: d8ea6f5e810f9f5c04fbda28abd9813933fb830938613eaa32b16f9c372cbf60
                      • Instruction Fuzzy Hash: 3B513761B1ED4252F610FB25E4622BB6692EFD1380F904032F68D9A7E7DE2ED445CB48
                      Function 00007FFDA33F3CF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __crt_scoped_stack_ptr
                      • String ID: %ls$minkernel\crts\ucrt\src\appcrt\stdio\_flsbuf.cpp$stream.valid()
                      • API String ID: 1704660383-221745940
                      • Opcode ID: c192645a937187c20963e0c3b3c8df1643d2cfe52f583ad84651b8cce1ee8202
                      • Instruction ID: 3ec31ad9ae6c61dded13b4aa3721d92b60e922ba372105ab3e1d30834d696439
                      • Opcode Fuzzy Hash: c192645a937187c20963e0c3b3c8df1643d2cfe52f583ad84651b8cce1ee8202
                      • Instruction Fuzzy Hash: 04514761B0ED4252F610FB24E4612BB6792EF90790F900132F69D9A7E7DF2ED845CB48
                      Function 00007FFDA33D71A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 00007FFDA33D4860: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D4878
                        • Part of subcall function 00007FFDA33F3C10: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33F3C65
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA33D72D7
                      • __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33D72E6
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_$__crt_unique_heap_ptr
                      • String ID: Y$minkernel\crts\ucrt\src\appcrt\stdio\setvbuf.cpp
                      • API String ID: 2978586664-2115953152
                      • Opcode ID: fc43c5dbd14e521786e2be64ac85185f0b8adcf4e88fd57504b3738b205b6d1f
                      • Instruction ID: cc09910054a892fb856d56420ce645526b7fd88e9e43da4c2b50cfd2ad077a16
                      • Opcode Fuzzy Hash: fc43c5dbd14e521786e2be64ac85185f0b8adcf4e88fd57504b3738b205b6d1f
                      • Instruction Fuzzy Hash: 8D41263670DF8585DA60AB1AE49136EA761F7C8BD0F404122EA9D57BAACF2ED4008B44
                      Function 00007FFDA3405C80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: U$minkernel\crts\ucrt\src\appcrt\locale\inittime.cpp
                      • API String ID: 2780765137-3976952806
                      • Opcode ID: cd9adbdb5970b0be57340dd49032d1ff6af7623461400080522fab6191061c7c
                      • Instruction ID: 54d3e921333cf977fd78984c46f1e4c2baed67d69d9214aed5907fdb623d974a
                      • Opcode Fuzzy Hash: cd9adbdb5970b0be57340dd49032d1ff6af7623461400080522fab6191061c7c
                      • Instruction Fuzzy Hash: BC213021B2EA4291EA40EB11E4653BA6362FF91740F805032F68E967D7DF7EE804C748
                      Function 00007FFDA33F3C10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::_
                      • String ID: %ls$minkernel\crts\ucrt\src\appcrt\stdio\_freebuf.cpp$public_stream != nullptr
                      • API String ID: 2780765137-1254537880
                      • Opcode ID: 723a290794a1eeaf22a3dd70160b4e7125b8f814b96d7cc9c79a073d852f1741
                      • Instruction ID: 4abeabe738a64e93886da0a042fa5b0ef93c71586bade62d36e91ac9e5b9cbed
                      • Opcode Fuzzy Hash: 723a290794a1eeaf22a3dd70160b4e7125b8f814b96d7cc9c79a073d852f1741
                      • Instruction Fuzzy Hash: 0E215B21B2EE8291E650FB10E4623BA6292FF90740FC04032F68D967D7EF6ED904C758
                      Function 00007FFDA33ECB63 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _invoke_watson_if_error
                      • String ID: _wsetlocale_get_all$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscat_s(pch, cch, L";")
                      • API String ID: 2705885044-2337922735
                      • Opcode ID: cb0c2eb46dcca9b22f2a1859bbb19ca12578b75d2e503d100c81124b012a2fea
                      • Instruction ID: 857220d2479877ac2c3b11c5b5c17673aa038c3bbed1102e9bad3dc377fd2c49
                      • Opcode Fuzzy Hash: cb0c2eb46dcca9b22f2a1859bbb19ca12578b75d2e503d100c81124b012a2fea
                      • Instruction Fuzzy Hash: 65215E7272DA4182DA50DB95E4A02AAB7A1FB88780F002136FA8E93769CF7DD151CB44
                      Function 00007FFDA33EC870 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      • _wcscats, xrefs: 00007FFDA33EC923
                      • minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FFDA33EC91C
                      • wcscat_s(outstr, numberOfElements, ((sizeof(wchar_t *) > sizeof(__int64) || (sizeof(wchar_t *) & (sizeof(wchar_t *) - 1)) != 0) ? , xrefs: 00007FFDA33EC92A
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _invoke_watson_if_error
                      • String ID: _wcscats$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp$wcscat_s(outstr, numberOfElements, ((sizeof(wchar_t *) > sizeof(__int64) || (sizeof(wchar_t *) & (sizeof(wchar_t *) - 1)) != 0) ?
                      • API String ID: 2705885044-3504986905
                      • Opcode ID: c597d0289211b9e4dbabc8f64a8fd9f4e40f035f77a9311bad4cfa03b636dbc8
                      • Instruction ID: 6c518d0dce6f2f36231750272e11a04dc38464ff86fb4673ada77c1227e5dc17
                      • Opcode Fuzzy Hash: c597d0289211b9e4dbabc8f64a8fd9f4e40f035f77a9311bad4cfa03b636dbc8
                      • Instruction Fuzzy Hash: 4421F376A2EF8586D780DB19E49025EBBA1F788784F501026FACE93B69DF3DD050CB04
                      Function 00007FFDA338BB00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Xinvalid_argument
                      • String ID: bad locale name
                      • API String ID: 2491201059-1405518554
                      • Opcode ID: 80188f5143d2ef0829719828a5730bd4b3306ecfef9dc9d7437f557180999907
                      • Instruction ID: 31f050b4648bef7bd95c55e42f7ad0bac356718dca457b184e3f7c0a210302d1
                      • Opcode Fuzzy Hash: 80188f5143d2ef0829719828a5730bd4b3306ecfef9dc9d7437f557180999907
                      • Instruction Fuzzy Hash: 7201A23260AFC18AC744EF74A89015877B6FB18B88B185538DA8C8371BEF39C490C344
                      Function 00007FFDA3413CA9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$DestroyedExceptionObject
                      • String ID: csm
                      • API String ID: 1489075212-1018135373
                      • Opcode ID: 45fc25228333b8835a864d84cb728d154b25b83ea04dab2c50b4bef0d7df9f3a
                      • Instruction ID: d0b3b9c97c3e94350065efb1b0c3d1b3341b98682d117fe1c111dfaed53ab501
                      • Opcode Fuzzy Hash: 45fc25228333b8835a864d84cb728d154b25b83ea04dab2c50b4bef0d7df9f3a
                      • Instruction Fuzzy Hash: 36112E33B05A45CADB20AF25C4A10782776FB98B58F511235FA4E5B7A6CF6AD940C708
                      Function 00007FFDA33C2900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_HandleModuleSchedulerScheduler::_
                      • String ID: CorExitProcess$mscoree.dll
                      • API String ID: 302703240-1276376045
                      • Opcode ID: b4dd9bfea75f599e2005204b09a33ecbbaeb0527a98f7c57191f5488e068cfe7
                      • Instruction ID: 432cea181718d8936551cf2b8a83be6f270b38427e13448a523ff1519d261268
                      • Opcode Fuzzy Hash: b4dd9bfea75f599e2005204b09a33ecbbaeb0527a98f7c57191f5488e068cfe7
                      • Instruction Fuzzy Hash: 10114222B1EE4692DA20FB14F4611AAB362FF947A4F404235F58E937E7DF2DD5448B04
                      Function 00007FFDA33C2A60 Relevance: 6.1, APIs: 4, Instructions: 99COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 33ee4a3f8b3dc3b3f73b37e33473058ae51cc490f9c2ef52f1c8b4428a33ce93
                      • Instruction ID: e044ba538f5b2619f0cae59f764473074c75161df49386b9d6cdfa31f444d829
                      • Opcode Fuzzy Hash: 33ee4a3f8b3dc3b3f73b37e33473058ae51cc490f9c2ef52f1c8b4428a33ce93
                      • Instruction Fuzzy Hash: 18413222B1EE4186EA50FB29F46136FA7A1EBC4790F108135F68E93766DF3DD4458B04
                      Function 00007FFDA33E5670 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 1a4d65fe99d9f9ab1d78ff5cdae8b7ec49f07f134c1ee6dc259366cc3efdbefb
                      • Instruction ID: 8c3eed4ac8db655becae1fa4a608256698830da73bd6b6a77a477e265575814d
                      • Opcode Fuzzy Hash: 1a4d65fe99d9f9ab1d78ff5cdae8b7ec49f07f134c1ee6dc259366cc3efdbefb
                      • Instruction Fuzzy Hash: 27411022B1EE4186F650AB25E5613AAA7E2EBC4790F200135F6CE57BA6DF3DD4408B04
                      Function 00007FFDA33FFA50 Relevance: 6.1, APIs: 4, Instructions: 98COMMONLIBRARYCODE
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: ea6a3cb4564ab5cedbe2a918b8c6ef4ae8f18df3486f7da4830e9b41e7bf46e6
                      • Instruction ID: c63fdd35304690c11205442805cf60906185cc2cb7d33dc389986c7c3f4dbccd
                      • Opcode Fuzzy Hash: ea6a3cb4564ab5cedbe2a918b8c6ef4ae8f18df3486f7da4830e9b41e7bf46e6
                      • Instruction Fuzzy Hash: 68414532B1EE4182E750AB69E46136FA7A1FBC4790F100136FA8E577A6DF3DD8408B04
                      Function 00007FFDA33960F0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_task$_heap_alloc
                      • String ID:
                      • API String ID: 3657483247-0
                      • Opcode ID: e3701771adba3fc3b8608beb17ae73e46000c7a603822a1e4642d2fb7e996696
                      • Instruction ID: 4402ffd24f431a0ae255e0ea41ac03eb54dc96dab0348af55ee544f09bc4c685
                      • Opcode Fuzzy Hash: e3701771adba3fc3b8608beb17ae73e46000c7a603822a1e4642d2fb7e996696
                      • Instruction Fuzzy Hash: F731C733515B9182E3159F30E89035973B8F758F88F698219E7C807B99DF34D9A1C790
                      Function 00007FFDA33AE050 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EventLockitWaitstd::_$Concurrency::details::Lockit::_Lockit::~_NodeNode::Setgloballocalenew[]std::locale::_
                      • String ID:
                      • API String ID: 3239492027-0
                      • Opcode ID: 23e39481080a5d4b43a5c42bbcd31e10ccc03af8b432b70dadafa1f754b94255
                      • Instruction ID: 74d911eb7698e616f9b435dfa4ab32f2d1aef5efd38c0462468c640d04212cdf
                      • Opcode Fuzzy Hash: 23e39481080a5d4b43a5c42bbcd31e10ccc03af8b432b70dadafa1f754b94255
                      • Instruction Fuzzy Hash: 4E313C36A0DF8581DA20EB15E4A022AB7A1FBC8BD4F444535EA8D5377ACF7EC540CB04
                      Function 00007FFDA33F3AE0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: CriticalSection__vcrt_lock$Concurrency::details::_DeleteEnterSchedulerScheduler::_
                      • String ID:
                      • API String ID: 27951074-0
                      • Opcode ID: 3ae4729a016763c6c9baee245556228f498e51731a6c010fe907ee40fb7edb63
                      • Instruction ID: 550a2c94f1a216592216eaafaa7339cc824a03a8b66986a154936c3aba45ba98
                      • Opcode Fuzzy Hash: 3ae4729a016763c6c9baee245556228f498e51731a6c010fe907ee40fb7edb63
                      • Instruction Fuzzy Hash: A1212565B0FA0686EA34DB09E4B233963A1FB88758F400235E9CE577A6CF3FD5018B44
                      Function 00007FFDA33BA940 Relevance: 6.1, APIs: 4, Instructions: 55COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ReadUnsigned$FuncImageOffset
                      • String ID:
                      • API String ID: 439361810-0
                      • Opcode ID: 1e24120de7a75267c18a3e6f5ea890041c1f62116286d7e1c3121b4b4ee60727
                      • Instruction ID: d1bb47765f4866d785996acedeed2ea702ceffe9edb2a7308cb63d665967bbfe
                      • Opcode Fuzzy Hash: 1e24120de7a75267c18a3e6f5ea890041c1f62116286d7e1c3121b4b4ee60727
                      • Instruction Fuzzy Hash: 8F213932A1DE85CAD620EF15E05022AB7A1FB88354F100235F29E92B9ACF3DD5408F48
                      Function 00007FFDA33EA090 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Container_base12Container_base12::~_ErrorFileLastModuleName_dosmaperrstd::_
                      • String ID:
                      • API String ID: 2518310752-0
                      • Opcode ID: a750bc43f48650b65ac63f696a8bfb13a79cd251ce714e08fc64ffec691de9c2
                      • Instruction ID: eda1cda9b8c7b0897d1bc3ccb0711059b9d9048b25c0b88525defa692f388808
                      • Opcode Fuzzy Hash: a750bc43f48650b65ac63f696a8bfb13a79cd251ce714e08fc64ffec691de9c2
                      • Instruction Fuzzy Hash: B1113332B1DA8186E760EB24F4553AB77A2FB84380F501135E68E92B6ADF3DD544CF44
                      Function 00007FFDA33BF4C0 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Read$Unsigned
                      • String ID:
                      • API String ID: 690901639-0
                      • Opcode ID: 997d214639c8de6a40983724337db2da493b3f0164aa2394e80dd5bf3b690909
                      • Instruction ID: 6a5a2447b842dd4a6c49d98b3f2f5d381d907ce255807fde97837ff9bbb40542
                      • Opcode Fuzzy Hash: 997d214639c8de6a40983724337db2da493b3f0164aa2394e80dd5bf3b690909
                      • Instruction Fuzzy Hash: F611CE36A2EA45C6CB84EF19E49142EB7A1FBC4B80B101426FA8F97765CF39D542CF44
                      Function 00007FFDA33B6BD0 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                      Download Yara Rule
                      APIs
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID:
                      • API String ID: 2516003560-0
                      • Opcode ID: 5d331982587b77fed0568ac2d33f1d9354825b90d2fee1cd5b157c62b4a24687
                      • Instruction ID: adc636c5b33e1a3873ece51cc59958e34be588be38fd49cb88a0dcf5db069b7f
                      • Opcode Fuzzy Hash: 5d331982587b77fed0568ac2d33f1d9354825b90d2fee1cd5b157c62b4a24687
                      • Instruction Fuzzy Hash: 0A117F36608F8882DA10EF59E09035EBBA5F7D9B84F104125EACD47B6ACF79D0548B40
                      Function 00007FFDA340AD40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON
                      Download Yara Rule
                      APIs
                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFDA340AD70
                        • Part of subcall function 00007FFDA33B4EB0: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFDA33B4EBE
                        • Part of subcall function 00007FFDA33B4E90: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFDA33B4E9E
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_scoped_stack_ptr__crt_unique_heap_ptr
                      • String ID: minkernel\crts\ucrt\src\appcrt\lowio\osfinfo.cpp
                      • API String ID: 1054307577-534659383
                      • Opcode ID: 2d7f48b2d097a886eb6da1acbb3278b47832c56f675d8b915627066bfb716106
                      • Instruction ID: 44c9343e9fe41a961246525b46b224e10cefe6509fab4c214c1270030659ed65
                      • Opcode Fuzzy Hash: 2d7f48b2d097a886eb6da1acbb3278b47832c56f675d8b915627066bfb716106
                      • Instruction Fuzzy Hash: C0418E2272EB8081D780CB09E0A136EBBA1E7C5790F501026FB8F57BA6CF7ED4418B04
                      Function 00007FFDA33BA400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      • D:\a\_work\1\s\src\vctools\crt\vcruntime\src\internal\per_thread_data.cpp, xrefs: 00007FFDA33BA4B7
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: D:\a\_work\1\s\src\vctools\crt\vcruntime\src\internal\per_thread_data.cpp
                      • API String ID: 0-277556848
                      • Opcode ID: f6492ba7598ffe57cd4f1ae9084fb1325eedd3cd06a2ea4c4d27055ecd25daf0
                      • Instruction ID: ea3df3044dd4c49aad2eaabc17532636708d86e91f300ff29e2f69285ece0895
                      • Opcode Fuzzy Hash: f6492ba7598ffe57cd4f1ae9084fb1325eedd3cd06a2ea4c4d27055ecd25daf0
                      • Instruction Fuzzy Hash: 28411221B2DD8291E650FB14E4613BA6262FF80350F800231F59E567E7DF3EE945CB48
                      Function 00007FFDA33D9D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      • minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h, xrefs: 00007FFDA33D9E04
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 0-3378279506
                      • Opcode ID: a219812b556b3e4fa8377f6f8542d86e486195a3db9f0ab0172f9d517a366897
                      • Instruction ID: c4986ea45007a4929e32b7fec6360126d444c673b8a21e51f77e505601e00d2d
                      • Opcode Fuzzy Hash: a219812b556b3e4fa8377f6f8542d86e486195a3db9f0ab0172f9d517a366897
                      • Instruction Fuzzy Hash: 2031C43271DF8181EA20AB15E06136E67A2FBC4790F400631F6DE577EADE3ED5018B48
                      Function 00007FFDA33D9C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      • minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h, xrefs: 00007FFDA33D9CC1
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\inc\corecrt_internal_stdio_output.h
                      • API String ID: 0-3378279506
                      • Opcode ID: edbb23dfff7a866f135b186558f65cb8090800169ca33089220c8d57aed29899
                      • Instruction ID: 593d5739180c759b928e15d5118ef36971867b81486a55858db85b20ef4bb183
                      • Opcode Fuzzy Hash: edbb23dfff7a866f135b186558f65cb8090800169ca33089220c8d57aed29899
                      • Instruction Fuzzy Hash: F631C42271DF8181EA20AB15E0503AE6792FF817D0F500631F6DE677EADE3ED4018B08
                      Function 00007FFDA33B8FB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: ExceptionFileHeaderRaise
                      • String ID: csm
                      • API String ID: 2573137834-1018135373
                      • Opcode ID: 45f4c95b8486d458b6bf2377f99b40895d2afb0e678e5a9284b77ef065b482fd
                      • Instruction ID: 0bef4649372a7d9e2a7b78f13c6138b21c3d58284adc3174387f5d41b2703a4e
                      • Opcode Fuzzy Hash: 45f4c95b8486d458b6bf2377f99b40895d2afb0e678e5a9284b77ef065b482fd
                      • Instruction Fuzzy Hash: 3F31C43661DF8586DBA08F19F48431AB7A4F788B98F000125EACD83B68DF7DD554CB04
                      Function 00007FFDA338C480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON
                      Download Yara Rule
                      APIs
                      • new[].LIBCMTD ref: 00007FFDA338C4C9
                      • Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFDA338C4F6
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33AE068
                        • Part of subcall function 00007FFDA33AE050: std::locale::_Setgloballocale.LIBCPMTD ref: 00007FFDA33AE095
                        • Part of subcall function 00007FFDA33AE050: Concurrency::details::EventWaitNode::EventWaitNode.LIBCMTD ref: 00007FFDA33AE0FF
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33AE158
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA338C4BC
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EventLockitWaitstd::_$Concurrency::cancel_current_taskConcurrency::details::Lockit::_Lockit::~_NodeNode::Setgloballocalenew[]std::locale::_
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale
                      • API String ID: 2241008158-3987724511
                      • Opcode ID: d1185321319142bebfcd61f08487c4c5762ef391fbaf9cb11e667277f75212dc
                      • Instruction ID: 842ecc157880a33a3a648cec3ccab4450c51fe3244def063c0d851faa305a479
                      • Opcode Fuzzy Hash: d1185321319142bebfcd61f08487c4c5762ef391fbaf9cb11e667277f75212dc
                      • Instruction Fuzzy Hash: 0621E032A0AF828AD7449F15E5902A973A5FB58B48F249231DB4C57362EF3AD5E2C340
                      Function 00007FFDA33E6940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
                      Download Yara Rule
                      Strings
                      • minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp, xrefs: 00007FFDA33E69E2
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID:
                      • String ID: minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp
                      • API String ID: 0-2685728405
                      • Opcode ID: 1fbd6848e8c9d859454040a808c77f2a67984dead701bff7ecc43411c206922a
                      • Instruction ID: 3199343a2ce45c6c330ea545ae2b6b8ed139fd087c09cafa07b56210b319bd68
                      • Opcode Fuzzy Hash: 1fbd6848e8c9d859454040a808c77f2a67984dead701bff7ecc43411c206922a
                      • Instruction Fuzzy Hash: E121323271DE8181DA50EB15F45126AB3A1FB807A0F600735F6AD56BEADF7DD4148B04
                      Function 00007FFDA33A4650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                      Download Yara Rule
                      APIs
                      • new[].LIBCMTD ref: 00007FFDA33A467B
                      • Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFDA33A4702
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33AE068
                        • Part of subcall function 00007FFDA33AE050: std::locale::_Setgloballocale.LIBCPMTD ref: 00007FFDA33AE095
                        • Part of subcall function 00007FFDA33AE050: Concurrency::details::EventWaitNode::EventWaitNode.LIBCMTD ref: 00007FFDA33AE0FF
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33AE158
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA33A466D
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EventLockitWaitstd::_$Concurrency::cancel_current_taskConcurrency::details::Lockit::_Lockit::~_NodeNode::Setgloballocalenew[]std::locale::_
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale
                      • API String ID: 2241008158-3987724511
                      • Opcode ID: 4ca3dd4959a92f0a2304b0acf08b6c914f41439e60a19d7c44fc2a70d342f568
                      • Instruction ID: 7ad764764d4362c425ed9102f4e556bb9f0cc6df512681ea064fbb91dea6fd0c
                      • Opcode Fuzzy Hash: 4ca3dd4959a92f0a2304b0acf08b6c914f41439e60a19d7c44fc2a70d342f568
                      • Instruction Fuzzy Hash: 4A215672615F85D6D705EF24E46049C33B9FB08B48B548526DF9C2331AEF3AD9A4C384
                      Function 00007FFDA33A4CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                      Download Yara Rule
                      APIs
                      • new[].LIBCMTD ref: 00007FFDA33A4CDB
                      • Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFDA33A4D50
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::_Lockit.LIBCPMTD ref: 00007FFDA33AE068
                        • Part of subcall function 00007FFDA33AE050: std::locale::_Setgloballocale.LIBCPMTD ref: 00007FFDA33AE095
                        • Part of subcall function 00007FFDA33AE050: Concurrency::details::EventWaitNode::EventWaitNode.LIBCMTD ref: 00007FFDA33AE0FF
                        • Part of subcall function 00007FFDA33AE050: std::_Lockit::~_Lockit.LIBCPMTD ref: 00007FFDA33AE158
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA33A4CCD
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: EventLockitWaitstd::_$Concurrency::cancel_current_taskConcurrency::details::Lockit::_Lockit::~_NodeNode::Setgloballocalenew[]std::locale::_
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale
                      • API String ID: 2241008158-3987724511
                      • Opcode ID: 6d9b9a8031ea6d3d597514e6ca52f607eaf08d7aa45a1c9dd5c79d1b9765092e
                      • Instruction ID: b0fc783a96435432aabd4a3d84da06fada80e8187e4702be568a2858d7c74ffa
                      • Opcode Fuzzy Hash: 6d9b9a8031ea6d3d597514e6ca52f607eaf08d7aa45a1c9dd5c79d1b9765092e
                      • Instruction Fuzzy Hash: 2E116672615F85D6D705EF25E06009C33B9FB08B88B958526DF9C2331AEF3AD9A4C384
                      Function 00007FFDA34106D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: _handle_error
                      • String ID: !
                      • API String ID: 1757819995-2657877971
                      • Opcode ID: 58f80548405584300126f5307b0abbeb56c4e493f66a3dd2cac30c6f70468e38
                      • Instruction ID: 06fda60f1a46fc260a22e184e97fe2959f69bcbd4c81ff70c95a2bbe3ada076a
                      • Opcode Fuzzy Hash: 58f80548405584300126f5307b0abbeb56c4e493f66a3dd2cac30c6f70468e38
                      • Instruction Fuzzy Hash: 0C211676A18BC58AD360CF20E45435BFB61FBDA394F105316E68966A59EFBDD084CF00
                      Function 00007FFDA33EB8F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::details::_SchedulerScheduler::___crt_unique_heap_ptr
                      • String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
                      • API String ID: 4142048518-2192260110
                      • Opcode ID: 299da63e106db33b4b9f6053a64c69786a7eab512cff0bebb074328b0cfcfb5f
                      • Instruction ID: 16c246972c7185d5882daa61d9c702eb8f105b41d114af8c306b33974d036ac5
                      • Opcode Fuzzy Hash: 299da63e106db33b4b9f6053a64c69786a7eab512cff0bebb074328b0cfcfb5f
                      • Instruction Fuzzy Hash: 19215C7661EF8585DB60AB11E0903AEB7A1F7C4B84F504026EACD57BAADF3DC404CB00
                      Function 00007FFDA33B8660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd
                      • String ID: csm
                      • API String ID: 2516003560-1018135373
                      • Opcode ID: 3d468df72b71d04141ee0efeeef380821a8023c5777498227f807e8cb75fd156
                      • Instruction ID: 185f0b4547f06e2054a1f0d7f0eec646501041cbdda70aabe377fd03416caa8f
                      • Opcode Fuzzy Hash: 3d468df72b71d04141ee0efeeef380821a8023c5777498227f807e8cb75fd156
                      • Instruction Fuzzy Hash: 3F110A7660DB8982DA70AF15E09002A7BB5FB99B44F440225EBCD07B66CF7DC540CB08
                      Function 00007FFDA34113D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: __vcrt_getptd$__except_validate_context_record
                      • String ID: csm
                      • API String ID: 2542711375-1018135373
                      • Opcode ID: aca15a6cb97a560dc1add86d4d5ed306f2cd8914cf37c8d7b69f7eee2139e7dc
                      • Instruction ID: 9d4e6497fb2cfc5b8a04f4970ef18ff78b8b3fb0687ea902997536ea5b7f7d63
                      • Opcode Fuzzy Hash: aca15a6cb97a560dc1add86d4d5ed306f2cd8914cf37c8d7b69f7eee2139e7dc
                      • Instruction Fuzzy Hash: D1014836A0CB85C2C620EF45E05001EBBB5F7D9B94F100125EACC53B5ACF7EC4108B44
                      Function 00007FFDA33C6320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE
                      Download Yara Rule
                      APIs
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C632B
                        • Part of subcall function 00007FFDA33D1950: EnterCriticalSection.KERNEL32(?,?,?,?,00007FFDA33C2645,?,?,?,?,00007FFDA33C2352), ref: 00007FFDA33D1971
                        • Part of subcall function 00007FFDA33C4010: _CrtIsValidPointer.LIBCMTD ref: 00007FFDA33C4148
                      • __vcrt_lock.LIBVCRUNTIMED ref: 00007FFDA33C633E
                        • Part of subcall function 00007FFDA33D19E0: LeaveCriticalSection.KERNEL32 ref: 00007FFDA33D1A01
                      Strings
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: CriticalSection__vcrt_lock$EnterLeavePointerValid
                      • String ID: Object dump complete.
                      • API String ID: 214106405-632625063
                      • Opcode ID: 9b6c4bc64bbd9027e7e78ea7c96f646f25c7ee14e5f20167ec93217b7efa2171
                      • Instruction ID: 5b2fcae5be6940d4bf7931f53231dad283bbe53a4aeee28c673b5df5ff02f908
                      • Opcode Fuzzy Hash: 9b6c4bc64bbd9027e7e78ea7c96f646f25c7ee14e5f20167ec93217b7efa2171
                      • Instruction Fuzzy Hash: 98E0E531F1EA4241EB64B7B0A46246A2366AF80380F904839DB4EA3B67CE3FD0148508
                      Function 00007FFDA338BC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale, xrefs: 00007FFDA338BC37
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_tasknew[]
                      • String ID: C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.37.32822\include\xlocale
                      • API String ID: 2028883729-3987724511
                      • Opcode ID: 753f177e26b9a1781695a9e60be368b8532ef5a2df015b605bd757bd45a835bd
                      • Instruction ID: 77925899152494a1bc8f6ed964a845546b3c8c15dbddb1fc9a8e83c34259ca21
                      • Opcode Fuzzy Hash: 753f177e26b9a1781695a9e60be368b8532ef5a2df015b605bd757bd45a835bd
                      • Instruction Fuzzy Hash: B0D05E20F0FA828AFD49774288A1BF422521F44300F800835D90C227A3EE6E65058604
                      Function 00007FFDA33ADE20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON
                      Download Yara Rule
                      APIs
                      Strings
                      • D:\a\_work\1\s\src\vctools\crt\github\stl\src\locale0.cpp, xrefs: 00007FFDA33ADE4C
                      Memory Dump Source
                      • Source File: 00000003.00000002.4601432547.00007FFDA3381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDA3380000, based on PE: true
                      • Associated: 00000003.00000002.4601402018.00007FFDA3380000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601532295.00007FFDA341C000.00000002.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601608009.00007FFDA3502000.00000004.00000001.01000000.00000003.sdmpDownload File
                      • Associated: 00000003.00000002.4601630364.00007FFDA350D000.00000002.00000001.01000000.00000003.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_7ffda3380000_rundll32.jbxd
                      Similarity
                      • API ID: Concurrency::cancel_current_tasknew[]
                      • String ID: D:\a\_work\1\s\src\vctools\crt\github\stl\src\locale0.cpp
                      • API String ID: 2028883729-2407928748
                      • Opcode ID: fec10210aff4c5bff012f15687ded63816d2e8da8467b5a16e23b7f0933dda40
                      • Instruction ID: a5bd5b3d95aa1688087b6ecb2469263dac2447a90b952be9ae91da051ebd50db
                      • Opcode Fuzzy Hash: fec10210aff4c5bff012f15687ded63816d2e8da8467b5a16e23b7f0933dda40
                      • Instruction Fuzzy Hash: 27F0FE61E0DF8581E630BB00E06436A67A1F795348F500635E6CC16BAACF7FD5548B08

                      Executed Functions

                      Function 00007FFD346C3788 Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.2328671845.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: ZC
                      • API String ID: 0-2859832980
                      • Opcode ID: 3a021ec9f6f363b1cc590aff846cf58d1546402ba3c44d9f527124120940579d
                      • Instruction ID: 0408646e30f6e2be3a19f10510952eee1c32dd9551736cdd76d51bae87946859
                      • Opcode Fuzzy Hash: 3a021ec9f6f363b1cc590aff846cf58d1546402ba3c44d9f527124120940579d
                      • Instruction Fuzzy Hash: 7D417E62A0E3D24FE7176B6898B20E43F60DF93224B5D01FBC1D5CB0A3D91D684B97A5
                      Function 00007FFD3479351F Relevance: .1, Instructions: 123COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.2330168534.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6f033719e26190fe1c6e7352591e693f63a452f32603f52ce1243a9cdf4b6e6f
                      • Instruction ID: 3b4c7d12b3d4256771110df98a8d731e8cc1f320a533de08ab4bf99eda647923
                      • Opcode Fuzzy Hash: 6f033719e26190fe1c6e7352591e693f63a452f32603f52ce1243a9cdf4b6e6f
                      • Instruction Fuzzy Hash: BF311572B0DA858FEB95DA6C94A41B8B7D1EF4E324F1801BFD14DD7193DA1CB8059380
                      Function 00007FFD3479353A Relevance: .1, Instructions: 61COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.2330168534.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 34ce08d528be0d9cafb109f96f880b5dfad798ee5900b482547bc68b1830d769
                      • Instruction ID: 44f88cfb573546b25d8c20aa5672fe0eda391c310687244e6f078e396bac9a44
                      • Opcode Fuzzy Hash: 34ce08d528be0d9cafb109f96f880b5dfad798ee5900b482547bc68b1830d769
                      • Instruction Fuzzy Hash: E4112972B0D6498FEB95DA6C90A41B8B7D1EF4E314B0401BFC14EE7193D918BC058380
                      Function 00007FFD346C3715 Relevance: .0, Instructions: 49COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.2328671845.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                      • Instruction ID: 76c7a8516f93446f0fc3f1fc4a92c12573ae97e34c68bfaea83246ba135f494c
                      • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                      • Instruction Fuzzy Hash: 4601677125CB0C8FD754EF0CE491AA6B7E0FB95364F10056DE58AC3651D636E881CB45

                      Non-executed Functions

                      Function 00007FFD34790FB5 Relevance: .1, Instructions: 115COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000006.00000002.2330168534.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd34790000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: f490759a45b730f0926aa7b0f6f158fa8aeea53c823b19916289abe0ef513ef6
                      • Instruction ID: 1b3fd00c44c678e00f6dfa98fa04e5fa37ddac4488fc1705bf3bfd44c9950a50
                      • Opcode Fuzzy Hash: f490759a45b730f0926aa7b0f6f158fa8aeea53c823b19916289abe0ef513ef6
                      • Instruction Fuzzy Hash: 4031A092A0EBC15FE7939B7848B50607FB1EF5721470E05FBD188DB1A3E81DAC099352
                      Function 00007FFD346C86F2 Relevance: 7.6, Strings: 6, Instructions: 98COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000006.00000002.2328671845.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_6_2_7ffd346c0000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID: N_^$N_^$N_^$N_^$N_^$N_^
                      • API String ID: 0-1364355708
                      • Opcode ID: a0ac2af26b8fa7f92d4831242975fd390e4b2989288b31a6b97415e84c205e0a
                      • Instruction ID: 76dce88ede0a83fb58a260370ca5b6764752c7b7fefb47bccfbbb39c7bba7d2f
                      • Opcode Fuzzy Hash: a0ac2af26b8fa7f92d4831242975fd390e4b2989288b31a6b97415e84c205e0a
                      • Instruction Fuzzy Hash: 1531C1A3A4E6D25FD7279A3A4CB90E93F90AF53224B0911F6C6D4CF083FE0C58075252

                      Executed Functions

                      Function 00007FFD346C3788 Relevance: .1, Instructions: 134COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c0000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 338c4331bd7905b17e8723b1bda3b0f184db4ff7ea351675ec9c9a082a89a4e6
                      • Instruction ID: 4ad5a7673f7e8221dabd7188bbe799634c6e8eedc8ebc8e0ce351d927b12a9d4
                      • Opcode Fuzzy Hash: 338c4331bd7905b17e8723b1bda3b0f184db4ff7ea351675ec9c9a082a89a4e6
                      • Instruction Fuzzy Hash: 7F419762A0E7D20FE7136B6868B20E93F70DF93224B0901F7D1D4CB0A3D91D584AD755
                      Function 00007FFD346C6D38 Relevance: .1, Instructions: 132COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C5000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c5000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: bcbc960ae3fd08f7390a2b3294061ed8594870692740ffa4792ad1410e1de06c
                      • Instruction ID: 1b144b1e8255241d1278e5d394bc00212cfda97fdf8f279f973e91e00c970f95
                      • Opcode Fuzzy Hash: bcbc960ae3fd08f7390a2b3294061ed8594870692740ffa4792ad1410e1de06c
                      • Instruction Fuzzy Hash: F3314831A0C64C4FEB58DF5C988A3E97BE0EB97331F04826BD548C3166DA74A456CB92
                      Function 00007FFD346C68C8 Relevance: .1, Instructions: 125COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C5000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c5000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 222061e32712e5630db41b8812c4fd6e015d63918fad30e32659cf3c73cae606
                      • Instruction ID: 98cf2e6753da7902132aa474c5c4261cf254d45cd17d0e145d6242ea698a0a87
                      • Opcode Fuzzy Hash: 222061e32712e5630db41b8812c4fd6e015d63918fad30e32659cf3c73cae606
                      • Instruction Fuzzy Hash: 2731C73091CB4C8FDB1C9B5C9C466E97BE0FB5A321F00426FE449D3252CA74A856CBD2
                      Function 00007FFD346C6C68 Relevance: .1, Instructions: 101COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C5000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c5000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 42ed04cea1df9f7700eb0489186a0dc540c56f5ce3bcc5426502e2f219ab423d
                      • Instruction ID: bff03ba6a7a199f4f48492d3512366b6a4680f1add2cbf6b22e14d3bc14d0d0e
                      • Opcode Fuzzy Hash: 42ed04cea1df9f7700eb0489186a0dc540c56f5ce3bcc5426502e2f219ab423d
                      • Instruction Fuzzy Hash: 75212C7090CB4C4FDB58DF9C984A7E97BE0EB96331F04416FD448C3152DA74A456CB91
                      Function 00007FFD346C6AA8 Relevance: .1, Instructions: 74COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C5000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c5000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 73b4ea5079912ed186a69ae32396ac59102c30e9879fdb0292092ea57f7dcd0a
                      • Instruction ID: 94c6e224cde78b92ce6088a9b2435fc4f5f88841adbcb57de36a2a9bdb6aedc8
                      • Opcode Fuzzy Hash: 73b4ea5079912ed186a69ae32396ac59102c30e9879fdb0292092ea57f7dcd0a
                      • Instruction Fuzzy Hash: BB110B31908A8D4FDF49EF1884559E57FE0FF66310B0401AAE44DC71B2DB25E964CB81
                      Function 00007FFD346C3715 Relevance: .0, Instructions: 49COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 0000000B.00000002.2385439513.00007FFD346C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346C0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_11_2_7ffd346c0000_powershell.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                      • Instruction ID: 76c7a8516f93446f0fc3f1fc4a92c12573ae97e34c68bfaea83246ba135f494c
                      • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                      • Instruction Fuzzy Hash: 4601677125CB0C8FD754EF0CE491AA6B7E0FB95364F10056DE58AC3651D636E881CB45